A cloud forensics system and method based on remote control

Abstract

A remote control-based cloud forensics system is disclosed, comprising an application cloud forensics subsystem and a core algorithm system, the core algorithm system comprising a core algorithm client subsystem and a server subsystem, the application cloud forensics subsystem, the core algorithm client subsystem and the core algorithm server subsystem each comprising a basic component module; the cloud forensics subsystem further comprises a crawler module, an auxiliary verification module, a first plug-in management module and a network communication client module, the core algorithm client subsystem further comprises a network communication server module, a second plug-in management module and an RPC client module, the core algorithm server subsystem further comprises a service listening module and an RPC server module; the network communication client module is in communication connection with the network communication server, the RPC server module is in communication connection with the RPC client module, and a corresponding program is called for data interception by means of JavaScript script injection. The present application can greatly reduce the reverse research and development investment and improve the development efficiency of cloud forensics reverse and productization.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cloud forensics, and in particular to a cloud forensics system and method based on remote control. BACKGROUND

[0002] With the development of mobile Internet technology, more and more mainstream APPs store various sensitive data in the cloud. The core data that can be obtained by traditional forensics technology is becoming less and less, and consequently, a large amount of cloud data forensics follows. For example, many domestic chat APPs currently have not only chat functions but also transaction functions, thereby facilitating users' daily use. However, the more important transaction data is generally stored in the cloud, which effectively ensures the security of sensitive data. The current traditional cloud forensics technology mainly includes cloud forensics technology based on web protocols, cloud forensics technology based on APP protocols, cloud forensics technology based on simulation environment simulation, cloud forensics technology based on mobile terminal traffic data interception and other means. The reverse analysis cost of each scheme is relatively high, and the development cycle is also relatively long. In addition, due to the increasing detection of data security by mainstream APPs, the investment cost of APP protocol upgrade and various risk control bypass technologies is also increasing. The efficiency improvement for such problems is also rising to a crucial position.

[0003] The advantages and disadvantages of the above-mentioned several cloud forensics technologies are as follows: web protocol analysis and APP protocol analysis need to perform protocol reverse analysis, and the difficulties that may be encountered include: using JS reverse, OLLVM obfuscation restoration, VMP shell, etc., which requires a large amount of human research cost and a long time. Due to the detection and limitation of various Hook frameworks by mainstream APPs for the purpose of protecting data security, the number of APPs that can use simulation environment is gradually decreasing. Mobile terminal traffic data interception needs to install a certificate on the mobile terminal, and needs to perform data restoration processing on the intercepted data, which is high in cost. In addition, the user needs to install a certificate on the mobile terminal and perform various settings, which is complicated to operate, and is not very suitable for daily forensics scenarios. SUMMARY

[0004] In order to solve the above technical problems in the prior art, the present application proposes a cloud forensics system and method based on remote control to solve the above technical problems.

[0005] According to a first aspect of the present application, a remote control-based cloud forensics system is provided, comprising an application cloud forensics subsystem and a core algorithm system, the core algorithm system comprising a core algorithm client subsystem and a core algorithm server subsystem, the application cloud forensics subsystem, the core algorithm client subsystem and the core algorithm server subsystem each comprising a basic component module for being responsible for basic business function encapsulation, third-party library encapsulation and general business logic management; the cloud forensics subsystem further comprises a crawler module, an auxiliary verification module, a first plug-in management module and a network communication client module, the core algorithm client subsystem further comprises a network communication server module, a second plug-in management module and an RPC client module, the core algorithm server subsystem further comprises a service listening module and an RPC server module; the network communication client module is in communication connection with the network communication server module, the RPC server module is in communication connection with the RPC client module, and a corresponding program is called for data interception by means of JavaScript script injection.

[0006] In some specific embodiments, in the application cloud forensics subsystem: the crawler module is configured for APP network request protocol simulation, including login and two-part request protocol simulation of various types of cloud data, to complete APP login and cloud data extraction functions; the auxiliary verification module is configured for processing security verification operations of APPs in the login and data request processes, to assist the crawler module to complete login and cloud data request through simulation of actual APP scenarios; the first plug-in management module is configured for starting corresponding cloud forensics crawler modules according to cloud forensics business requirements, and managing the crawler modules; and the network communication client module is configured for network communication with the server, sets custom information including evidence ID, APP name, account and request interface, and assists the crawler module to complete cloud forensics functions.

[0007] In some specific embodiments, the crawler module comprises a plurality of APP crawler modules, and each APP crawler module is independent of each other and is responsible for cloud data crawling of a respective APP.

[0008] In some specific embodiments, in the core algorithm client subsystem: the network communication server module is configured for listening to information transmitted by the network communication client module in the application cloud forensics subsystem, and transmitting the information to the second plug-in management module for processing; the second plug-in management module is configured for receiving and analyzing custom information of the network communication server module, loading specified parameters according to APP-specific configurations, transmitting the parameters to the RPC client module, and transmitting results received by the RPC client module to the network communication server module in a specified custom format; and the RPC client module is configured for transmitting process name, page name and related parameter information of a corresponding APP to the RPC server module in the core algorithm server subsystem for processing by means of RPC, and sending returned results to the second plug-in management module.

[0009] In some specific embodiments, in the core algorithm service end subsystem: the service monitoring module is configured to start and monitor the core algorithm mainboard service; and the RPC server module is configured to, after the core algorithm mainboard is started, respond to a request of an RPC client, call an interface of an APP Java layer according to passed script calling information, and inform the RPC client module of a returned result.

[0010] In some specific embodiments, the application cloud forensics subsystem, the core algorithm client end subsystem and the core algorithm service end subsystem share a set of basic component modules.

[0011] In some specific embodiments, the application cloud forensics subsystem and the core algorithm client end subsystem depend on a windows hardware part for running, and the core algorithm service end subsystem depends on a core algorithm mainboard, which is configured with a Frida binary executable file and a forwarding monitoring port, and a custom start script.

[0012] According to a second aspect of the present application, a cloud forensics method based on remote control is provided, which utilizes the cloud forensics system as described above, and includes the following steps:

[0013] S1: after the application cloud forensics subsystem is started, a login and an interface request operation of an APP are responded to, and if the core algorithm service needs to be started for assistance, a first plug-in management module in the application cloud forensics subsystem encapsulates a custom message required by the APP, and a network communication client module is used to transmit the message;

[0014] S2: a network communication service end module in the core algorithm client end subsystem receives and analyzes the custom message, maps an APP name and a structure name, and corresponds cloud forensics business data with actual APP data;

[0015] S3: the core algorithm client end subsystem uses a remote calling mode to enumerate application processes running on the core algorithm mainboard, performs remote injection operation on the application processes after matching the process names, and transmits relevant simulation js script information to the core algorithm service end subsystem;

[0016] S4: the core algorithm service end subsystem simulates APP Java layer code logic according to the js script information, performs corresponding interface parameter transmission and returned result interception, and returns the returned result to the core algorithm client end subsystem module, and the core algorithm client end subsystem module encapsulates a custom message and transmits it back to the application cloud forensics subsystem;

[0017] S5: the application cloud forensics subsystem performs a request of a corresponding login / request interface, and completes cloud end data extraction.

[0018] In some specific embodiments, S1 further comprises, if the core algorithm service assistance is not required to be started, directly performing corresponding login, interface request operation according to the network protocol request, and if the auxiliary security verification is triggered in the process, the corresponding verification operation is completed by the auxiliary verification module of the application cloud evidence subsystem.

[0019] In some specific embodiments, the encapsulation of the self-defined message in S1 includes APP name information, interface name, and login / request interface parameter information.

[0020] In some specific embodiments, S2 further comprises: detecting whether the Frida client is started, and performing corresponding result return and exception handling for various exceptions.

[0021] According to a third aspect of the present application, a computer readable storage medium is provided, which stores one or more computer programs, and the one or more computer programs are executed by a computer processor to implement the above method.

[0022] The present application provides a cloud evidence system and method based on remote control, which effectively reduces the reverse cost by increasing the software and hardware modules, greatly improves the development efficiency of cloud evidence reverse and productization, and can be popularized to other mobile phone evidence systems in the future. Through the construction of this architecture, the rapid development efficiency of specific APP cloud evidence can be greatly reduced, for example, the productization function of VMP reinforced application has been realized, the effect is significant, and it is also helpful for the reverse of other anti-confusion applications. The possibility of cloud electronic data evidence can be effectively improved. BRIEF DESCRIPTION OF DRAWINGS

[0023] The accompanying drawings are included to provide a further understanding of embodiments and are incorporated in and constitute a part of this specification. The drawings illustrate embodiments and serve to explain principles of the present application. Other embodiments and many of the intended advantages of the present application will be readily appreciated as the same becomes better understood by reference to the following detailed description when considered in connection with the accompanying drawings, wherein:

[0024] Figure 1 is a cloud evidence system architecture based on remote control according to an embodiment of the present application;

[0025] Figure 2 is a flowchart of a cloud evidence method based on remote control according to an embodiment of the present application;

[0026] Figure 3 is a cloud evidence request flowchart based on remote control according to a specific embodiment of the present application;

[0027] Figure 4 A schematic diagram of the structure of a computer system suitable for implementing the electronic devices of the present application. Detailed Implementation

[0028] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0029] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0030] Figure 1 A diagram illustrating the architecture of a remote-controlled cloud forensics system according to an embodiment of this application is shown. Figure 1 As shown, the system comprises a cloud-based forensics business system and a core algorithm system. The core algorithm system includes a core algorithm client subsystem and a core algorithm server subsystem. The cloud-based forensics subsystem and the core algorithm client subsystem rely on Windows hardware to run, while the core algorithm server subsystem relies on the core algorithm motherboard. It primarily handles RPC calls, injecting JavaScript into the corresponding program via Frida calls to ultimately capture data. All three systems share a set of basic component modules. The system is ultimately implemented as a piece of equipment, relying on specific hardware. The hardware component includes specialized Windows hardware and the core algorithm motherboard. The Windows hardware handles cloud-based forensics business processing, while the core algorithm server motherboard handles remote control of the various app interfaces.

[0031] In specific embodiments, the application cloud forensics subsystem includes: a basic component module, a crawler module, an auxiliary verification module, a plug-in management module, a network communication client module. Among them, the basic component module: responsible for basic business function encapsulation, third-party library encapsulation, etc., all the business logic of the cloud forensics system with universality is managed; the crawler module: responsible for APP network request protocol simulation, including login, two parts of each type of cloud data request protocol simulation, finally completing the login of APP and the extraction function of cloud data, the crawler module contains several APP crawler modules, the modules are independent of each other, and are responsible for the extraction of cloud data of each APP; the auxiliary verification module: this module is mainly used to process the security verification operation of APP in the login and data request process, through the simulation of the actual scene of APP, the auxiliary crawler module completes the login and cloud data request, for example, the security verification of sliding block, graphic click, trajectory drawing, etc. in the login process; the plug-in management module: according to the cloud forensics business requirements, the corresponding cloud forensics crawler module is started, and the crawler module management is carried out; the network communication client module: responsible for network communication with the server, setting specified provisions, including evidence ID, APP name, account, request interface and other custom information, assisting the crawler module to complete the cloud forensics function.

[0032] In specific embodiments, the core algorithm client subsystem includes: a basic component module, a plug-in management module, a network communication server module, a PRC client module. Among them, the basic component module: responsible for basic business function encapsulation, third-party library encapsulation, etc., all the business logic of the cloud forensics system with universality is managed; the network communication server module: listens to the information transmitted by the application cloud forensics subsystem-network communication client module, and transmits the corresponding information to the plug-in management module for processing; the plug-in management module: after receiving the custom information of the network communication server module, the custom information is analyzed, the specified parameters are loaded according to the specified configuration of each APP, and are transmitted to the RPC client module, and the results received by the RPC client module are transmitted to the network communication server module according to the specified custom format; the RPC client module: responsible for transmitting the process name, page name, related parameters and other information of the corresponding APP to the core algorithm server subsystem-RPC server module for processing through RPC, and sending the returned result to the plug-in management module.

[0033] In specific embodiments, the core algorithm service subsystem includes: a basic component module, an RPC service end module, and a service detection module. Among them, the basic component module: responsible for basic business function encapsulation, third-party library encapsulation, etc., all the business logic of the cloud forensics system with universality is managed; the service listening module: responsible for starting and listening to the core algorithm mainboard service, ensuring the normal operation of the core algorithm mainboard and service, and ensuring the stability of cloud forensics calling; the RPC server module: the core algorithm mainboard starts automatically after starting, responsible for responding to RPC client requests, and calling the corresponding APP Java layer interface simulation according to the script calling information passed, and informing the RPC client module of the return result.

[0034] In specific embodiments, the core algorithm mainboard is a customized mainboard, which is equipped with an Arm 64-bit high-performance CPU, and is matched with an Android Pie9.0 Root operating system, installs a Frida binary executable file and forwards a listening port, and customizes a start script, which is convenient for remote calling control. In the later period, the Frida version adaptability is enhanced, and the corresponding Android version and CPU are also upgraded, so as to meet the business needs of the cloud forensics system.

[0035] With reference to Figure 2 , Figure 2 a cloud forensics method flowchart based on remote control according to an embodiment of the present application is shown, as Figure 2 shown, the method mainly includes the following steps:

[0036] S1: after the application cloud forensics subsystem is started, in response to the login, interface request operation of a certain APP, if the core algorithm service needs to be started for assistance, the APP needs to pass the encapsulation of the custom message by the first plug-in management module in the application cloud forensics subsystem, and the message is transmitted through the network communication client module.

[0037] In specific embodiments, if the core algorithm service does not need to be started for assistance, directly according to the network protocol request, the corresponding login, interface request operation is performed, and if there is a trigger auxiliary security verification in the process, the auxiliary verification module of the application cloud forensics subsystem is used to complete the corresponding verification operation. The encapsulation of the custom message includes APP name information, interface name, and login / request interface parameter information.

[0038] S2: the network communication service end module in the core algorithm client subsystem receives and analyzes the custom message, maps the APP name and structure name, and corresponds the cloud forensics business data with the actual APP data.

[0039] In some specific embodiments, S2 further comprises detecting whether the Frida client and the related application are started, and performing corresponding result returning and exception handling for various types of exceptions.

[0040] S3: The core algorithm client subsystem enumerates the application processes running on the core algorithm mainboard through remote calling, matches the process name, performs remote injection operation on the application process, and transmits the related simulation js script information to the core algorithm server subsystem.

[0041] S4: The core algorithm server subsystem simulates the APP Java layer code logic according to the js script information, performs corresponding interface parameter transmission and returns the result, and returns the returned result to the core algorithm client subsystem module, which then performs custom message packaging and transmits it back to the application cloud evidence subsystem.

[0042] S5: The application cloud evidence subsystem performs corresponding login / request interface request to complete cloud data extraction.

[0043] In specific embodiments, Figure 3 a cloud evidence request flowchart based on remote control according to one specific embodiment of the present application is shown, as Figure 3 shown, the cloud evidence request step comprises:

[0044] The core algorithm mainboard is powered on, the operating system is started, the core algorithm service hardware module is powered on and started, and the core algorithm service client is connected. After connection, the cloud evidence module is started, the APP login / interface request operation is started, and it is judged whether the core algorithm service calculation is needed. If not, the APP login and interface request are performed, and the cloud evidence is executed according to the expected business; if yes, the cloud evidence process network communication module is started, the network communication with the core algorithm service client is performed, the APP name, interface name, login parameter, request parameter, etc. are converted, the converted parameters are sent to the core algorithm service client through network message, the core algorithm client subsystem analyzes the cloud evidence sending data, and the Frida client initialization operation is performed. It is judged whether the core algorithm service target process is started. If not, the corresponding process is started. After the process is started, the cloud evidence process name is matched with the Frida enumeration process name, the attach operation is performed after the matching, the mainboard corresponding process is actively called, the corresponding js script information is read, and the js script calling is performed. The js script performs core algorithm calling according to the APP java layer / so layer calling mode, the js script execution is performed in the core algorithm server subsystem, the APP corresponding interface result is returned and transmitted to the core algorithm client subsystem, the APP interface return result is accepted, the application cloud evidence subsystem performs APP login and interface request, and the cloud evidence is executed according to the expected business.

[0045] The remote control-based cloud forensic system and method of the present application plays a certain role in improving the efficiency of cloud forensics, and can also be promoted to other aspects of electronic data forensics in the future to provide method support for the breakthrough of other technologies. The scheme focuses on shortening the reverse reduction time of various APPs. Through the combination of software and hardware, interface simulation and data interception are performed through remote control, effectively solving the time waste caused by the difficulty of interface function reduction in the cloud forensics process. Once this technology is put into use, the reverse efficiency of cloud data extraction of APPs with reverse difficulties will be improved by several times. This scheme can be used to achieve a technical breakthrough for difficult algorithms and hardened applications.

[0046] The cloud forensic system of the present application has completed the productization work, and the feasibility has been verified. The reverse efficiency of the VMP hardened APP is greatly improved, and the original reverse research and development cost is reduced by at least 5 times or more. At present, it has been put into supporting the development of cloud forensics functions of more than 3 key applications. Due to the reusability of public basic components and interface modes, the product development efficiency is also improved by more than 1 times. The actual effect of so algorithm obfuscation reduction needs to be further explored. Due to the limitation of the core algorithm mainboard operating system version and the Frida version, the version matching problem can be updated in time in the future.

[0047] Reference is made below to Figure 4 which shows a structural schematic diagram of a computer system of an electronic device suitable for implementing the embodiments of the present application. Figure 4 The electronic device shown is merely an example and should not impose any limitation on the functions and use range of the embodiments of the present application.

[0048] As shown in Figure 4 , the computer system includes a central processing unit (CPU) 401 which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 402 or programs loaded from a storage portion 408 into a random access memory (RAM) 403. In the RAM 403, various programs and data required for the operation of the system 400 are also stored. The CPU 401, the ROM 402, and the RAM 403 are connected to each other through a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0049] The following components are connected to the I / O interface 405: an input section 406 including a keyboard, a mouse, etc.; an output section 407 including a display such as a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 408 including a hard disk, etc.; and a communication section 409 including a network interface card such as a LAN card, a modem, etc. The communication section 409 performs communication processing via a network such as the Internet. A drive 410 is also connected to the I / O interface 405 as necessary. A removable recording medium 411 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is attached to the drive 410 as necessary, so that a computer program read out therefrom is installed in the storage section 408 as necessary.

[0050] In particular, the processes described above with reference to the flowcharts can be implemented as a computer software program in accordance with embodiments of the present disclosure. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer readable storage medium, the computer program comprising program code for performing the methods illustrated by the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via the communication section 409, and / or installed from the removable media 411. When the computer program is executed by the central processing unit (CPU) 401, the above-described functions defined in the methods of the present application are performed. It should be noted that the computer readable storage medium of the present application can be a computer readable signal medium or a computer readable storage medium or any combination of the two. The computer readable storage medium may, for example, be - but is not limited to - an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any suitable combination of the above. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus or device. In the present application, the computer readable signal medium can include a data signal carried in a baseband or as part of a carrier wave, in which the computer readable program code is carried. Such a propagated data signal can take any of a variety of forms, including but not limited to electro-magnetic, optical, or any suitable combination thereof. The computer readable signal medium can also be any computer readable storage medium that can be used for by or in connection with an instruction execution system, apparatus or device, and that can contain or store a program for use by or in connection with an instruction execution system, apparatus or device. The program code contained on the computer readable storage medium can be transmitted by any suitable medium, including but not limited to wireless, wire line, optical fiber cable, RF, etc., or any suitable combination of the above.

[0051] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0052] The computer program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0053] The modules involved in the embodiments of the present application can be implemented in the form of software, or can be implemented in the form of hardware.

[0054] As another aspect, the application also provides a computer readable storage medium, which can be included in the electronic device described in the above embodiments, or can exist independently without being assembled into the electronic device. The computer readable storage medium carries one or more programs, when the one or more programs are executed by the electronic device, the electronic device is caused to: after the application cloud forensics subsystem is started, in response to login, interface request operation of an APP, if it is needed to start the core algorithm service for assistance, the APP needs to pass the encapsulation of the custom message by the first plug-in management module in the application cloud forensics subsystem, and the message is transmitted through the network communication client module; the network communication server module in the core algorithm client subsystem receives and analyzes the custom message, maps the APP name and the structure name, and corresponds the cloud forensics business data and the actual APP data; the core algorithm client subsystem enumerates the application processes running on the core algorithm mainboard through the remote calling mode, matches the process name, performs remote injection operation on the application process, and transmits the related simulation js script information to the core algorithm server subsystem; the core algorithm server subsystem simulates the APP Java layer code logic according to the js script information, performs corresponding interface parameter transmission and return result interception, and returns the return result to the core algorithm client subsystem module, and the core algorithm client subsystem module encapsulates the custom message again and transmits it back to the application cloud forensics subsystem; the application cloud forensics subsystem performs corresponding login / request interface request, and completes the cloud data extraction.

[0055] The above description is merely the preferred embodiments of the present application and the explanation of the applied technical principles. It should be understood by those skilled in the art that the scope of the application involved in the present application is not limited to the technical solutions formed by the specific combinations of the above technical features, and should also cover other technical solutions formed by any combinations of the above technical features or their equivalent features without departing from the above inventive concept. For example, the above features can be replaced with the technical features disclosed in the present application (but not limited to) having similar functions to form technical solutions.

Claims

1. A remote control based cloud forensics system, characterized in that, The application comprises an application cloud forensics subsystem and a core algorithm system, the core algorithm system comprises a core algorithm client subsystem and a core algorithm server subsystem, the application cloud forensics subsystem, the core algorithm client subsystem and the core algorithm server subsystem each comprise a basic component module for being responsible for basic business function encapsulation, third-party library encapsulation and general business logic management; the cloud forensics subsystem further comprises a crawler module, an auxiliary verification module, a first plug-in management module and a network communication client module, the core algorithm client subsystem further comprises a network communication server module, a second plug-in management module and an RPC client module, the core algorithm server subsystem further comprises a service listening module and an RPC server module; the network communication client module is in communication connection with the network communication server, the RPC server module is in communication connection with the RPC client module, and a corresponding program is called by JavaScript script injection to intercept data; S1: after the application cloud forensics subsystem is started, in response to login and interface request operation of an APP, if the core algorithm service needs to be started for assistance, the first plug-in management module in the application cloud forensics subsystem encapsulates a custom message required to be transmitted by the APP, and the network communication client module is used for message transmission; S2: the network communication server module in the core algorithm client subsystem receives and analyzes the custom message, maps the APP name and the structure name, and corresponds the cloud forensics business data with the actual APP data; S3: the core algorithm client subsystem uses a remote calling mode to enumerate application processes running on a core algorithm mainboard, matches the process name, remotely injects the application processes, and transmits relevant simulated js script information to the core algorithm server subsystem; S4: the core algorithm server subsystem simulates APP Java layer code logic according to the js script information, performs corresponding interface parameter transmission and returns result interception, returns the return result to the core algorithm client subsystem module, the core algorithm client subsystem module encapsulates and transmits a custom message back to the application cloud forensics subsystem; S5: the application cloud forensics subsystem performs a request corresponding to login / request interface, and completes cloud data extraction.

2. The remote control based cloud forensics system of claim 1, wherein, The application cloud evidence subsystem comprises: a crawler module configured for APP network request protocol simulation, including login and two-part request protocol simulation of various types of cloud data, to complete APP login and cloud data extraction functions; an auxiliary verification module configured for processing security verification operations of the APP in the login and data request process, to assist the crawler module to complete login and cloud data request through simulation of the actual scene of the APP; a first plug-in management module configured for starting corresponding cloud evidence crawler modules according to cloud evidence business requirements, and managing the crawler modules; and a network communication client module configured for network communication with a server, setting custom information including evidence ID, APP name, account, and request interface, to assist the crawler module to complete cloud evidence functions.

3. The remote control based cloud forensics system of claim 2, wherein, The crawler module comprises a plurality of APP crawler modules, and each APP crawler module is independent of each other and is responsible for cloud data crawling of a respective APP.

4. The remote control based cloud forensics system of claim 1, wherein, In the core algorithm client subsystem: the network communication server module is configured to listen to information transmitted by the network communication client module in the application cloud evidence subsystem, and transmit the information to the second plug-in management module for processing; the second plug-in management module is configured to receive and analyze custom information of the network communication server module, load specified parameters according to the specified configuration of each APP, transmit the parameters to the RPC client module, and transmit the results received by the RPC client module to the network communication server module in the specified custom format; The RPC client module is configured to transmit the process name, page name, and related parameter information of the corresponding APP to the RPC server module in the core algorithm server subsystem through the RPC mode for processing, and send the returned result to the second plug-in management module.

5. The remote control based cloud forensics system of claim 1, wherein, In the core algorithm server subsystem: the service listening module is configured to start and listen to the core algorithm mainboard service; and the RPC server module is configured to respond to the RPC client request after the core algorithm mainboard is started, simulate the calling of the APP Java layer interface according to the transmitted script calling information, and notify the RPC client module of the returned result.

6. The remote control based cloud forensics system of claim 1, wherein, The application cloud evidence subsystem, the core algorithm client subsystem, and the core algorithm server subsystem share a set of basic component modules.

7. The remote control based cloud forensics system of claim 1, wherein, The application cloud evidence subsystem and the core algorithm client subsystem depend on the windows hardware part for running, and the core algorithm server subsystem depends on the core algorithm mainboard, which is configured with a Frida binary executable file and a forwarding listening port, and a custom start script.

8. The remote control based cloud forensics system of claim 1, wherein, The S1 further comprises: if the core algorithm service assistance is not required, directly performing corresponding login and interface request operations according to the network protocol request, and if the auxiliary security verification is triggered in the process, the corresponding verification operation is completed by the auxiliary verification module of the application cloud evidence subsystem.

9. The remote control based cloud forensics system of claim 1, wherein, The encapsulation of the self-defined message in the S1 includes APP name information, interface name, and login / request interface parameter information.

10. The remote control based cloud forensics system of claim 1, wherein, The S2 further includes detecting whether the Frida client is started, and performing corresponding result return and exception handling for various exceptions.

Images