A clue data matching method, system, electronic device and storage medium

Abstract

The present application relates to the technical field of information security, and discloses a clue data matching method, system, electronic device and storage medium, wherein the method comprises obtaining a target data set of a target source; extracting target key information from the target data set; matching an associated source from an information database according to the target key information; wherein the information database is associated with the target source, and the associated source corresponds to the target key information; obtaining an associated data set corresponding to the associated source from the information database; calculating the degree of association between the associated source and the target source according to a preset association algorithm based on the target key information and the associated data set; if the degree of association is higher than a preset association threshold, the associated source is used as a pre-analysis source; if feature information is identified from the analysis data set of the pre-analysis source, the analysis data set is sent to an analysis center; wherein the analysis center is pre-set to correspond to the pre-analysis source. The present application can improve the data matching degree of clues.

Description

Technical Field

[0001] The present application relates to the technical field of information security, and in particular to a clue data matching method, system, electronic device and storage medium. Background Art

[0002] The particularity of cyber cases leads to great difficulties in collecting evidence. Therefore, only limited information can be traced at present; however, in the process of tracing, due to the large amount of data to be traced, it is more difficult to collect evidence; therefore, the matching degree of clue data is low, which is not conducive to supporting the judgment of the case. Summary of the invention

[0003] In order to improve the current data matching degree in case clues to support case analysis, the present application provides a clue data matching method, system, electronic device and storage medium.

[0004] This application provides a clue data matching method, which adopts the following technical solution:

[0005] A clue data matching method comprises the following steps:

[0006] Get the target data set of the target source;

[0007] Extracting target key information from the target data set;

[0008] Matching an associated source from an information database according to the target key information; wherein the information database is associated with the target source, and the associated source corresponds to the target key information;

[0009] Acquire a set of associated data corresponding to the associated source from the information database;

[0010] According to the target key information and the associated data set, and in accordance with a preset association algorithm, the degree of association between the associated source and the target source is calculated;

[0011] If the correlation degree is higher than a preset correlation threshold, the correlation source is used as a pre-analysis source;

[0012] If characteristic information is identified from the analysis data set of the pre-analysis source, the analysis data set is sent to an analysis center; wherein the analysis center is pre-set to correspond to the pre-analysis source.

[0013] By adopting the above technical solution, according to the case information provided by the user (target source), that is, the target data set, the target key information is extracted, such as name, social account, phone number, payment and receipt bank card information, etc., and the associated source associated with it is retrieved from the information database. There may be one or more associated sources. The correlation degree of the associated data set in the associated source is judged. If the correlation degree is high, the pre-analysis source is continued to be analyzed to extract the information associated with this user, and provide the analysis center with rich case materials; thereby, the current data matching degree in case clues can be improved, and the efficiency and quality of case judgment can be improved.

[0014] Optionally, the step of extracting target key information from the target data set further includes:

[0015] parsing target data in the target data set;

[0016] Identify the content in the target data and generate corresponding target text information;

[0017] Identifying and matching the target key information from the target text information through a first template;

[0018] If the target key information cannot be matched through the first template recognition, then according to the target text information, a first historical data set associated with the target text information is acquired from a preset historical database;

[0019] Obtaining a second template corresponding to the first historical data set;

[0020] identifying and matching target key information from the target text information using the second template;

[0021] Alternatively, the second template in the first historical data set is merged with the first template to obtain a first merged template; the target key information is identified and matched from the target text by using the first merged template;

[0022] Alternatively, a first fused set is obtained by fusing the first historical data set and the target data set; a second template in the first historical data set is fused with the first template to obtain a first fused template; and the target key information is matched from the first fused set using the first template, the second template or the first fused template.

[0023] By adopting the above technical solution, the target data can be pictures, recordings, videos or other forms of files. For different files, different methods are used to read all the contents in the files and process them into text information. In addition, for the matching method of the target key information, if the data in the target data set is limited, the matching data method can be increased, such as replacing the relevant matching template, that is, the first template, the second template or the first fusion template, to further match; if no further match is found, the matching data range can be increased.

[0024] Optionally, the step of matching the associated source from the information database according to the target key information further includes:

[0025] designated key information of a designated portion from the target key information;

[0026] Matching associated information overlapping with the designated key information from the information database;

[0027] According to the association information, matching the association source corresponding to the association information;

[0028] If the associated source corresponding to the associated information cannot be matched according to the associated information, then according to the associated information, using the third template in the historical database, a historical source corresponding to the associated information is matched within a set historical time T1; wherein the set historical time T1 is a time within a set time period T1 before the current moment;

[0029] Acquire a second historical data set associated with the historical source;

[0030] extracting historical key information from the second historical data set;

[0031] Determine the correlation between the historical key information and the target key information. If the correlation is greater than a preset value, use the historical source as the correlation source; otherwise, feedback-adjust the span of the set historical time T1 to increase the set historical time T1 to the set historical time T2;

[0032] Alternatively, the first template and the third template are fused to obtain a second fused template; and the associated source is matched from the information database through the second fused template.

[0033] By adopting the above technical solution, for example, a social account is designated as designated key information, and the information database is searched according to the designated key information to retrieve the associated information containing the designated key information, so as to find the associated source according to the associated information. In addition, for the matching method of the associated source, if the data in the information database is limited, the matching data method can be increased, such as replacing the relevant matching template, that is, the third template or the second fusion template, to further match, and if no further match is found, the matching data range can be increased.

[0034] Optionally, the association algorithm includes:

[0035] parsing the associated data in the associated data set;

[0036] Identify the content in the associated data and generate corresponding associated text information;

[0037] Acquire other key information in the target key information except the specified key information;

[0038] From the associated text information, identifying information that overlaps with the other key information;

[0039] The degree of association is calculated according to the weights corresponding to all the information in the target key information, and the degree of association is the sum of the weights corresponding to the information in the other key information that overlaps with the associated text information.

[0040] By adopting the above technical solution, as a further search judgment, if the associated data set also includes other key information in the target key information except the specified key information, the sum of the weights of the other identified key information is finally calculated, which is the association degree.

[0041] Optionally, if feature information is extracted from the analysis data set of the pre-analysis source, the step of sending the analysis data set to the analysis center includes:

[0042] Acquire the analysis data set;

[0043] Identifying characteristic text from the analysis data set;

[0044] According to a preset first recognition algorithm, a first result is identified from the feature text;

[0045] Sending the first result to a preset model library, and matching a second result through a second recognition algorithm in the model library;

[0046] According to the second result, obtaining a context of the second result in the feature text;

[0047] Recognize the context in the feature text according to a third recognition algorithm, and determine whether the context in the feature text contains the feature information;

[0048] If the feature information is included, matching the target feature corresponding to the feature information from the model library;

[0049] The analysis data set is sent to the analysis center according to the correspondence between the target feature and the analysis center; wherein the analysis center is pre-set to correspond to the target feature in the pre-analysis source.

[0050] By adopting the above technical solution, the first result is identified from the feature text of the analysis data set, for example, the chat record, that is, the information suspected to be the feature information is preliminarily obtained; then it is sent to the preset model library, the information suspected to be the feature information is matched with the recognition algorithm in the model library, and the accurate information, that is, the second result, is screened out; the context of the accurate information appearing in the chat record is again audited to ensure that it is the feature information, and the belonging information of the target feature is matched from the model library, and based on the belonging information, it is provided to the analysis center corresponding to the target feature after the audit is completed.

[0051] Optionally, the method further comprises:

[0052] Cleaning the target text information and the associated text information into a first target format and entering the format into the information database;

[0053] The target source and the associated source are cleaned into a second target format and entered into the information database.

[0054] By adopting the above technical solutions, the quality, consistency, comprehensibility and usability of data can be improved.

[0055] Optionally, the method further comprises:

[0056] Constructing index fields for the information database;

[0057] According to different contents of the index field, corresponding word segmentation parameters are set, and the word segmentation parameters are associated with the contents of the index field;

[0058] The length of the word segmentation parameter is dynamically adjusted, and the adjustment steps include:

[0059] The length of the word segmentation parameter is inversely related to the time span of the first historical data set and the second historical data set in the historical database, wherein the time span is the time span within a set time period from the current time to the current moment;

[0060] Alternatively, the length of the word segmentation parameter is inversely related to the region span of the first historical data set and the second historical data set in the historical database, wherein the region span is the number of different regions involved in the data set.

[0061] By adopting the above technical solution, the query efficiency is improved and the performance of data retrieval is optimized. In addition, the length of the word segmentation parameter, that is, the granularity of the word, will directly affect the accuracy and relevance of the data matching degree. Too long or too short a word segmentation parameter may affect the relevance of the retrieval results. Too long a word segmentation may cause the short words related to the query to be missed, while too short a word segmentation may introduce noise words that are irrelevant to the query intent. When the time span increases, the length of the word segmentation parameter will decrease; conversely, when the time span decreases, the length of the word segmentation parameter will increase. When the area involved in the data set increases, the length of the word segmentation parameter will decrease; when the area decreases, the length of the word segmentation parameter will increase. The practice of dynamically adjusting the length of the word segmentation parameter can make the word segmentation more flexible and adaptable. Under different time spans or area spans, the word segmentation parameters can be adjusted according to the actual situation to obtain better word segmentation effects.

[0062] The present application provides a clue data matching system, which adopts the following technical solutions:

[0063] A clue data matching system, based on the above clue data matching method, includes the following modules:

[0064] An information processing module is used to obtain a target data set from a target source; and extract target key information from the target data set;

[0065] A search query module is used to match the associated source from the information database according to the target key information; wherein the information database is associated with the target source, and the associated source corresponds to the target key information; and obtain the associated data set corresponding to the associated source from the information database;

[0066] The correlation judgment module calculates the correlation between the correlation source and the target source according to the target key information and the correlation data set in accordance with a preset correlation algorithm; if the correlation is higher than a preset correlation threshold, the correlation source is used as a pre-analysis source; if feature information is identified from the analysis data set of the pre-analysis source, the analysis data set is sent to an analysis center; wherein the analysis center is pre-set to correspond to the pre-analysis source.

[0067] By adopting the above technical solution, the information processing module extracts the target key information, such as name, social account, phone number, payment and receipt bank card, etc., from the case information provided by the user (target source), that is, the target data set. The retrieval query module retrieves the associated sources associated with it from the information database. There may be one or more associated sources. The correlation judgment module performs correlation judgment on the associated data set in the associated source. If the correlation is high, the pre-analysis source is continued to be analyzed to extract the information associated with the user and provide the analysis center with rich case materials; thereby improving the current data matching degree in case clues and improving the efficiency and quality of case judgment.

[0068] The present application provides an electronic device, which adopts the following technical solution:

[0069] An electronic device includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above-mentioned clue data matching method when calling the computer program in the memory.

[0070] The present application provides a storage medium, which adopts the following technical solution:

[0071] A storage medium stores computer executable instructions, which, when loaded and executed by a processor, implement the steps of the above-mentioned clue data matching method.

[0072] In summary, the present application includes at least one of the following beneficial technical effects:

[0073] The present application can extract target key information from the target data set of the acquired target source, retrieve the associated sources associated with the target key information in the information database, and then judge the degree of association of the associated data set of the associated source to obtain the pre-analysis source and its analysis data set, and continue to judge whether there is characteristic information in the analysis data set. If so, it means that the analysis data set has a high degree of match with the required case clues, thereby improving the efficiency and quality of data processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] Figure 1 It is a method step diagram of a clue data matching method.

[0075] Figure 2 It is a data relationship diagram among target source, associated source, and information database in a clue data matching method.

[0076] Figure 3 The invention is a sub-step diagram for extracting target key information from the target data set in a clue data matching method.

[0077] Figure 4 The invention relates to a clue data matching method, in which a sub-step diagram is used to match an associated source from an information database according to the target key information.

[0078] Figure 5 It is a correlation relationship diagram between the target source and the associated source in a clue data matching method.

[0079] Figure 6 It is a relationship diagram between the historical database and the information database in a clue data matching method.

[0080] Figure 7 It is a step diagram of the association algorithm in the clue data matching method.

[0081] Figure 8 A sub-step diagram of a clue data matching method, wherein if feature information is extracted from the analysis data set of the pre-analysis source, the analysis data set is sent to an analysis center. DETAILED DESCRIPTION

[0082] The present application is further described in detail below in conjunction with the accompanying drawings. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0083] An embodiment of the present application discloses a clue data matching method.

[0084] Reference Figure 1 and Figure 2 , a clue data matching method, the method comprising the following steps:

[0085] Obtain the target data set of the target source; the target source provides the user with the address or carrier for storing data; the target data set includes pictures, recordings, videos or other forms of files.

[0086] Extract target key information from the target data set; target key information, such as name, social account, phone number, payment and receipt bank card information, etc.

[0087] According to the target key information, the associated source is matched from the information database; wherein the information database is associated with the target source, and the associated source corresponds to the target key information. The information database includes data in the form of pictures, audio files or other files, which is the authorization information obtained before the implementation of this method, and the database is built based on the above information.

[0088] Acquire a set of associated data corresponding to an associated source from an information database;

[0089] According to the target key information and the associated data set, the association degree between the associated source and the target source is calculated according to the preset association algorithm.

[0090] If the correlation degree is higher than the preset correlation threshold, the correlation source is used as a pre-analysis source;

[0091] If feature information is identified from the analysis data set of the pre-analysis source, the analysis data set is sent to the analysis center; wherein the analysis center is pre-set to correspond to the pre-analysis source.

[0092] Based on the case information provided by the user (target source), that is, the target data set, the target key information is extracted, and the associated sources associated with it are retrieved from the information database. There may be one or more associated sources, and the correlation degree is judged for the associated data set in the associated source. If the correlation degree is high, the pre-analysis source is continued to be analyzed to extract the information associated with this user and provide the analysis center with rich case materials; thereby improving the current data matching degree in case clues and improving the efficiency and quality of case judgment.

[0093] Reference Figure 2 , the data range of the target data set may not completely belong to the information database.

[0094] Reference Figure 3 , the step of extracting target key information from the target data set also includes:

[0095] Parse the target data in the target data set; the target data can be pictures, recordings, videos, or other forms of files.

[0096] Identify the content in the target data and generate corresponding target text information;

[0097] The target key information is identified and matched from the target text information through the first template.

[0098] For example, you can use the model library to recognize images, such as introducing the ultra-lightweight PaddleOCR model library, inputting images into the model library to recognize them as text information. Parse files of different formats, mainly including doc, docx, xls, xlsx, txt, sqlite, apk, html, etc., read all the contents in the file, and process them into text information.

[0099] If the target key information cannot be matched through the first template recognition, then according to the target text information, a first historical data set associated with the target text information is obtained from a preset historical database, and a second template corresponding to the first historical data set is obtained.

[0100] In this embodiment, if the target key information cannot be matched through the first template recognition, it may be due to the matching degree of the template or the limited data provided by the target source. Therefore, there are several other methods that can be used as methods for matching the key target information:

[0101] Method 1: Use the second template to identify and match the target key information from the target text information. For example, the matching content of the first template is the string: 1-3-5-7 (match in order); the target text information contains the strings: 1, 3, 5, 8, 7; the matching content of the second template is the string: 1, 5, 3, 7 (match not in order); using the first template, only the string: 1, 3, 5 can be matched in order; in fact, the string: 1, 3, 5, 7 can all be obtained in the target text information; and using the second template, all matching data can be obtained. Therefore, the data obtained using the first template has a low matching degree.

[0102] Method 2: Fuse the second template in the first historical data set with the first template to obtain the first fused template; identify and match the target key information from the target text through the first fused template. The fusion method can be based on the position relationship. For example, the name, phone number and email address have a specific order or relative position relationship in the text, and some are selected in order and some are set in disorder. Or set according to the separator, such as comma, colon, semicolon, etc. to separate different information items.

[0103] Method 3: By fusing the first historical data set and the target data set, a first fused set is obtained, and the target key information is matched from the first fused set using the first template, the second template, or the first fused template in method 2. This method expands the data matching range and the corresponding data matching method, thereby improving the matching degree of clues as much as possible.

[0104] Therefore, with regard to the matching method of target key information, if the data in the target data set is limited, the matching data method can be increased, such as replacing the relevant matching templates, i.e. the first template, the second template or the first fusion template, to further match; if no further match is found, the matching data range can also be increased to improve the accuracy and completeness of clue matching.

[0105] Reference Figure 4 and Figure 5 and Figure 6 The step of matching the associated source from the information database according to the target key information also includes:

[0106] designated key information from a designated portion of the target key information;

[0107] Match the related information that overlaps with the specified key information from the information database; the relationship diagram can be referred to Figure 5 .

[0108] According to the association information, the association source corresponding to the association information is matched.

[0109] For example, a social account is designated as designated key information, and the information database is searched according to the designated key information to retrieve related information containing the designated key information, thereby finding the related source according to the related information.

[0110] If the associated source corresponding to the associated information cannot be matched according to the associated information, then according to the associated information, the third template in the historical database is used to match the historical source corresponding to the associated information within the set historical time T1; wherein the set historical time T1 is the time within the set time period T1 before the current moment. For example, if T1 is the time of the past year, the historical source in the historical data of the past year in the historical database is matched.

[0111] A second historical data set associated with the historical source is obtained.

[0112] In this embodiment, there are several ways to match association sources:

[0113] Method 1: extracting historical key information from the second historical data set;

[0114] Determine the correlation between historical key information and target key information. If the correlation is greater than the preset value, the historical source is used as the correlation source; otherwise, feedback adjusts the span of the set historical time T1, and increases the set historical time T1 to the set historical time T2; continues to obtain the second historical data set associated with the historical source, thereby increasing the data range of the second historical data set. If no match is found in the database of the past year, the scope can be expanded to match the past two years, where the data of the past year has been matched. In order to reduce the steps of repeated operation, T2 is the data of the year before in the past two years. In addition, the calculation method of the correlation is consistent with the principle of the association algorithm.

[0115] Method 2: Fusing the first template and the third template to obtain a second fused template;

[0116] The second fusion template is used to match the associated source from the information database. The fusion method can be based on the position relationship. For example, the name, phone number and email address have a specific order or relative position relationship in the text, and some are selected in order and some are set in disorder. Or it can be set according to the separator, such as comma, colon, semicolon, etc. to separate different information items.

[0117] By changing the structure of the template, the disadvantages caused by incomplete template matching can be reduced.

[0118] In addition, for the matching method of the associated source, if the data in the information database is limited, you can increase the matching data method, such as replacing the relevant matching template, that is, the third template or the second fusion template, to further match. If no further match is found, you can also increase the matching data range.

[0119] Reference Figure 7 , the association algorithms include:

[0120] Resolve the linked data in a linked data collection; the linked data may be stored in a database table, JSON, XML, or other structured format.

[0121] Identify the content in the associated data and generate corresponding associated text information;

[0122] Obtain other key information in the target key information except the specified key information;

[0123] From the associated text information, identify information that overlaps with other key information; for example, use text matching, similarity calculation or natural language processing (NLP) technology to identify the associated text information that overlaps with other key information.

[0124] The relevance is calculated based on the weights corresponding to all information in the target key information. The relevance is the sum of the weights corresponding to the information in other key information that overlaps with the associated text information.

[0125] As a further search judgment, if the associated data set also includes other key information in the target key information except the specified key information. For example, it also includes other information such as name and account number, for example, the weight of the name is 2, and the weight of the account number is 10; finally, the sum of the weights of the other key information identified is calculated, which is the degree of association. By judging whether the degree of association exceeds the association threshold, if it exceeds the association threshold, it is judged as a pre-analysis source.

[0126] Reference Figure 8 If feature information is extracted from the analysis data set of the pre-analysis source, the step of sending the analysis data set to the analysis center includes:

[0127] Get the analysis data set;

[0128] Identify feature text from the analysis data set; for example, chat logs.

[0129] According to the preset first recognition algorithm, a first result is recognized from the feature text, that is, information suspected of feature information is preliminarily obtained. For example, to recognize a specific number, it can be preliminarily recognized by a number recognition algorithm, that is, a first recognition algorithm.

[0130] The first result is sent to the preset model library, and the second result is matched by the second recognition algorithm in the model library; the information of the suspected characteristic information is matched with the recognition algorithm in the model library to screen out the accurate information, i.e. the second result. The model library pre-stores the special format of the specific number. If the first result of the preliminary recognition can match the special format, the second result is the result that meets the specific number format.

[0131] According to the second result, a context of the second result in the feature text is obtained; wherein the context is obtained according to a set text length, or according to a set time interval length.

[0132] The context in the feature text is identified according to the third recognition algorithm to determine whether the context in the feature text contains feature information; for example, the feature information is a record of increase or decrease of a number associated with the second result, or a record of fund transactions related to the second result.

[0133] If feature information is included, a target feature corresponding to the feature information is matched from the model library; the target feature is the relevant information corresponding to the specific number; the relevant information includes, for example, a name or a searchable address.

[0134] According to the correspondence between the target feature and the analysis center, the analysis data set is sent to the analysis center; wherein the analysis center is pre-set to correspond to the target feature in the pre-analysis source.

[0135] The first result is identified from the feature text of the analysis data set, for example, the chat record, that is, the information suspected to be the feature information is preliminarily obtained; then it is sent to the preset model library, the information suspected to be the feature information is matched with the recognition algorithm in the model library, and the accurate information, that is, the second result, is screened out; the context of the accurate information appearing in the chat record is again audited to ensure that it is the feature information, and then the information belonging to the target feature is matched from the model library, and based on the belonging information, it is provided to the analysis center corresponding to the target feature after the audit is completed.

[0136] The method also includes:

[0137] The target text information and the associated text information are cleaned into a first target format and entered into an information database; the information database is an ElasticSearch database.

[0138] The target source and related sources are cleaned into the second target format and entered into the information database to improve the quality, consistency, understandability and usability of the data.

[0139] The method also includes:

[0140] Build index fields for information databases; set corresponding word segmentation parameters according to the different contents of index fields, and the word segmentation parameters are associated with the contents of index fields; improve query efficiency and optimize data retrieval performance. Select the appropriate word segmenter based on the content of the field and query requirements; such as standard word segmenter, IK word segmenter, etc.

[0141] The length of the word segmentation parameter is dynamically adjusted, and the adjustment steps include:

[0142] The length of the word segmentation parameter is inversely related to the time span of the first historical data set and the second historical data set in the historical database, wherein the time span is the time span within a set time period from the current time to the current moment.

[0143] Alternatively, the length of the word segmentation parameter is inversely related to the region span of the first historical data set and the second historical data set in the historical database, wherein the region span is the number of different regions involved in the data sets.

[0144] Improve query efficiency and optimize data retrieval performance. In addition, the length of the word segmentation parameter, that is, the granularity of the word, will directly affect the accuracy and relevance of the data matching. Word segmentation parameters that are too long or too short may affect the relevance of the retrieval results. Too long word segmentation may cause the short words related to the query to be missed, while too short word segmentation may introduce noise words that are irrelevant to the query intent. When the time span increases, the length of the word segmentation parameter will decrease; conversely, when the time span decreases, the length of the word segmentation parameter will increase. When the area involved in the data set increases, the length of the word segmentation parameter will decrease. When the area decreases, the length of the word segmentation parameter will increase. The practice of dynamically adjusting the length of the word segmentation parameter can make word segmentation more flexible and adaptable. Under different time spans or area spans, the word segmentation parameters can be adjusted according to the actual situation to obtain better word segmentation effects.

[0145] In addition, five data nodes are set up, two of which are standby nodes and the other three are data nodes for storing collected data. Ensure that the data nodes have sufficient computing power and storage space. Install and configure the search engine software on the five data nodes; three data nodes are configured as master nodes, and the other two are configured as standby nodes. Standby nodes provide data redundancy and fault recovery capabilities when the master node fails.

[0146] Specifically, the data provided by the user can be in the form of a table, and the content of the table file can be identified by column to extract the information therein; for example, including the user's name, user's social account, social account of the associated person, user's phone number, payment and collection bank card number, historical IP of the associated person's device, and WIFI hotspot connected to the associated person's device. The above information is used as the query condition to search in the ElasticSearch database to find the associated associated source. For example: searching based on the user's social account, if this account information appears in the local file of the associated source, it means that this associated source is associated with this case.

[0147] View all pictures, historical IPs, chat tools, local files, WIFI lists, chat records, platform information, and logged-in network accounts of the associated source. Retrieve other case information from this associated source to further confirm the relevance to this case; find that, for example, the user's name and bank card number appear in the chat record of the associated source, and after confirmation, analyze the associated source, i.e., the pre-analysis source. Extract various supporting clue data sets for case judgment and analysis from the pre-analysis source, and send them to the corresponding analysis center after sorting.

[0148] All information obtained in this application is authorized information and is used reasonably and legally.

[0149] The implementation principle of a clue data matching method in an embodiment of the present application is: based on the case information provided by the user (target source), that is, the target data set, extract the target key information therein, such as name, social account, phone number, payment and receipt bank card information, etc., retrieve the associated source associated with it from the information database, there may be one or more associated sources, and judge the correlation degree of the associated data set in the associated source. If the correlation degree is high, continue to analyze the pre-analysis source, extract the information associated with this user therefrom, and provide rich case materials to the analysis center; thereby, it is possible to improve the current data matching degree in case clues and improve the efficiency and quality of case judgment.

[0150] A clue data matching system, based on the above clue data matching method, includes the following modules:

[0151] The information processing module is used to obtain the target data set of the target source; and extract the target key information from the target data set.

[0152] The retrieval query module is used to match the associated source from the information database according to the target key information; wherein the information database is associated with the target source, and the associated source corresponds to the target key information; and obtain the associated data set corresponding to the associated source from the information database.

[0153] The correlation judgment module calculates the correlation between the correlation source and the target source according to the target key information and the correlation data set in accordance with the preset correlation algorithm; if the correlation is higher than the preset correlation threshold, the correlation source is used as a pre-analysis source; if feature information is identified from the analysis data set of the pre-analysis source, the analysis data set is sent to the analysis center; wherein the analysis center is pre-set to correspond to the pre-analysis source.

[0154] The implementation principle of a clue data matching system in an embodiment of the present application is: the information processing module extracts the target key information, such as name, social account, phone number, payment and receipt bank card information, etc., based on the case information provided by the user (target source), that is, the target data set; the retrieval query module retrieves the associated sources associated with it from the information database, and there may be one or more associated sources; the correlation judgment module performs correlation judgment on the associated data set in the associated source; if the correlation is high, the pre-analysis source is continued to be analyzed to extract the information associated with this user, and provide the analysis center with rich case materials; thereby, the current data matching degree in case clues can be improved, and the efficiency and quality of case judgment can be improved.

[0155] An electronic device includes a memory and a processor, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the steps of the clue data matching method are implemented.

[0156] A storage medium stores computer executable instructions, which, when loaded and executed by a processor, implement the steps of the clue data matching method.

[0157] The above are all preferred embodiments of the present application, and the protection scope of the present application is not limited thereto. Therefore, any equivalent changes made according to the structure, shape, and principle of the present application should be included in the protection scope of the present application.

Claims

1. A clue data matching method, characterized in that: The method comprises the following steps: obtaining a target data set of a target source; Extracting target key information from the target data set; Matching an associated source from an information database according to the target key information; wherein the information database is associated with the target source, and the associated source corresponds to the target key information; Acquire a set of associated data corresponding to the associated source from the information database; According to the target key information and the associated data set, and in accordance with a preset association algorithm, the degree of association between the associated source and the target source is calculated; If the correlation degree is higher than a preset correlation threshold, the correlation source is used as a pre-analysis source; If characteristic information is identified from the analysis data set of the pre-analysis source, the analysis data set is sent to an analysis center; wherein the analysis center is pre-set to correspond to the pre-analysis source; The step of extracting target key information from the target data set also includes: parsing target data in the target data set; Identify the content in the target data and generate corresponding target text information; Identifying and matching the target key information from the target text information through a first template; If the target key information cannot be matched through the first template recognition, then according to the target text information, a first historical data set associated with the target text information is acquired from a preset historical database; Obtaining a second template corresponding to the first historical data set; identifying and matching target key information from the target text information using the second template; Alternatively, the second template in the first historical data set is merged with the first template to obtain a first merged template; the target key information is identified and matched from the target text by using the first merged template; Alternatively, a first fused set is obtained by fusing the first historical data set and the target data set; a second template in the first historical data set is fused with the first template to obtain a first fused template; and the target key information is matched from the first fused set using the first template, the second template or the first fused template; The step of matching the associated source from the information database according to the target key information also includes: designated key information of a designated portion from the target key information; Matching associated information overlapping with the designated key information from the information database; According to the association information, matching the association source corresponding to the association information; If the associated source corresponding to the associated information cannot be matched according to the associated information, then according to the associated information, using the third template in the historical database, a historical source corresponding to the associated information is matched within a set historical time T1; wherein the set historical time T1 is a time within a set time period T1 before the current moment; Acquire a second historical data set associated with the historical source; extracting historical key information from the second historical data set; Determine the correlation between the historical key information and the target key information. If the correlation is greater than a preset value, use the historical source as the correlation source; otherwise, feedback-adjust the span of the set historical time T1 to increase the set historical time T1 to the set historical time T2; Alternatively, the first template and the third template are fused to obtain a second fused template; and the associated source is matched from the information database using the second fused template; The association algorithm includes: parsing the associated data in the associated data set; Identify the content in the associated data and generate corresponding associated text information; Acquire other key information in the target key information except the specified key information; From the associated text information, identifying information that overlaps with the other key information; Calculating the relevance according to the weights corresponding to all information in the target key information, where the relevance is the sum of the weights corresponding to information in the other key information that overlaps with the associated text information; Cleaning the target text information and the associated text information into a first target format and entering the format into the information database; The target source and the associated source are cleaned into a second target format and entered into the information database; Constructing index fields for the information database; According to different contents of the index field, corresponding word segmentation parameters are set, and the word segmentation parameters are associated with the contents of the index field; The length of the word segmentation parameter is dynamically adjusted, and the adjustment steps include: The length of the word segmentation parameter is inversely related to the time span of the first historical data set and the second historical data set in the historical database, wherein the time span is the time span within a set time period from the current time to the current moment; Alternatively, the length of the word segmentation parameter is inversely related to the region span of the first historical data set and the second historical data set in the historical database, wherein the region span is the number of different regions involved in the data set.

2. The clue data matching method according to claim 1, characterized in that: If feature information is extracted from the analysis data set of the pre-analysis source, the step of sending the analysis data set to the analysis center includes: Acquire the analysis data set; Identifying characteristic text from the analysis data set; According to a preset first recognition algorithm, a first result is identified from the feature text; Sending the first result to a preset model library, and matching a second result through a second recognition algorithm in the model library; According to the second result, obtaining a context of the second result in the feature text; Recognize the context in the feature text according to a third recognition algorithm, and determine whether the context in the feature text contains the feature information; If the feature information is included, matching the target feature corresponding to the feature information from the model library; The analysis data set is sent to the analysis center according to the correspondence between the target feature and the analysis center; wherein the analysis center is pre-set to correspond to the target feature in the pre-analysis source.

3. A clue data matching system, based on the clue data matching method according to any one of claims 1-2, characterized in that: Includes the following modules: An information processing module is used to obtain a target data set from a target source; and extract target key information from the target data set; A search query module is used to match the associated source from the information database according to the target key information; wherein the information database is associated with the target source, and the associated source corresponds to the target key information; and obtain the associated data set corresponding to the associated source from the information database; The correlation judgment module calculates the correlation between the correlation source and the target source according to the target key information and the correlation data set in accordance with a preset correlation algorithm; if the correlation is higher than a preset correlation threshold, the correlation source is used as a pre-analysis source; if feature information is identified from the analysis data set of the pre-analysis source, the analysis data set is sent to an analysis center; wherein the analysis center is pre-set to correspond to the pre-analysis source.

4. An electronic device, characterized in that: It comprises a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the clue data matching method as claimed in any one of claims 1 to 2 when calling the computer program in the memory.

5. A storage medium, characterized in that: The storage medium stores computer executable instructions, and when the computer executable instructions are loaded and executed by the processor, the steps of the clue data matching method as described in any one of claims 1 to 2 are implemented.

Images