Website reconstruction method and system based on cloud forensics, electronic equipment and storage medium

Abstract

The invention provides a website reconstruction method and system based on cloud forensics, electronic equipment and a storage medium. The method comprises the following steps: acquiring to-be-detected voice and keywords; respectively acquiring a voice input matrix of the voice to be detected and a target matrix of the keywords; obtaining a target probability matrix based on the voice input matrix and the target matrix; and positioning the position of the keyword in the voice to be detected according to the target probability matrix. According to the technical scheme, the large language model is utilized, and any keyword of the voice segment can be detected and positioned.

Description

Technical Field

[0001] The present application relates to the technical field of server forensics, and in particular to a website reconstruction method and system based on cloud forensics, an electronic device and a storage medium. Background Art

[0002] With the rapid development of cloud computing technology, more and more websites are moving to the public cloud. Public cloud is a service model based on cloud computing technology, which provides various computing resources and application services through the Internet. Public cloud is built and maintained by cloud service providers. Users can use computing, storage, network and other resources on demand without having to pay attention to the maintenance and management of the underlying infrastructure. While public cloud brings convenience to everyone, it also provides more opportunities. Many are moving to the cloud, which also brings new challenges to forensics work.

[0003] Traditional website refactoring solutions usually include the following steps:

[0004] 1. Fix the disk image of the cloud server to the local computer, and then simulate the cloud server image as a virtual machine through the local virtualization management software; 2. Export the backup file of the cloud database to the local computer, and use the database management tool to restore the cloud database backup to the local database; 3. Modify the network configuration, website code configuration and other information to restore the website locally.

[0005] However, the above reconstruction schemes generally have the following problems: 1. Timeliness limitation: It is very easy to apply for and release resources on the cloud, but in the process of fixing cloud data and transferring it to the local, time delays may occur due to network conditions, making cloud resources invalid; 2. Data volume challenge: The dynamic scaling technology provided by cloud service providers may cause problems with massive data in the local simulation environment, resulting in ineffective parsing and processing; 3. Complex networking configuration: Cloud service providers not only provide computing resources, but also provide virtual network services of public clouds. To restore the entire cloud service environment locally, not only virtual machine simulation is required, but also complex network configuration.

[0006] Therefore, existing website reconstruction methods face many challenges in public cloud environments, and a more efficient and reliable reconstruction solution is needed that can solve the above problems and ensure data integrity and the smooth progress of the reconstruction process.

[0007] Application Contents

[0008] The purpose of this application is to provide a website reconstruction method and system based on cloud forensics, an electronic device and a storage medium, which are used to solve the technical problems of timeliness, data volume challenges and complex networking configuration existing in existing reconstruction solutions.

[0009] In a first aspect, the present application provides a website reconstruction method based on cloud forensics. The website reconstruction method based on cloud forensics includes: accessing a source server where a source website is located to obtain source website information; the source website information includes: source server setting information, source website database data, and source website network information; establishing a target server on a cloud platform according to the source server setting information; and establishing a target database in the target server according to the source database data; configuring a network environment based on the source website network information, the target server, and the target database to obtain a target reconstructed website.

[0010] In an implementation of the first aspect, establishing a target server on a cloud platform according to the source server setting information includes: establishing a source server cloud image corresponding to the source server based on the source server setting information; and establishing a target server according to the acquired cloud image.

[0011] In an implementation of the first aspect, a cloud image corresponding to the source server is established based on the source server setting information, including: sending first API request information to the cloud platform so that the cloud platform performs API verification; after the API verification is successful, establishing an initial cloud image, and configuring the initial cloud image according to the source server setting information to obtain the source server cloud image; saving and sharing the source server cloud image to the cloud platform.

[0012] In an implementation of the first aspect, establishing a target server based on the acquired cloud image includes: acquiring basic information of the source server cloud image; the basic information of the source server cloud image includes: server instance specifications, intranet IP address and storage space; establishing the target server based on the basic information of the source server cloud image.

[0013] In an implementation of the first aspect, a target database is established in a target server according to the source database data, including: sending a second API request information to the cloud platform so that the cloud platform performs an API verification; after the API verification is successful, backing up the source website database data to the cloud platform to obtain a backup database and a logical backup file corresponding to the backup database, and saving the logical backup file to an object storage service; obtaining basic information of the backup database, and establishing a target database in the target server based on the basic information of the backup database; transmitting the logical backup file and the backup database to the target server; parsing the logical backup file to obtain database backup information; and restoring the backup database data to the target database based on the database backup information.

[0014] In an implementation of the first aspect, the basic information of the backup database includes: database instance specifications, database engine type and version, and database connection address.

[0015] In an implementation of the first aspect, a network environment is configured for the source website network information, the target server and the target database to obtain a target reconstructed website, including: sending a third API request information to the cloud platform to enable the cloud platform to perform API verification; after the API verification is successful, establishing a cloud private network for the source website on the cloud platform based on the source website network information; obtaining private network information and database connection address information of the cloud private network, and establishing a target website in the target server; the private network information includes: a private network segment and intranet IP information of each server of the website; the database connection address information includes: a database connection domain name, a database instance intranet IP; configuring the target website based on the private network information; and configuring the target database intranet IP based on the database connection address information, so that the target website is directly connected to the target database to achieve website reconstruction.

[0016] In the second aspect, the present application provides a website reconstruction system based on cloud forensics. The website reconstruction system based on cloud forensics includes: an acquisition module, which is used to access the source server where the source website is located to obtain the source website information; the source website information includes: source server setting information, source website database data, source website network information; a first data structure creation module, which is used to establish a target server on the cloud platform according to the source server setting information; and a second data structure creation module, which is used to establish a target database in the target server according to the source database data; a reconstruction module, which is used to configure the network environment based on the source website network information, the target server and the target database to obtain the target reconstructed website.

[0017] In a third aspect, the present application provides an electronic device comprising: a processor and a memory; the memory is used to store a computer program; the processor is used to execute the computer program stored in the memory, so that the electronic device performs the cloud forensics-based website reconstruction method described in any one of the first aspects of the present application.

[0018] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by an electronic device, the cloud-based forensics-based website reconstruction method described in any one of the first aspects of the present application is implemented.

[0019] According to the website reconstruction method and system, electronic device and storage medium based on cloud forensics of the present application, all website reconstruction steps are performed on the cloud, and the backup, export, sharing and other functions of the public cloud platform are utilized. Through simple operations on the visual interface, the website data in the source account can be quickly copied to the cloud account of the forensics personnel, and the network environment that is the same as the source website environment can be automatically configured. The data generated in the process is not transmitted through the public network, and the original website data is not modified, thereby ensuring the security and integrity of the data.

[0020] The website reconstruction method and system based on cloud forensics, electronic device and storage medium described in this application include the following beneficial effects:

[0021] 1. Efficiency: By using the backup, export, and sharing functions of the cloud platform, the cloud server image of the source website can be quickly generated and shared on the cloud, greatly reducing the data transfer time. Through the intranet transmission function of the cloud platform, high-speed data transmission is achieved, avoiding the delay problem caused by network bandwidth limitations in traditional methods.

[0022] 2. Compatibility: Since the reconstructed website runs in the same public cloud environment as the source website, it is compatible with the original website code and configuration to the greatest extent, avoiding compatibility issues that may occur in the local simulation environment.

[0023] 3. Flexibility: The elastic computing and dynamic scaling capabilities of the public cloud enable the reconstructed website to freely adjust resource allocation according to demand to cope with different access and data requirements.

[0024] 4. Simplicity: The program provides automation functions, which simplifies the steps of virtual machine configuration, database reconstruction, network configuration, etc., reduces the complexity of manual operations, and lowers the technical threshold.

[0025] 5. Security: The website data generated during the website reconstruction process is encrypted and transmitted through the public cloud intranet, without passing through the public network, ensuring the security and confidentiality of the data. The reconstruction process does not affect the original data, ensuring the integrity and consistency of the data.

[0026] 6. Traceability: During the website reconstruction process, all operations are recorded in logs to ensure that each step of the operation is traceable and provide detailed log records, which effectively guarantees the credibility of the data source and the transparency of the operation, facilitating subsequent audits and problem tracing. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 Shown is a schematic diagram of an application scenario of the present application.

[0028] Figure 2 Shown is a flowchart of an embodiment of the website reconstruction method based on cloud forensics described in this application.

[0029] Figure 3 Shown is a flowchart of an embodiment of the website reconstruction method based on cloud forensics described in this application.

[0030] Figure 4 Shown is a flowchart of an embodiment of the website reconstruction method based on cloud forensics described in this application.

[0031] Figure 5 Shown is a flowchart of an embodiment of the website reconstruction method based on cloud forensics described in this application.

[0032] Figure 6 Shown is a schematic diagram of the structure of a website reconstruction system based on cloud forensics described in the present application in one embodiment.

[0033] Figure 7 Shown is a schematic diagram of the structure of an electronic device described in an embodiment of the present application.

[0034] Component number description

[0035] 11 Server

[0036] 12 Processor

[0037] 13 Display Terminal

[0038] 600 Website reconstruction system based on cloud forensics

[0039] 610 Get Module

[0040] 620 First data structure creation module

[0041] 630 Second data structure creation module

[0042] 640 Reconstruction Module

[0043] 71 Processing Units

[0044] 72 Memory

[0045] 721 Random Access Memory

[0046] 722 Cache memory

[0047] 723 Storage System

[0048] 724 Programs / Utilities

[0049] 725 Program Modules

[0050] 73 Bus

[0051] 74 Input / Output Interfaces

[0052] 75 Network Adapter

[0053] Steps S1 to S4

[0054] Steps S21 to S22

[0055] Steps S31 to S36

[0056] Steps S41 to S45 DETAILED DESCRIPTION

[0057] The following describes the embodiments of the present application through specific examples, and those skilled in the art can easily understand other advantages and effects of the present application from the contents disclosed in this specification. The present application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present application. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0058] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present application, and thus the drawings only show components related to the present application rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed at will, and the component layout may also be more complicated.

[0059] In addition, in this application, descriptions such as "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in this field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0060] Website refactoring is the process of improving the code, architecture, design and functionality of an existing website in order to improve its performance, maintainability, scalability and user experience. This process is usually carried out without changing the external behavior of the website, that is, the user interface and functionality remain the same, but the internal implementation may change significantly.

[0061] Figure 1The diagram shows an application scenario of the website reconstruction system based on cloud forensics of the present application. The website reconstruction system based on cloud forensics can be used to implement the website reconstruction method based on cloud forensics provided in the embodiment of the present application, but the application scenario of the website reconstruction method based on cloud forensics provided in the embodiment of the present application is not limited to Figure 1 The website reconstruction system based on cloud forensics. Figure 1 As shown, the website reconstruction system based on cloud forensics includes: a server 11, a processor 12 and a display terminal 13.

[0062] Figure 1 The processor 12 in the embodiment may be a single processor or a processor cluster or a cloud computing center composed of multiple processors, and the specific details are not limited here. Figure 1 Only one server 11, one processor 12 and one display terminal 13 are shown, but it should be understood that Figure 1 The examples are only used to understand this solution, and the specific number of display terminals and processors should be flexibly determined based on actual conditions.

[0063] In some other implementations, the website reconstruction system 1 based on cloud forensics may not include the display terminal 13, but only include the server 11 and the processor 12 with display function. The processor 12 with display function may include a tablet computer, a laptop computer, a PDA, a mobile phone, a personal computer (PC), etc., which is not limited here.

[0064] The following embodiments of the present application provide a website reconstruction method and system, electronic device and storage medium based on cloud forensics, in which all website reconstruction steps are performed on the cloud, and the backup, export, sharing and other functions of the public cloud platform are utilized. Through simple operations on a visual interface, the website data in the source account can be quickly copied to the cloud account of the forensics personnel, and the network environment that is the same as the source website environment can be automatically configured. The data generated in the process is not transmitted through the public network, and the original website data is not modified, thereby ensuring the security and integrity of the data.

[0065] The following will describe in detail the principles and implementation methods of the cloud-based forensics website reconstruction method and system, electronic device and storage medium described in the embodiments of the present application in conjunction with the accompanying drawings, so that those skilled in the art can understand the cloud-based forensics website reconstruction method and system, electronic device and storage medium of the embodiments without creative work.

[0066] See also Figure 2 , showing a flow chart of a website reconstruction method based on cloud forensics provided in an embodiment of the present application. Figure 2 As shown, the steps include the following steps S1 to S4.

[0067] Step S1, accessing the source server where the source website is located to obtain source website information; the source website information includes: source server setting information, source website database data, and source website network information.

[0068] In this embodiment, it is necessary to access the source server and obtain the source website data in the source server as needed, wherein the source website is the website to be obtained for evidence, and the source server is the server to be obtained for evidence.

[0069] Step S2: establishing a target server on the cloud platform according to the source server setting information.

[0070] Specifically, after obtaining cloud platform verification, a cloud image corresponding to the source server is created on the cloud platform and sharing is enabled, and then a virtual machine is created based on the shared cloud image to further obtain the target server.

[0071] Wherein, the target server is a forensics server.

[0072] Specifically, the optional cloud platforms include Amazon Web Services (AWS), Microsoft Azure or Google Cloud Platform (GCP), etc. These platforms provide powerful infrastructure and services that can support high availability, elastic scaling and security of websites.

[0073] In some implementations, establishing a target server on a cloud platform according to the source server setting information includes: establishing a source server cloud image corresponding to the source server based on the source server setting information; and establishing a target server according to the acquired cloud image.

[0074] like Figure 3 As shown, establishing a target server on a cloud platform includes the following steps S21 to S22.

[0075] Step S21: establishing a source server cloud image corresponding to the source server based on the source server setting information.

[0076] Specifically, it includes sending a first API request message to the cloud platform so that the cloud platform performs API verification; after the API verification is successful, establishing an initial cloud image, and configuring the initial cloud image according to the source server setting information to obtain the source server cloud image; saving and sharing the source server cloud image to the cloud platform.

[0077] In some implementations, an API key or an existing API key is created on the cloud platform for identity authentication based on an account of the cloud platform that has obtained and configured access permissions. After successful authentication, the corresponding API interface is called to create an initial cloud image based on the API documentation of the cloud platform used.

[0078] For example, when creating an initial cloud image through Amazon Web Services (AWS), the following code snippet is included:

[0079] import boto3

[0080] #Create EC2 client

[0081] ec2=boto3.client('ec2',region_name='your-region')

[0082] #Create a custom image

[0083] response = ec2.create_image(

[0084] InstanceId='your-instance-id',

[0085] Name = 'your-image-name',

[0086] Description='your-image-description' )

[0088] print(response)

[0089] In this example, Python's boto3 library is used to interact with the EC2 service of Amazon Web Services (AWS); an EC2 client object is created to communicate with the EC2 service in the specified region. In actual use, replace 'your-region' with the name of the AWS region you are using, such as 'us-west-2' or 'eu-central-1'. Then call the create_image method of the EC2 client object to create a custom image.

[0090] And for example, when creating an initial cloud image through Google Cloud Platform (GCP), including using the following code snippet:

[0091] from google.cloud import compute_v1

[0092] from google.oauth2 import service_account

[0093] #Authenticate and create a Compute Engine client

[0094] credentials=service_account.Credentials.from_service_account_file('path / to / your / keyfile.json')

[0095] compute_client=compute_v1.ImagesClient(credentials=credentials)

[0096] #Create a custom image

[0097] project = 'your-project-id'

[0098] zone='your-zone'

[0099] image_body={

[0100] 'name':'your-image-name',

[0101] 'source_disk':'your-source-disk-url',

[0102] 'description':'your-image-description'

[0103] }

[0104] response=compute_client.insert(project=project,zone=zone,body=image_body)

[0105] print(response)

[0106] The client library of the Google Cloud Compute Engine API is imported to interact with virtual machine instances on Google Cloud. The Google OAuth2 service account library is then imported for authentication and authorization. A credential object is created using the service account key read from the JSON file. A Compute Engine Images client is created based on the credential object to interact with image resources on Google Cloud.

[0107] It should be noted that cloud images provide a method for quickly deploying and restoring cloud servers in cloud computing. The image file contains the operating system, applications, and configuration settings, allowing users to quickly build the required software environment without having to manually install and configure each component from scratch. The main types of cloud images include public images, service market images, custom images, and shared images. Public images are usually provided by cloud service providers, covering most mainstream operating systems for all users.

[0108] Step S22: establishing a target server according to the acquired source server cloud image.

[0109] Specifically, it includes: obtaining basic information of the source server cloud image; the basic information of the source server cloud image includes: server instance specifications, intranet IP address and storage space; and establishing a target server based on the basic information of the source server cloud image.

[0110] In this embodiment, the obtained source server cloud image is used as a template for establishing the target server, and the specifications, intranet IP address and storage space settings of the target server are configured according to the basic information of the obtained source server cloud image.

[0111] Step S3: establishing a target database in the target server according to the source database data.

[0112] In some implementations, establishing a target database in a target server based on the source database data includes: sending a second API request message to the cloud platform so that the cloud platform performs an API verification; after the API verification succeeds, backing up the source website database data to the cloud platform to obtain a backup database and a logical backup file corresponding to the backup database, and saving the logical backup file to an object storage service; obtaining basic information of the backup database, and establishing a target database in the target server based on the basic information of the backup database; transmitting the logical backup file and the backup database to the target server; parsing the logical backup file to obtain database backup information; and restoring the backup database data to the target database based on the database backup information.

[0113] like Figure 4 As shown, establishing a target database in a target server includes the following steps S31 to S36.

[0114] Step S31: Send a second API request message to the cloud platform so that the cloud platform performs API verification.

[0115] Specifically, according to the account of the cloud platform for obtaining and configuring access rights, an API key is created on the cloud platform or an existing API key is used for identity authentication.

[0116] Step S32: After the API verification is successful, the source website database data is backed up to the cloud platform to obtain a backup database and a logical backup file corresponding to the backup database, and the logical backup file is saved to the object storage service.

[0117] Specifically, determine the data type, data volume and backup frequency of the acquired source database data; select a suitable cloud backup service based on the above information, and add the source database data as a data source to the console of the cloud backup service; then define a backup strategy based on the data type, data volume and backup frequency of the acquired source database data, specify the data source to be backed up, apply the backup strategy and start the backup task.

[0118] Among them, the data type of the source database data includes: MySQL, PostgreSQL, etc.; the backup strategy includes: full backup, incremental backup, etc.

[0119] After backing up the source website database data to the cloud platform, a logical backup file is generated based on the backup strategy, backup frequency and backup time, and the logical backup file is saved in the object storage server.

[0120] Step S33: Acquire basic information of the backup database, and establish a target database in the target server based on the basic information of the backup database.

[0121] Specifically, the basic information of the backup database includes: database instance specifications, database engine type and version, and database connection address.

[0122] In this embodiment, a database instance is deployed according to the basic information of the backup database, and it is ensured that the database instance and the target server are located in the same virtual private cloud (VPC) to ensure that they can communicate with each other.

[0123] Connect to the database instance through the command line or the cloud platform's management tool; Create a database: execute the command to create a database, such as CREATE DATABASE your_database_name; Create a user and authorize: create a new user for the database and grant appropriate permissions; configure the database connection string in the application on the target server, including the database address, user name, password, etc.

[0124] Test connection: Ensure that the application can successfully connect to the database instance and perform data operations. Specifically, first decompress the backup file, use tools such as qpress, gzip, and xbstream to decompress the backup compressed package, read the backed-up database startup parameter configuration file, extract database program parameters such as innodb\_undo\_tablespaces and innodb\_log\_file\_size, and add them to the startup parameters of the self-built database instance.

[0125] Step S34: transmitting the logical backup file and the backup database to the target server.

[0126] In this embodiment, after the target database is established, the logical backup file and the backup database data are transferred to the target server, wherein the backup database data can be migrated from the backup database to the target database using Data Transfer Service (DTS) or other migration tools.

[0127] Step S35: parse the logical backup file to obtain database backup information.

[0128] In this embodiment, the logical backup file is parsed to obtain the data, structure (such as table definition, index, etc.), view, stored procedure and trigger, etc. of the database table of the backup database; and according to the file header information of the logical backup file, it is determined whether the logical backup file needs to be decompressed, and the backup directory structure is obtained according to the decompressed logical backup file.

[0129] It should be noted that the logical backup file of a database is a backup file that contains database data and structure export information. Its core feature is that it stores data in a logical form, which is usually different from the file format of the original database.

[0130] The purpose of logical backup files is to be able to reconstruct the database using the data in these files. This backup method focuses on the readability and portability of the data rather than the physical state of the underlying files. Logical backup files are usually used for incremental backups, that is, to back up data that has changed since the last backup. Logical backup files can only be used for logical recovery, that is, to rebuild the database content by importing data, and cannot be used to directly copy the database files for physical recovery.

[0131] The content of a logical backup file is usually composed of data definition language (DDL) and data manipulation language (DML), including SQL statements for creating tables, views, indexes, etc., and INSERT statements for inserting data. The advantage of this backup method is that it can be migrated across platforms and versions, because the generated SQL script file can theoretically be executed on any database system that supports SQL. At the same time, the logical backup file is small in size, easy to manage and modify, and can be more conveniently version controlled.

[0132] Specifically, for physical backup, first use the Percona XtraBackup tool to restore the backup file to the data directory of the self-built database, and then start the database instance. For logical backup, first start the database instance, obtain the sql backup files of the database and data table from the backup file, such as structure.sql, and import the sql to the self-built database service to create the corresponding database and data table; obtain the backup data record files such as sql and csv from the backup file, and import the files into the corresponding data table according to the data table structure. For example, use LOAD DATA LOCAL INFILE'your\_csv'INTOTABLE your\_table to import csv data.

[0133] Step S36: Restoring the backup database data to the target database based on the database backup information.

[0134] In this embodiment, the backup type and data backup structure of the backup database are automatically identified according to the acquired database backup information, and the backup database data is restored to the target database.

[0135] Step S4: configuring a network environment based on the source website network information, the target server and the target database to obtain a target reconstructed website.

[0136] In some implementations, configuring a network environment based on the source website network information, the target server, and the target database to obtain a target reconstructed website includes: sending a third API request information to the cloud platform so that the cloud platform performs an API verification; after the API verification is successful, establishing a cloud private network for the source website on the cloud platform based on the source website network information; obtaining private network information and database connection address information of the cloud private network, and establishing a target website in the target server; the private network information includes: a private network segment and intranet IP information of each server of the website; the database connection address information includes: a database connection domain name, a database instance intranet IP; configuring the target website based on the private network information; and configuring the target database intranet IP based on the database connection address information, so that the target website is directly connected to the target database to achieve website reconstruction.

[0137] like Figure 5 As shown, obtaining the target reconstruction website includes the following steps S41 to S45.

[0138] Step S41: Send third API request information to the cloud platform so that the cloud platform performs API verification.

[0139] Specifically, according to the account of the cloud platform for obtaining and configuring access rights, an API key is created on the cloud platform or an existing API key is used for identity authentication.

[0140] Step S42: After the API verification is successful, a private cloud network of the source website is established on the cloud platform based on the network information of the source website.

[0141] In this embodiment, it includes: establishing a virtual private cloud (VPC) on the cloud platform, creating a subnet in the VPC, and assigning the IP address range of the source website to the subnet to ensure that the source website is isolated from other resources on the cloud platform. A routing table is configured for the subnet to define how to send traffic from the subnet to the Internet or other subnets.

[0142] Preferably, if more fine-grained control is required, a network access control list (ACL) can be configured. An ACL allows you to specify whether traffic is allowed or denied for specific IP address ranges.

[0143] Step S43, obtain the private network information and database connection address information of the private network on the cloud, and establish a target website in the target server; the private network information includes: private network segment and intranet IP information of each server of the website; the database connection address information includes: database connection domain name, database instance intranet IP.

[0144] Step S44: configure the target website based on the private network information.

[0145] Specifically, the IP address of the target website is matched with the obtained server intranet IP address so that the target website is consistent with the private network information on the cloud.

[0146] Step S45: configuring the target database intranet IP based on the database connection address information so that the target website is directly connected to the target database to achieve website reconstruction.

[0147] In this embodiment, the target database intranet IP address is configured to be the same as the database instance intranet IP address, so that the reconstructed target database network environment is consistent with the source database address. Through the intranet domain name resolution service, the acquired database connection domain name is resolved to the intranet IP address in the target database, so that the website server can directly use the original database connection domain name without modifying the website code.

[0148] In some implementations, a database service corresponding to the database engine of the target database is automatically built through the service orchestration module of the cloud platform, and some startup parameters of the database service are obtained during the preparation phase before database backup and recovery (such as innodb\_undo\_tablespaces, innodb\_log\_file\_size). Thereafter, the backup data is restored to the target database through the database recovery module of the cloud platform so that the target database can be used normally.

[0149] In some implementations, the cloud forensics-based website reconstruction method described in the embodiments of the present application also includes: each step of the operation process needs to be recorded and stored in an operation log for subsequent review and maintenance.

[0150] It should be noted that the protection scope of the website reconstruction method based on cloud forensics described in this application is not limited to the execution order of the steps listed in this embodiment. All solutions implemented by adding, reducing or replacing steps in the prior art based on the principles of this application are included in the protection scope of this application.

[0151] See also Figure 6 , showing a structural diagram of a website reconstruction system based on cloud forensics as described in an embodiment of the present application.

[0152] like Figure 6 As shown, the website reconstruction system 600 based on cloud forensics includes: an acquisition module 610, a first data structure creation module 620, a second data structure creation module 630, and a reconstruction module 640.

[0153] The acquisition module 610 is used to access the source server where the source website is located to obtain source website information; the source website information includes: source server setting information, source website database data, and source website network information;

[0154] A first data structure creation module 620, configured to establish a target server on the cloud platform according to the source server setting information; and

[0155] A second data structure creation module 630, configured to create a target database in a target server according to the source database data;

[0156] The reconstruction module 640 is used to configure the network environment based on the source website network information, the target server and the target database to obtain a target reconstructed website.

[0157] It should be noted that the manner in which each module of the website reconstruction system based on cloud forensics described in this embodiment implements corresponding functions corresponds one-to-one to the website reconstruction method based on cloud forensics described in the embodiment of the present application, so it will not be repeated here.

[0158] In the several embodiments provided in the present application, it should be understood that the disclosed system, device or method can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of modules / units is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or units can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules or units, which can be electrical, mechanical or other forms.

[0159] The modules / units described as separate components may or may not be physically separated, and the components displayed as modules / units may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules / units may be selected according to actual needs to achieve the purpose of the embodiments of the present application. For example, the functional modules / units in the various embodiments of the present application may be integrated into one processing module, or each module / unit may exist physically separately, or two or more modules / units may be integrated into one module / unit.

[0160] Those of ordinary skill in the art should further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0161] The present application embodiment also provides a computer-readable storage medium. A person of ordinary skill in the art can understand that all or part of the steps in the method for implementing the above embodiment can be completed by a program to instruct the processor, and the program can be stored in a computer-readable storage medium, and the storage medium is a non-transitory medium, such as a random access memory, a read-only memory, a flash memory, a hard disk, a solid-state hard disk, a magnetic tape, a floppy disk, an optical disc, and any combination thereof. The above storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a digital video disc (DVD)), or a semiconductor medium (e.g., a solid-state hard disk (SSD)), etc.

[0162] An embodiment of the present application also provides an electronic device, including: a processor and a memory.

[0163] Specifically, the memory is used to store computer programs; the memory includes: ROM, RAM, disk, USB flash drive, memory card or CD and other media that can store program codes.

[0164] The processor is used to execute the computer program stored in the memory so that the electronic device can perform the above-mentioned website reconstruction method based on cloud forensics.

[0165] like Figure 7 As shown, the electronic device of the present application is in the form of a general computing device. The components of the electronic device may include but are not limited to: one or more processors or processing units 71, a memory 72, and a bus 73 connecting different system components (including the memory 72 and the processing unit 71).

[0166] Bus 73 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. By way of example, these architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, an Enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0167] Electronic devices typically include a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device, including volatile and non-volatile media, removable and non-removable media.

[0168] The memory 72 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 721 and / or cache memory 722. The electronic device may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 723 may be used to read and write non-removable, non-volatile magnetic media ( Figure 7 not shown, usually called a "hard drive"). Although Figure 7 Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical medium) may be provided. In these cases, each drive may be connected to the bus 73 via one or more data medium interfaces. The memory 72 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present application.

[0169] A program / utility 724 having a set (at least one) of program modules 725 may be stored, for example, in the memory 72, such program modules 725 including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. The program modules 725 generally perform the functions and / or methods of the embodiments described herein.

[0170] The electronic device may also communicate with one or more external devices (e.g., keyboards, pointing devices, displays, etc.), one or more devices that enable a user to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (e.g., network cards, modems, etc.). Such communication may be performed via input / output (I / O) interface 74. Furthermore, the electronic device may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via network adapter 75. Figure 7 As shown, the network adapter 75 communicates with other modules of the electronic device via the bus 73. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0171] The descriptions of the processes or structures corresponding to the above-mentioned figures have different emphases. For parts that are not described in detail in a certain process or structure, please refer to the relevant descriptions of other processes or structures.

[0172] In summary, according to the website reconstruction method and system, electronic device and storage medium based on cloud forensics of this application, all website reconstruction steps are carried out on the cloud, and the backup, export, sharing and other functions of the public cloud platform are utilized. Through simple operations on the visual interface, the website data in the source account can be quickly copied to the cloud account of the forensics personnel, and the network environment that is the same as the source website environment can be automatically configured. The data generated in the process is not transmitted through the public network, and the original website data is not modified, which ensures the security and integrity of the data. Therefore, this application effectively overcomes the various shortcomings in the prior art and has a high industrial utilization value.

[0173] The above embodiments are merely illustrative of the principles and effects of the present application and are not intended to limit the present application. Anyone familiar with the technology may modify or change the above embodiments without violating the spirit and scope of the present application. Therefore, all equivalent modifications or changes made by a person of ordinary skill in the art without departing from the spirit and technical ideas disclosed in the present application shall still be covered by the claims of the present application.

Claims

1. A website reconstruction method based on cloud forensics, characterized in that: The method comprises: Access the source server where the source website is located to obtain source website information; the source website information includes: source server setting information, source website database data, and source website network information; Establishing a target server on the cloud platform according to the source server setting information; and Establishing a target database in a target server according to the source database data; A network environment is configured based on the source website network information, the target server and the target database to obtain a target reconstructed website.

2. The website reconstruction method based on cloud forensics according to claim 1 is characterized in that: Establishing a target server on the cloud platform according to the source server setting information includes: Establishing a source server cloud image corresponding to the source server based on the source server setting information; A target server is established according to the acquired cloud image.

3. The website reconstruction method based on cloud forensics according to claim 2 is characterized in that: Establishing a cloud image corresponding to the source server based on the source server setting information includes: Sending a first API request message to the cloud platform so that the cloud platform performs an API verification; After the API verification is successful, an initial cloud image is established, and the initial cloud image is configured according to the source server setting information to obtain the source server cloud image; The source server cloud image is saved and shared to the cloud platform.

4. The website reconstruction method based on cloud forensics according to claim 2 is characterized in that: Establishing a target server according to the obtained cloud image includes: Obtain basic information of the source server cloud image; the basic information of the source server cloud image includes: server instance specifications, intranet IP address and storage space; A target server is established based on the basic information of the source server cloud image.

5. The website reconstruction method based on cloud forensics according to claim 1 is characterized in that: Establishing a target database in a target server according to the source database data includes: Sending a second API request message to the cloud platform so that the cloud platform performs an API verification; After the API verification is successful, the source website database data is backed up to the cloud platform to obtain a backup database and a logical backup file corresponding to the backup database, and the logical backup file is saved to the object storage service; Acquire basic information of the backup database, and establish a target database in the target server based on the basic information of the backup database; Transmitting the logical backup file and the backup database to the target server; Parsing the logical backup file to obtain database backup information; The backup database data is restored to the target database based on the database backup information.

6. The website reconstruction method based on cloud forensics according to claim 5 is characterized in that: The basic information of the backup database includes: database instance specifications, database engine type and version, and database connection address.

7. The website reconstruction method based on cloud forensics according to claim 1 is characterized in that: Configuring a network environment based on the source website network information, the target server and the target database to obtain a target reconstructed website includes: Sending a third API request message to the cloud platform so that the cloud platform performs an API verification; After the API verification is successful, a private cloud network of the source website is established on the cloud platform based on the network information of the source website; Obtain the private network information and database connection address information of the private network on the cloud, and establish a target website in the target server; the private network information includes: private network segment and intranet IP information of each server of the website; The database connection address information includes: database connection domain name, database instance intranet IP; Configuring the target website based on the private network information; and The target database intranet IP is configured based on the database connection address information so that the target website is directly connected to the target database to achieve website reconstruction.

8. A website reconstruction system based on cloud forensics, characterized in that: The system comprises: The acquisition module is used to access the source server where the source website is located to obtain the source website information; the source website information includes: source server setting information, source website database data, and source website network information; A first data structure creation module is used to establish a target server on the cloud platform according to the source server setting information; and A second data structure creation module, used to establish a target database in a target server according to the source database data; The reconstruction module is used to configure the network environment based on the source website network information, the target server and the target database to obtain the target reconstruction website.

9. An electronic device, characterized in that: including a processor and a memory; The memory is used to store computer programs; The processor is used to execute the computer program stored in the memory so that the electronic device performs the website reconstruction method based on cloud forensics according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by an electronic device, the website reconstruction method based on cloud forensics described in any one of claims 1 to 7 is implemented.

Images