Electronic data forensics combat training integrated equipment system

Abstract

The present invention discloses an electronic data forensics combat training integrated equipment system, the system includes two modules, a combat training integrated analysis module and a unified component development environment module, and the interfaces between the two modules are intercommunication; the combat training integrated analysis module is used to import and store multi-source data, and the main structure is divided into five layers, namely: data source layer, data processing layer, data storage layer, service support layer and data application layer; the unified component development environment module includes an analysis platform, a development platform and a sharing platform, wherein the analysis platform is used to import data, run forensic analysis components, and display historical analysis; the development platform is used for authorized users to use the development environment to develop forensic analysis components; the sharing platform is used to share the developed forensic analysis components. The present invention docks multiple resource platforms, integrates multiple analysis components, and can realize the analysis of massive data.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic data forensics, and in particular to an electronic data forensics combat and training integrated equipment system. Background Art

[0002] With the rapid development of information technology and applications such as cloud computing, artificial intelligence, and the Internet of Things, traditional crimes have spread to the Internet, and the electronic data involved in the case has increased exponentially. Data analysis will be the basis of future investigations. At present, electronic data forensics mostly emphasizes data extraction and recovery, requiring forensics personnel to analyze the extracted data to find related clues, but lacks the function of automatic in-depth analysis of data. From the perspective of network security work practice, current cybercrime presents ecological characteristics. To implement a full-chain crackdown, data analysis capabilities are particularly important. At present, there are the following difficulties in electronic data analysis:

[0003] (1) The multi-source nature of electronic data and the differences in analysis methods for various special cases make data analysis difficult. For example, the suspect data, related person data, and related case data obtained through evidence collection need to be stored, categorized, labeled, and compared. The evidence data needs to be comprehensively analyzed with public intelligence, police data, and network security big data to provide more in-depth clues for case investigation.

[0004] (2) General electronic data forensics systems have low sharing, poor scalability, and difficult maintenance. In the electronic data forensics scenario, although electronic data forensics equipment has a unified data standard, it is difficult to use flexible and convenient analysis tools to fully mine the data during data analysis, and there is a lack of analysis tools for different data and different projects. It is difficult to share data between different electronic data forensics systems, and it is difficult to expand data tools.

[0005] (3) The connection between the electronic data forensics system and the big data analysis system is relatively weak. Most of the data collected and stored in the forensics system is concentrated in the forensics system, and the data interoperability between forensics systems of different manufacturers is poor. Cyber ​​security police cannot take advantage of the superior systems of multiple manufacturers and make comprehensive use of the superior functions of different products. Summary of the invention

[0006] In order to solve the above problems, the present invention proposes an electronic data forensics combat and training integrated equipment system that can realize the sharing of forensic data and forensic analysis components.

[0007] In order to achieve the above object, the present invention is implemented by the following technical solutions:

[0008] The present invention is an electronic data forensics combat training integrated equipment system, the system includes two modules: a combat training integrated analysis module and a unified component development environment module, and the interfaces between the two modules are interconnected;

[0009] The combat training integrated analysis module is used to import and store multi-source data. The main structure is divided into five layers: data source layer, data processing layer, data storage layer, service support layer and data application layer.

[0010] The data source layer is used to collect data from different forensic devices and store it in the local NAS / storage unit;

[0011] The data processing layer is used to access data according to specifications and perform data preprocessing operations, including extraction, cleaning, association, comparison, and identification, and to classify and classify the preprocessed data and establish a data resource directory; the data storage layer is used to normalize and standardize the data according to data characteristics and application requirements, and to store it uniformly, and distribute it to the original library and multiple optional databases under the premise of security through the network security boundary, and provide interfaces for querying and calling standardized data resources;

[0012] The service support layer is used to provide external access and management capabilities for various data resources and provide capability support for the data application layer;

[0013] The data application layer is used to provide users with applications and tools, including practical applications and training exercises;

[0014] The unified component development environment module includes an analysis platform, a development platform and a sharing platform, wherein the analysis platform is used to import data, run forensic analysis components, and display historical analysis; the development platform is used for users to use the development environment to develop forensic analysis components; and the sharing platform is used to share developed forensic analysis components.

[0015] A further improvement of the present invention is that the data source layer supports the import of forensic equipment data, the import of data within the network security big data platform, the import of external platform data, and the import of local platform data. The data comes from electronic device forensic data, network big data, evidence retrieval data, Internet open source data, and data from joint investigation of specific case data.

[0016] A further improvement of the present invention is that the data import operation of the evidence collection device accesses the evidence collection report and BCP data packet data generated by the evidence collection device in both synchronous and asynchronous modes.

[0017] A further improvement of the present invention is that the data source layer supports the conversion of HTML reports into BCP standard format, specifically including:

[0018] Create a thread pool and multiple concurrent HTML parsing threads;

[0019] Use the thread pool to preprocess the HTML report, including removing unnecessary tags, styles and scripts; assign the preprocessed single or multiple HTML reports to multiple HTML parsing threads for parsing as required, and determine the fields and corresponding values ​​to be extracted according to the requirements of the BCP standard format, organize and arrange the fields and values ​​in the specified format according to the template of the BCP standard format, and save them as a text file or generate a data structure containing BCP format information. The HTML parsing library in each HTML parsing thread can be customized according to requirements, including custom settings of the parser type, encoding settings, fault tolerance mechanism, and custom selection of CSS selectors;

[0020] The thread pool periodically detects whether the HTML report is updated, and reallocates the updated HTML report to the corresponding HTML parsing thread for parsing.

[0021] A further improvement of the present invention is that the data extraction method in the data processing layer includes: image extraction, backup file parsing, HTML report parsing and BCP file restoration.

[0022] A further improvement of the present invention is that both the data source layer and the data processing layer support the function of periodically detecting whether the HTML report is updated, and re-parsing the updated HTML report, including using a hash algorithm to read the content of the HTML report, and using a hash function to calculate a summary or hash value of the read content, and comparing it with the saved summary or hash value of the last parsed HTML report. If the comparison result is inconsistent, it means that the HTML report has been updated, and the HTML report parsing operation is re-performed.

[0023] A further improvement of the present invention is that the analysis platform and the development platform provide an operation interface for users to directly operate, and run offline as an independent local terminal when not connected to the shared platform.

[0024] A further improvement of the present invention is that the sharing platform includes a front-end interactive interface and a back-end component manager, through which forensic analysis components are searched, uploaded and downloaded, and through which the component manager provides component management services for users connected to the sharing platform.

[0025] A further improvement of the present invention is that: the local terminal of the sharing platform is connected to the sharing platform in an internet-connected state, equipped with a unified operating environment and a unified development environment, the local terminal of the sharing platform is connected to the sharing platform to download the forensic analysis component, the user uses a mobile device to connect to the local terminal of the sharing platform in a unified operating environment, applies the forensic analysis component downloaded to the local terminal to collect evidence on the forensic device, or uses the forensic analysis component to perform in-depth analysis on single case data, and at the same time, the user can develop customized forensic analysis components in a unified development environment according to needs, and share the developed forensic analysis components to the sharing platform through the local terminal of the sharing platform.

[0026] The beneficial effects of the present invention are as follows: the present invention supports the acquisition of various types of forensic data, network big data, evidence collection data, Internet open source data, etc., and quickly performs data preprocessing and governance after data access. It connects to multiple resource platforms, supports data visualization analysis, supports the expansion of analysis tools, integrates multiple analysis components and third-party analysis tools, and can achieve universal, compatible, and multi-dimensional analysis of different types of data. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 This is the architecture diagram of the electronic data forensics combat training integrated equipment system of the present invention;

[0028] Figure 2 This is the architecture diagram of the combat and training integrated analysis module in this embodiment;

[0029] Figure 3 It is a logical architecture diagram of the development business of the forensic analysis component for small data in this embodiment;

[0030] Figure 4 4 is a flow chart of data analysis in this embodiment. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0032] like Figure 1As shown, this embodiment is an integrated equipment system for electronic data forensics combat and training, including software and hardware. It is built by multiple servers in a forensics laboratory, connected to multiple resource platforms, and integrates multiple forensics analysis components. It can realize the analysis of massive data and is suitable for case analysis with large amounts of data. Each server is equipped with multiple hard disks and uses a RAID 5 array. Each server is equipped with multiple network cards, storage and business isolation, and multiple VLANs are established for network isolation to prevent Trojan virus LAN broadcasts. Create an Internet LAN and regularly connect to the Internet to upgrade the software through a physical network switch. The database is sharded, with redundant copies, and the health status of the shards is monitored in real time, and repaired automatically at regular intervals. To ensure the security of data transmission, the data transmission of this embodiment uses the SSL encryption protocol.

[0033] The system includes two modules: an integrated combat and training analysis module and a unified component development environment module, and the interfaces between the two modules are interconnected. The security audit component is used to record the operations of the integrated combat and training analysis module and the unified component development environment module, and supports triggering illegal operation alarms and notifications based on preset rules and security policies.

[0034] like Figure 2 As shown, the combat training integrated analysis module is used to import and store multi-source data. The entire module is layered and decoupled, and the main structure is divided into five layers, namely: data source layer, data processing layer, data storage layer, service support layer and data application layer;

[0035] The data source layer is used to collect data from different forensic devices and store it in the local NAS / storage unit;

[0036] The data processing layer is used to access data according to specifications and perform data preprocessing operations, including extraction, cleaning, association, comparison, and identification, and to classify and classify the preprocessed data and establish a data resource directory. Accessing data according to specifications includes: defining the data interface between the data source layer, including determining the data format, transmission protocol, and authentication and authorization mechanism; defining data extraction rules; defining data quality inspection specifications, using data quality inspection specifications to verify the consistency, completeness, and accuracy of the extracted data to achieve data cleaning; defining a data association system; defining data comparison rules, comparing data from different sources or at different time points to find differences or anomalies; defining a label system according to the case type and establishing data labels.

[0037] The data storage layer is used to normalize and standardize the data according to the data characteristics and application requirements, and uniformly store it, and distribute it to the original library and multiple optional databases under the premise that the network security boundary is safe, and provide interfaces for querying and calling standardized data resources; among them, the optional databases include resource libraries, subject libraries and knowledge bases.

[0038] The service support layer is used to provide external access and management capabilities for various data resources, and provide capability support for the data application layer. The service support layer supports the ability to access data in the data storage layer, and provides the data in the data storage layer to the data application layer. The service support layer provides security and permission control capabilities, adopts the OAuth2.0 standard protocol, and implements RBAC role permission control. Users can log in through KEY encryption, and authorized users can access data resources. The service support layer also supports the use of caching technology, query and other means to provide efficient data access and query capabilities.

[0039] The data application layer is used to provide users with applications and tools, including practical applications and training exercises. The tools include analysis tools and forensic tools.

[0040] The unified component development environment module includes an analysis platform, a development platform, and a sharing platform. The analysis platform is used to import data, run forensic analysis components, and display historical analysis; the development platform is used for users to use the development environment to develop forensic analysis components; and the sharing platform is used to share developed forensic analysis components.

[0041] The data source layer supports the import of structured data and unstructured data. Structured data includes data in mainstream databases, excel tables, csv, txt and other file formats. Unstructured data includes pictures, voice, video, etc. It also supports the integration of OCR, voice transcription, voiceprint recognition, video analysis, face recognition, bank card recognition, document recognition, pornography detection and other AI technologies for in-depth data analysis. The data in the data source layer can specifically include the import of forensic equipment data, the import of proprietary data in the network security big data platform, the import of external platform data, and the import of local platform data. The import of forensic equipment data can be synchronized and asynchronously connected to the forensic reports and BCP data packets generated by the mainstream forensic vendors, and support the transcription of HTML reports into the BCP standard format. Proprietary data in the network security big data platform, including network behavior logs in the network security big data platform. Virtual identity association information. External platform data, including bank platforms, exchanges, third-party payment platforms, etc. Funds verification data, operator platform bills, and blockchain data. Importing data from local platforms, including supporting the import of data related to specific cases, connecting to local police integrated platforms, criminal investigation platforms, blockchain traceability platforms, password cracking platforms and other local platforms, making efficient use of police resources and maximizing the use of public security business systems. Imported forensic data is stored in local NAS / storage units, which use RAID 5 arrays.

[0042] Convert HTML reports to BCP standard format, including:

[0043] Create a thread pool and multiple concurrent HTML parsing threads;

[0044] Use the thread pool to preprocess the HTML report, including removing unnecessary tags, styles and scripts; assign the preprocessed single or multiple HTML reports to multiple HTML parsing threads for parsing as required, and determine the fields and corresponding values ​​to be extracted according to the requirements of the BCP standard format, organize and arrange the fields and values ​​in the specified format according to the template of the BCP standard format, and save them as a text file or generate a data structure containing BCP format information. The HTML parsing library in each HTML parsing thread can be customized according to requirements, including custom settings of the parser type, encoding settings, fault tolerance mechanism, and custom selection of CSS selectors;

[0045] The thread pool periodically detects whether the HTML report is updated, and reallocates the updated HTML report to the corresponding HTML parsing thread for parsing.

[0046] The data processing layer implements data access, preprocessing and management. It accesses the data in the data source layer according to the specifications, performs data preprocessing operations such as extraction, cleaning, association, comparison, identification, and reorganization, and classifies the data, establishes a data resource directory, and sets the data management life cycle according to the case situation.

[0047] The extraction of raw data from mobile phones and other electronic devices includes the following methods:

[0048] Image Extraction: Supports the analysis of various electronic data image files, including but not limited to various Apple images and Android images. Supports image files of various iOS system versions of Apple, and supports the analysis and restoration of Android image files of Android 7.0 and above.

[0049] Backup file analysis: Supports analysis of various electronic original backup files, such as backup files generated by Apple based on iTunes or other Apple backup tools, and various backup files generated by mobile phone assistants such as Huawei Assistant.

[0050] HTML report parsing: supports HTML reports generated by various electronic data vendors, and provides fast compatibility with derivative versions or new versions of HTML reports.

[0051] BCP file restoration: supports XML and BCP structured data restoration capabilities, and all data combing standards meet the requirements of unified standards, such as dictionary tables, data formats, naming rules, etc.

[0052] The data source layer and the data processing layer both support the function of periodically detecting whether the HTML report is updated, and re-parse the updated HTML report, including using a hash algorithm to read the content of the HTML report, and using a hash function to calculate the summary or hash value of the read content, and compare it with the summary or hash value of the HTML report parsed last time. If the comparison result is inconsistent, it means that the HTML report has been updated, and the HTML report parsing operation is performed again. It is also possible to use the file timestamp and HTTP response header to detect whether the HTML report is updated, wherein the file timestamp method specifically includes saving the modification timestamp of the HTML report parsed last time, and then comparing the modification timestamp of the current HTML report with the last saved value at the next check. If the modification timestamp of the current HTML report is newer, it means that the HTML report has been updated and needs to be re-parsed. The HTTP response header method specifically includes that the HTML report is obtained through the HTTP protocol, and the Last-Modified field or ETag field in the HTTP response header can be checked, and the last modification time or unique identifier of the HTML report can be obtained through the Last-Modified field or ETag field, and the value of the obtained field is compared to determine whether the HTML report is updated. In addition, if the HTML report is obtained through the Webhook mechanism, a callback URL is set, and when the HTML report is updated, a notification will be sent to the callback URL. After receiving the notification, the updated HTML report can be re-parsed.

[0053] Data cleaning: Use a unified data cleaning mechanism to completely clean the data, solve data quality issues, and facilitate data mining. Data cleaning mainly includes the following operations:

[0054] 1. Data integrity processing, solving data integrity defects in various types of loaded data, such as missing types in identity information, missing source information of various types of data, and cleaning of irrational data;

[0055] 2. Data uniqueness processing to solve various existing duplicate data, such as multiple account information, duplicate friend information, duplicate chat information, duplicate fund source details, etc.;

[0056] 3. Data authority processing: for all types of information, with the help of unified judgment basis, the uniqueness of data is achieved, such as the loss or offset of timestamp information in the same chat, the conflict of unique ID and nickname in friend information, and the normalization of information of group chat members and friends;

[0057] 4. Data legitimacy processing, effectively clean up unreasonable and common sense-violating data, such as chat records initiated too early, funds transferred with values ​​exceeding the scope of common sense, and the lengths of various IDs exceeding the cognitive range, etc.;

[0058] 5. Data consistency processing mainly solves the problem of unifying the relevance and uniqueness of various types of data. For example, all friend IDs use a unified ID specification, all types of information of all suspected objects use a unique ID identifier, and all types of data use a unique coding rule for unique subject setting.

[0059] Backfill the data obtained from the cleaning operation: adopt a reasonable data backfill mechanism to reasonably supplement various data to facilitate data analysis and mining. Data backfill mainly includes backfilling of registration information, mutual supplementation of subject registration information and associated friend objects of various electronic accounts, backfilling between transfer information account and registration information, backfilling between account information such as mobile phone numbers and virtual accounts, and data backfilling between chat time and friend chat information.

[0060] Data association: Complete data association to avoid the emergence of data islands, including the following operations:

[0061] a. Establish a complete data hierarchical structure. All electronic data have a complete hierarchical data association system from similar cases to individual cases, individual cases to suspected objects, and suspected objects to electronic data types. Through data association, complete electronic data integration can be established;

[0062] b. Establish effective associations for dependent data types, such as the association between address book friends and call records, the association between social friends and social chat content, the association between group friends and social friends, the association between transfer objects and social friends, etc.;

[0063] c. Effectively associate cross-APP or cross-application data, such as the association between payment objects and chat objects, the association between payment objects and mobile phone friends, the association between payment accounts and social accounts, etc.

[0064] Data labels: Establish various data labels based on the various labeling systems provided for each type of case, and perform labeling management on the pulled case-related data.

[0065] Data reorganization: reorganize unreasonable data for the second time to solve the problem of obviously unreasonable data in various types of data, and use ideas that conform to conventional logic to reasonably split, supplement, and reconstruct the data. For example, WeChat public accounts are determined as WeChat friends, WeChat friends are determined as WeChat public accounts, Alipay general financial management accounts are set as Alipay friends, the same transfer object has multiple entity transfer targets, etc. Various types of pictures of various social networks exist in different forms and are not effectively centrally processed.

[0066] Establish a data resource catalog, including: building a complete data resource catalog for various types of cases, various data sources, and various data types, and dividing them into travel, shopping, social, payment, etc. according to the data application type; according to the cases involved by the persons involved, effectively classify the data involved according to the basic classification structure of the cases; and according to the identity type of the persons involved, compile catalogs of various identity levels for various identities.

[0067] The data storage layer provides standardized data resource query interface and standardized data resource call interface. The standardized data resource query interface facilitates users to query data resources with a graphical interface, including super archive retrieval and content full-text retrieval. Super archives mainly include basic personnel information, tag information, important identification numbers, time and space trajectories, relationship maps, criminal records and other data. Content full-text retrieval provides target object data search, case data search, analysis result search, etc., and supports multi-condition combination search and fuzzy search, precise search, logical search and other search methods for case, time, content, application and other data. The standardized data resource call interface adopts a multi-user mode, extracts data and then analyzes it. Each user uses the extracted database data independently to avoid mutual influence between users.

[0068] The analysis platform and development platform provide an operation interface for users to operate directly, and run offline as an independent local terminal when not connected to the shared platform. There are multiple report templates built into the analysis platform, and users can select them as needed after analysis, quickly generate a forensic report with one click, and the analysis platform can simultaneously push the forensic report to other reserved users. In addition, based on the forensic report, users can independently judge the forensic data according to their needs, and push files such as evidence collection data and conversation materials to other users according to the needs of the judgment. The tools that can be included in the report template are shown in Table 1:

[0069] Table 1 Report template tools

[0070]

[0071] Users define output visualization analysis results through report templates.

[0072] The sharing platform includes a front-end interactive interface and a back-end component manager. The front-end interactive interface is used to search, upload and download forensic analysis components. The component manager provides component management services for users connected to the sharing platform. Multiple electronic data forensics combat and training integrated equipment development platforms can be connected to the services provided by the same sharing platform, which facilitates the use of shared forensic analysis components in multiple locations and points to carry out electronic evidence analysis business at the same time.

[0073] The local terminal of the sharing platform is connected to the sharing platform in an online state, equipped with a unified operating environment and a unified development environment. The local terminal of the sharing platform is connected to the sharing platform to download the forensic analysis component. The user uses a mobile device to connect to the local terminal of the sharing platform in a unified operating environment, and applies the forensic tools in the forensic analysis component downloaded to the local terminal to collect evidence on the forensic device, or uses the analysis tools in the forensic analysis component to conduct in-depth analysis of single case data. The specific analysis process is as follows: Figure 4 As shown, the analysis content and analysis methods may include character portraits, inspection material analysis, artificial intelligence, technical and combat warnings, and research and judgment notes. Character portraits are used to describe the identity information, frequently used accounts, social patterns, economic patterns, data information, relatives and friends, frequent haunts, warning clues, etc. of the subject.

[0074] The evidence analysis supports the analysis of evidence involved in the case, and analyzes the social accounts, personal relationships, funds, network traces, etc. of the subjects involved.

[0075] Artificial intelligence can identify and analyze pictures, videos, voices, etc. obtained through forensics.

[0076] In addition, if the user of the electronic data forensics combat and training integrated equipment system is an administrator, he or she can assign tasks through the project task window in the front-end interactive interface. Users assigned to the corresponding tasks can access the relevant data after logging in with their account and password.

[0077] Users can develop customized forensic analysis components in a unified development environment according to their needs, and share the developed forensic analysis components to the shared platform through the local terminal of the shared platform. In this embodiment, the development and application of small data forensic analysis components are as follows: Figure 3 shown.

[0078] The functional modules of the front-end interactive interface are shown in Table 2:

[0079] Table 2 Functional modules

[0080]

[0081] In this embodiment, the process of using the electronic data forensics combat training integrated equipment system to perform forensic analysis is as follows:

[0082] Preparation: Users download corresponding forensic analysis components from the sharing platform according to task requirements;

[0083] Import data: For forensic data, if it has been collected through forensic software and can be read through a standardized interface, it can be called directly through the standardized interface; if it has not been collected through forensic software, it is necessary to connect the forensic device and use the forensic tools in the forensic analysis component downloaded to the local terminal to collect evidence. The resulting data is imported into the database of the data storage layer and then called by the standardized interface.

[0084] Data analysis: Analysis can be performed using analysis tools in the forensic analysis component downloaded from the sharing platform. Analysis tools can also be customized according to case requirements.

[0085] Result output: The analysis results and visualization results can be output in the form of reports.

[0086] Storage stage: The developed analysis tools with general value will be standardized according to the standards and the corresponding design documents will be provided and shared on the sharing platform to facilitate other authorized users to download and use.

[0087] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as those generally understood by those skilled in the art in the art to which the present invention belongs. It should also be understood that terms such as those defined in common dictionaries should be understood to have the same meaning as in the context of the prior art, and will not be interpreted with an idealized or overly formal meaning unless defined similarly here.

[0088] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. Electronic data forensics combat and training integrated equipment system, characterized by: The system includes a combat and training integrated analysis module and Unify the component development environment module into two modules, and the interfaces between the two modules are interoperable; The combat training integrated analysis module is used to import and store multi-source data. The main structure is divided into five layers, namely: Data source layer, data processing layer, data storage layer, service support layer and data application layer; The data source layer is used to collect data from different forensic devices and store it in the local NAS / storage unit; The data processing layer is used to access data according to specifications and perform data preprocessing operations, including extraction, cleaning, association, comparison, Identify and classify the pre-processed data and establish a data resource directory; The data storage layer is used to normalize and standardize data according to data characteristics and application requirements, and store them uniformly through the network. The network security boundary is distributed to the original library and multiple optional databases under the premise of security, and provides standardized data resource query Query and call interface; The service support layer is used to provide external access and management capabilities for various data resources and provide capability support for the data application layer; The data application layer is used to provide applications and tools for authorized users, including practical applications and training exercises; The unified component development environment module includes an analysis platform, a development platform and a sharing platform, wherein the analysis platform is used to Import of data, operation of forensic analysis components, and display of historical analysis; the development platform is used by authorized users to develop The environment is used to develop forensic analysis components; the sharing platform is used to share the developed forensic analysis components; The data source layer supports the import of forensic equipment data, the import of data within the network security big data platform, and the import of data from external platforms. Import and local platform data; The data source layer supports converting HTML reports into BCP standard formats, including: Create a thread pool and multiple concurrent HTML parsing threads; Use thread pool to pre-process HTML reports, including removing unnecessary tags, styles and scripts; Assign the pre-processed single or multiple HTML reports to multiple HTML parsing threads for parsing as required, and According to the requirements of the BCP standard format, determine the fields and corresponding values ​​that need to be extracted, and convert the fields into The data and values ​​are organized and arranged in the specified format and saved as a text file or a data file containing BCP format information is generated. According to the structure, the HTML parsing library in each HTML parsing thread can be customized according to the needs, including parsing Custom settings for the type of decoder, encoding settings, fault tolerance mechanism, and custom selection of CSS selectors; The thread pool periodically detects whether the HTML report is updated and reallocates the updated HTML report to the corresponding HTML The parsing thread performs parsing; The data extraction methods in the data processing layer include: image extraction, backup file parsing, HTML report parsing and BCP document parsing. Parts restoration; The data source layer and the data processing layer both support the function of regularly detecting whether the HTML report is updated, and The HTML report is re-parsed, including reading the content of the HTML report using a hash algorithm and using a hash function Computes a digest or hash of the content being read and compares it with the saved digest or hash of the last parsed HTML report. If the comparison results are inconsistent, it means that the HTML report has been updated and the HTML report parsing operation is performed again; Accessing data according to the specification includes: defining the data interface between the data source layer, including determining the data format, transmission protocol, define data extraction rules; define data quality inspection specifications, and use data quality inspection specifications to verify Verify the consistency, completeness, and accuracy of the extracted data, and implement data cleaning; define the data association system; define data Compare rules, compare data from different sources or at different time points to find differences or anomalies; define labels based on case types system, establish data labels; Data cleaning includes the following operations: data integrity processing, data uniqueness processing, data authority processing, data Legality processing and data consistency processing; Backfill the data obtained from the cleaning operation: Use a reasonable data backfill mechanism to perform reasonable backfilling of various data. It is added; Data backfill includes registration information backfill, the subject registration information of various electronic accounts and the interaction information of associated friend objects. To complement, the backfill between the transfer information account and the registration information, including the information between the mobile phone number account information and the virtual account Backfill of information, backfill of data between chat time and friend chat information; Data association: Complete data association to avoid the emergence of data islands, including the following operations: a. Establish a complete data hierarchy architecture; b. Establish effective associations for dependent type data; c. Effectively associate data across apps or applications; Data labeling: Establish various data labels based on the various labeling systems provided by various types of cases, and label the pulled case data Conduct label management; Establish a data resource catalog, including: building a complete data resource for various cases, various data sources, and various data types Table of contents; The forensic device data import operation uses both synchronous and asynchronous methods to access the forensic reports and BCP data generated by the forensic device. According to the packet data; The analysis platform and development platform provide an operation interface for authorized users to directly operate. The local terminal of the sharing platform is connected to the sharing platform in a networked state, and the Download the unified operating environment and unified development environment, and connect the local terminal of the shared platform to the shared platform to download the forensic analysis component. Users use mobile devices to connect to the local terminal of the shared platform in a unified manner. In the unified operating environment, the application has been downloaded to the local terminal. The forensic analysis component can be used to collect evidence from the forensic device, or the forensic analysis component can be used to conduct in-depth analysis of single case data. Users can develop customized forensic analysis components in a unified development environment according to their needs and The files are shared to the sharing platform through the local terminal of the sharing platform.

2. The electronic data forensics combat and training integrated equipment system according to claim 1 is characterized by: The shared platform It includes a front-end interactive interface and a back-end component manager. Through the front-end interactive interface, forensic analysis components can be searched, Upload and download operations, provide component management services to users connected to the sharing platform through the component manager.

Images