Online evidence obtaining method, device and equipment and storage medium

Abstract

The invention belongs to the technical field of computer data processing, and provides an online evidence obtaining method and device, equipment and a storage medium. The method comprises the following steps: deploying monitoring sensors at each level of a cloud platform; secondly, configuring a data transmission encryption protocol; secondly, carrying out federal learning data preprocessing; then, federal learning model training is carried out, wherein function loss, gradient and regularization are carried out; and then real-time evidence obtaining and analysis are carried out: cloud platform behaviors are monitored and analyzed in real time by using the trained model, abnormal behaviors are identified, and an evidence obtaining report is generated. And finally, performing evidence verification and storage: performing hash verification and digital signature on the key evidence, and storing the key evidence on the block chain to ensure the credibility and integrity of the evidence. According to the method provided by the invention, the problem of data island and privacy protection in the cloud environment is solved, a more timely and accurate clue is provided for evidence obtaining work, and the overall security and stability of a cloud platform are improved.

Description

Technical Field

[0001] The present application relates to the field of computer data processing technology, and in particular to an online evidence collection method, device, equipment and storage medium. Background Art

[0002] With the rapid development of cloud technology, cloud platforms have become an important infrastructure for enterprise data storage, processing and analysis. However, in the cloud environment, data silos and privacy protection issues have become increasingly prominent, becoming key factors restricting the further development of the cloud. On the one hand, data silos are common between different organizations or enterprises. Due to the restrictions of data format, storage method and laws and regulations, data between organizations is difficult to share effectively, resulting in the inability of data resources to fully realize their potential value. This data isolation state not only limits the ability of data-driven decision-making, but also hinders the development of innovative applications. On the other hand, privacy protection is an important issue that cannot be ignored in cloud applications. With the frequent occurrence of data leakage incidents, users' attention to data privacy continues to increase. How to ensure the privacy and security of user data while ensuring data sharing and utilization has become an important challenge facing cloud technology. In a cloud computing environment, data is distributed across multiple virtual machines and servers, and may even span different geographical locations and jurisdictions. This distributed storage method makes it extremely difficult to collect data centrally. Data in cloud computing systems is updated in real time, including user data, application data, system logs, etc. This dynamic nature requires that forensic technology must be able to respond quickly and capture changing evidence, while traditional static forensic methods cannot meet this demand. Summary of the invention

[0003] The present application provides an online forensics method, apparatus, device and storage medium to solve the problems of data silos and privacy protection in a cloud environment, provide more timely and accurate clues for forensics work, and improve the overall security and stability of the cloud platform.

[0004] In a first aspect, the present application provides an online evidence collection method, comprising: With authorization from each target area, at least one monitoring sensor is deployed in each target area in the cloud platform; wherein each target area corresponds to a target terminal, and the monitoring sensor feeds the monitored data to the target terminal based on a data transmission encryption protocol; Establishing a federated learning model based on the objective function, and transmitting the federated learning model to each target terminal; Based on the set number of iterations or convergence conditions, iterative training of the federated learning model is performed until the set number of iterations or convergence conditions are reached, and a trained federated learning model is obtained, wherein each iterative training includes: obtaining the model gradient and model loss transmitted by each target terminal, and aggregating the model gradient and model loss transmitted by each target terminal to obtain a weight matrix and transmit it to each target terminal respectively, and each target terminal updates the federated learning model based on the weight matrix; wherein the model gradient and model loss transmitted by the target terminal are obtained by training the federated learning model using a data set, and the data set is constructed by the target terminal according to the data fed by the monitoring sensor; Based on the trained federated learning model, the output data of the monitoring sensor is used as input to monitor and analyze the behavior of the cloud platform in real time, identify abnormal behavior and generate a forensic report; The forensic report is hash-checked and digitally signed and stored on the blockchain.

[0005] Furthermore, the data transmission encryption protocol is expressed by the following formula (1): C = E(M, k) (1) In the formula, C represents the encrypted data; E represents the encryption function; M represents the original data; and k represents the encryption key.

[0006] Furthermore, the objective function is expressed as: (2) In the formula, y is the target variable, x 1, x 2, ..., x n Represents different feature variables, β 0, β 1, ..., β n represents the weight parameter of the federated learning model, and ϵ represents the error term.

[0007] Furthermore, the target terminal trains the federated learning model to obtain the model gradient and model loss by the following method: Based on the monitoring sensor, the real-time data stream generated on the cloud platform is obtained, and the streaming processing technology is used for real-time cleaning to obtain data samples; Using a privacy set intersection scheme to compare the data sample with data samples of other target terminals to obtain a data set; The federated learning model configured on the target terminal is trained using the data set to obtain a model gradient and a model loss.

[0008] Furthermore, the federated learning model configured on the target terminal is trained using the data set, and the model loss is calculated using the following formula (3) or formula (4): (3) (4) In the formula, Indicates i The model loss of the target terminal, Indicates i The dataset size of the target terminal, Indicates j The true value of the data sample, represents the model parameters, Indicates i Among the target terminals j data samples, Indicates that the model has parameters Next pair The predicted value of represents the regularization parameter.

[0009] Furthermore, the federated learning model configured on the target terminal is trained using the data set, and the model gradient is calculated using the following formula (5): (5) In the formula, represents the model gradient.

[0010] In a second aspect, the present application provides an online evidence collection device, comprising: The monitoring sensors are deployed in each target area in the cloud platform with authorization permission from each target area; One of the target terminals corresponds to one of the target areas, and the target terminal is connected to a monitoring sensor in the corresponding target area to obtain monitored data from the monitoring sensor based on a data transmission encryption protocol; The central server is connected to the target terminal by signal, and the central server is used to establish a federated learning model based on the objective function, and transmit the federated learning model to each target terminal; based on the set number of iterations or convergence conditions, iterative training of the federated learning model is performed until the set number of iterations or convergence conditions are reached, and a trained federated learning model is obtained, and each iterative training includes: obtaining the model gradient and model loss transmitted by each target terminal, and aggregating the model gradient and model loss transmitted by each target terminal to obtain a weight matrix and transmit it to each target terminal respectively; the target terminal updates the federated learning model based on the weight matrix; wherein the model gradient and model loss transmitted by the target terminal are obtained by training the federated learning model using a data set, and the data set is constructed by the target terminal according to the data fed by the monitoring sensor; The central server is also used to monitor and analyze the behavior of the cloud platform in real time based on the trained federated learning model and using the output data of the monitoring sensor as input, identify abnormal behavior and generate a forensic report; perform hash verification and digital signature on the forensic report and store it on the blockchain.

[0011] In a third aspect, the present application provides an electronic device, comprising: a processor and a memory; the memory is used to store instructions; the processor is used to execute the instructions in the memory, so that the electronic device executes the method described in the first aspect.

[0012] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the method described in the first aspect.

[0013] In a fifth aspect, the present application provides a computer program product, including a computer program, which implements the method described in the first aspect when executed by a processor.

[0014] The online evidence collection method, device, equipment and storage medium provided by this application have the following beneficial effects: 1) Data privacy protection is achieved through decentralized training and encrypted data transmission: Decentralized training: Federated learning allows each participant to train the model locally, and only upload the model parameters (not the original data) to the central server or transmit them point-to-point. This approach fundamentally reduces the risk of data leakage and protects privacy.

[0015] Encrypted transmission: During data transmission, encryption technology can be used to ensure the security of model parameters and prevent them from being intercepted or tampered with during transmission.

[0016] 2) Improving forensics efficiency through federated aggregation: Federated learning in the cloud environment can utilize the distributed resources of the cloud to achieve large-scale parallel training. Each participant can use its own resources to independently train the model, accelerating the model convergence speed. In addition, through the federation aggregation of the central server, each participant can obtain the latest model parameters in real time and quickly deploy them to the local model for a new round of training. This real-time update mechanism makes the forensics process more efficient.

[0017] 3) Enhance forensic accuracy through multi-source data fusion and collaborative training Multi-source data fusion: Federated learning can fuse multi-source data from different participants (indirectly through model parameters) to capture more comprehensive and rich information. In electronic forensics, this helps to discover potential abnormal behaviors and hidden evidence.

[0018] Collaborative training: Through repeated iterative training, federated learning can continuously optimize model performance and improve the accuracy of forensic analysis.

[0019] 4) Reduce the cost of evidence collection by reducing the amount of data transmission: Reduced data transmission: Compared with traditional centralized training methods, federated learning reduces the need for data transmission. Each participant only needs to upload model parameters instead of the entire dataset, thereby reducing data transmission and storage costs.

[0020] 5) Strong adaptability: Support for heterogeneous data: Federated learning can process heterogeneous data from different companies and different application scenarios. In electronic forensics, this helps to cope with complex and changing forensic scenarios and data types.

[0021] Dynamic participation: Enterprises can choose to participate in or exit the federated learning process based on their own needs and actual conditions. This flexibility makes federated learning more adaptable to dynamically changing forensic needs in a cloud environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0023] Figure 1 An application scenario diagram of a prior evidence collection method is shown as an exemplary embodiment; Figure 2 A flowchart of an online evidence collection method is shown as an exemplary embodiment; Figure 3 The following is a flowchart of a federated learning model training according to an exemplary embodiment; Figure 4Another flow chart of an online evidence collection method shown as an exemplary embodiment; Figure 5 A training flowchart of a federated learning model is shown as an exemplary embodiment; Figure 6 The figure is a structural diagram of an online evidence collection device showing an exemplary embodiment.

[0024] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0025] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0026] It should be noted that the links involved in this application and the relevant information in the links, platform-related information, etc. (including but not limited to data used for analysis, stored data, displayed data, etc.) are all information and data that are understood and authorized by the relevant users or fully authorized by all parties, and the collection, use, processing, transmission, provision, disclosure and application of the relevant data comply with the laws, regulations and standards of the relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and comply with the principles of legality, legitimacy and necessity.

[0027] Currently, in cloud computing environments, data is distributed across multiple virtual machines and servers, and may even span different geographical locations and jurisdictions. This distributed storage method makes centralized data forensics extremely difficult. Data in cloud computing systems is updated in real time, including user data, application data, system logs, etc. For centralized forensics of this distributed storage data, static data extraction is currently used. Static data extraction refers to the process of extracting data from devices such as computer disks, memory cards, and mobile phones. This method is mainly used for data recovery, analysis, and search purposes, and does not involve the real-time operating status of the device. Static data extraction methods mainly include the following: Physical forensics: Extracting data from devices by physical means, which is suitable for situations where physical contact with the device is required. Logical forensics: Extracting data from devices by logical means, which is suitable for situations where physical contact with the device is not possible. Disk analysis: Extracting residual data by analyzing the storage space of the disk. Static data extraction tools, commonly used static data extraction tools include: Agent software: Deployed on the database, obtains data by reading the database. Database development interface: Use the database interface to collect data. ‌ETL tools‌: Data collection is performed through ETL technology, which is applicable to various database types. Static data extraction methods cannot quickly respond to and capture changing evidence, and cannot solve the data silos and privacy protection issues in cloud environments.

[0028] Based on this, an online forensics method, device, equipment, storage medium and computer program product are proposed in this embodiment, which utilizes the unique advantages of federated learning to achieve joint modeling and analysis of multiple parties without directly sharing sensitive data. Through decentralized data processing and model training, this technology effectively breaks down data silos and promotes the sharing and utilization of data resources. At the same time, combined with the cloud's operating state monitoring technology, this application can monitor the operating state of the cloud system in real time and comprehensively, and promptly detect potential security threats or abnormal behaviors. In terms of forensics, this technology makes full use of privacy protection technology to ensure that user data is strictly protected during the collection and analysis of evidence, thereby effectively solving the risk of privacy leakage.

[0029] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0030] Figure 1 FIG. 1 is an application scenario diagram of a prior evidence collection method shown in an exemplary embodiment. Figure 1As shown, the application scenario 100 includes a cloud platform 101, a monitoring sensor 102, multiple target terminals 103, a central server 104, and a blockchain terminal 105. Multiple target areas 1011 are distributed in the cloud platform 101, wherein the target area 1011 is a storage area of ​​the target terminal 103 in the cloud platform 101, and the target area 1011 is used to store the operation data of the corresponding target terminal 103, and the operation data is usually only authorized to be extracted by the corresponding target terminal 103.

[0031] Since the data between each target terminal 103 are all private data or sensitive data, in order to avoid data leakage and use a large amount of data for model training, this embodiment establishes a federated learning model based on the objective function through the central server 104, and transmits the federated learning model to each target terminal 103; after receiving the federated learning model, the target terminal 103 uses the data obtained in real time from the cloud platform 101 through the monitoring sensor 102 to perform model training locally, and feeds back the model gradient and model loss during the training process to the central server 104 in real time. The central server 104 aggregates the model gradients and model losses transmitted by multiple target terminals 103 to obtain the weighted The weight matrix is ​​fed back to each target terminal 103, and each target terminal 103 updates the federated learning model based on the weight matrix, and performs the next round of training based on the updated federated learning model and the data stream obtained in real time, and repeats this cycle until the training round is reached or the model converges, and the training is terminated to obtain a trained federated learning model. The trained federated learning model can be configured on each target terminal 103 or the central server 104, and the output data of the monitoring sensor 102 is used as input to monitor and analyze the cloud platform behavior in real time, identify abnormal behavior and generate a forensic report; the forensic report is hashed and digitally signed, and stored on the blockchain of the blockchain terminal 105.

[0032] It should be noted that the monitoring sensor 102 is deployed only with the authorization of the target area 1011. For example, in this embodiment, the target area 1011 is a data storage area of ​​a certain subject on the cloud platform 101. The certain subject can be, for example, a certain enterprise, which has multiple departments, and each department is located in a different area. For example, department a is located in city B, province A, and department b is located in city D, province C. In this case, the cloud platform can be used as a data storage platform to help departments located in different areas to achieve data interaction. The data of each department is uploaded to the corresponding target area 1011. The role of the target terminal 103 is to summarize the data of the enterprise through the monitoring sensor 102 and interact with the central server 104. Therefore, the deployment of the monitoring sensor 102 in the target area 1011 can be implemented by the enterprise, that is, the enterprise independently summarizes its own data, and does not involve improper use. The target terminal 103 can usually be managed by the enterprise (such as the corporate headquarters).

[0033] In a specific application scenario, the target terminal 103 can serve as a data provider for multiple enterprises. The data it provides are production-related data of the enterprises. Since the production-related data of the enterprises are private data for each enterprise and cannot be shared, multiple enterprises can negotiate to generate an intermediary party, which is a party trusted by multiple enterprises. The intermediary aggregates the model gradients and model losses transmitted by multiple target terminals 103 through the central server 104 to obtain a weight matrix and feed it back to each target terminal 103 to assist the local training of each target terminal 103. Finally, a trained federated learning model can be obtained. This trained federated learning model can be configured on the target terminal 103. The target terminal 103 can identify abnormal behavior and generate a forensic report based on the data fed by the monitoring sensor 102 and the trained federated learning model, thereby discovering abnormal behavior data. Based on the abnormal behavior data, it can be determined that abnormal production processes within the enterprise have occurred, and then the production process can be improved.

[0034] The embodiment of the present application provides a prior evidence collection method. It should be noted that the online evidence collection method provided by the present application can be implemented on any electronic device with data processing capabilities (such as Figure 1 The central server 104 shown in FIG. 1 may also be an online evidence collection system. It should be noted that the online evidence collection system may be deployed on an electronic device in any environment (for example, deployed on an edge server in an edge environment), may be deployed entirely in a cloud environment, or may be deployed in different environments in a distributed manner.

[0035] For example, an online forensic system can be logically divided into multiple parts, each with different functions. The parts in the online forensic system can be deployed in any two or three of the electronic device (located on the user side, such as the client), the edge environment, and the cloud environment. The edge environment is an environment that includes a collection of edge electronic devices that are close to the electronic device. The edge electronic devices include: edge servers, edge stations with computing power, etc. The various parts of the online forensic system deployed in different environments or devices work together to realize the functions of the data processing platform.

[0036] It should be understood that this application does not restrictively divide which parts of the online forensic system are deployed in what specific environment. In actual application, it can be adaptively deployed according to the computing power of the electronic device, the resource usage of the edge environment and the cloud environment, or the specific application requirements.

[0037] Figure 2 is a flowchart of an online evidence collection method shown in an exemplary embodiment. Figure 2 As shown, the method first implements system deployment and configuration, that is, deploys listening sensors at all levels of the cloud platform. Secondly, configure the data transmission encryption protocol and. Thirdly, perform federated learning data preprocessing: that is, data cleaning, sample alignment, feature similarity analysis, feature alignment, and indicator modeling analysis. Then, perform federated learning model training: loss function, gradient, regularization. Next, we conduct real-time forensics and analysis: use the trained model to monitor and analyze the cloud platform behavior in real time, identify abnormal behavior and generate a forensics report. Finally, perform evidence verification and storage: perform hash verification and digital signature on key evidence, and store it on the blockchain to ensure the credibility and integrity of the evidence. Specifically, the method includes steps S1 to S5, which are described in detail as follows: S1: With the authorization permission of each target area, at least one monitoring sensor is deployed in each target area in the cloud platform; wherein each target area corresponds to a target terminal, and the monitoring sensor feeds the monitored data to the target terminal based on a data transmission encryption protocol.

[0038] In some embodiments, the data transmission encryption protocol is expressed by the following formula (1): C = E(M, k) (1) In the formula, C represents the encrypted data; E represents the encryption function; M represents the original data; and k represents the encryption key.

[0039] S2: Establish a federated learning model based on the objective function and transmit the federated learning model to each target terminal.

[0040] In some embodiments, the objective function is expressed as: (2) In the formula, y is the target variable, x 1, x 2, ..., x n Represents different feature variables, β 0, β 1, ..., β n represents the weight parameter of the federated learning model, and ϵ represents the error term.

[0041] It should be noted that the purpose of the federated learning model is to determine whether there is abnormal behavior based on the behavior data of the target terminal, and to collect evidence for the abnormal behavior data. Therefore, in some embodiments, the characteristic variable in the federated learning model can be the behavior data that needs to be monitored, and the target variable can be a characteristic value that characterizes the abnormal behavior. After obtaining the target variable, the target variable can be compared with the set threshold. If the target variable is within the set threshold, it is determined that the characteristic variable corresponding to the target variable is abnormal, and the behavior data corresponding to the characteristic variable is extracted and stored to achieve evidence collection. As an example, in an enterprise abnormal emission data monitoring scenario, the monitored enterprise is the target terminal, and the characteristic variable is determined based on the emission data. For example, the emission data includes the emission amount of pollutants, where the pollutants can have multiple types, and thus correspond to multiple characteristic variables. Based on this, the abnormal emission data of multiple enterprises with similar properties (such as enterprises producing the same products) can be monitored and collected in real time based on the federated learning model. The weight parameters of the federated learning model are determined by the model training process in the subsequent step S3.

[0042] S3: Based on the set number of iterations or convergence conditions, iterative training of the federated learning model is performed until the set number of iterations or convergence conditions are reached to obtain a trained federated learning model. Each iterative training includes: obtaining the model gradient and model loss transmitted by each target terminal, and aggregating the model gradient and model loss transmitted by each target terminal to obtain a weight matrix and transmit it to each target terminal respectively. Each target terminal updates the federated learning model based on the weight matrix; wherein, the model gradient and model loss transmitted by the target terminal are obtained by training the federated learning model using a data set, and the data set is constructed by the target terminal based on data fed by the monitoring sensor.

[0043] In some embodiments, Figure 3 This is a flowchart of a federated learning model training shown in an exemplary embodiment. The target terminal trains the federated learning model through the following steps to obtain the model gradient and model loss: S301, obtaining the data stream generated in real time on the cloud platform based on the monitoring sensor, and using the streaming processing technology to perform real-time cleaning to obtain a data sample; S302, using a privacy set intersection scheme to compare the data sample with data samples of other target terminals to obtain a data set; S303: Use the data set to train the federated learning model configured on the target terminal to obtain the model gradient and model loss.

[0044] In some embodiments, the federated learning model configured on the target terminal is trained using the data set, and the model loss is calculated using the following formula (3) or formula (4): (3) (4) In the formula, Indicates i The model loss of the target terminal, Indicates i The dataset size of the target terminal, Indicates j The true value of the data sample, represents the model parameters, Indicates i Among the target terminals j data samples, Indicates that the model has parameters Next pair The predicted value of represents the regularization parameter.

[0045] It should be noted that in actual implementation, the model loss can be calculated based on formula (3) or formula (4), where formula (4) is a regularization based on formula (3). Compared with formula (3), choosing formula (4) to calculate the model loss can improve training efficiency and reduce the risk of model overfitting.

[0046] In some embodiments, the federated learning model configured on the target terminal is trained using the data set, and the model gradient is calculated using the following formula (5): (5) In the formula, represents the model gradient.

[0047] S4: Based on the trained federated learning model, the output data of the monitoring sensor is used as input to monitor and analyze the cloud platform behavior in real time, identify abnormal behavior and generate a forensic report.

[0048] S5: Perform hash verification and digital signature on the forensic report and store it on the blockchain.

[0049] In an exemplary embodiment, Figure 4 FIG. 1 is another flow chart of an online evidence collection method, which includes the following steps: Step 1: Implement system deployment and configuration, that is, deploy monitoring sensors at all levels of the cloud platform, and configure data transmission encryption protocols and blockchain nodes.

[0050] Step 2: Complete the data transmission encryption protocol:

[0051] Where: C represents the encrypted data (Ciphertext) E represents the encryption function M stands for original data (Message, plain text) k represents the encryption key.

[0052] Step 3: Perform federated learning data preprocessing: data cleaning, sample alignment, feature similarity analysis, feature alignment, feature binning, feature missing value filling and indicator modeling analysis.

[0053] Among them, data cleaning includes: using streaming processing technology to perform real-time cleaning on the data stream generated in real time on the cloud platform to ensure the real-time and accuracy of the data.

[0054] Sample alignment includes: using the Privacy Set Intersection (PSI) RSA scheme to align sample IDs and find these common users so that in subsequent model training or forensics, joint analysis can be performed based on the characteristics of these common users.

[0055] Step 4: Establish an objective function to build a federated learning model and train the federated learning model. The objective function is as shown in formula (2). The model loss and model gradient calculation during the model training process refer to the above formulas (3) to (5).

[0056] Step 5: Iterate the federated learning model (including updating parameter weights, etc.) until the model converges.

[0057] Step 6: Perform real-time forensics and analysis: Use the trained model to monitor and analyze cloud platform behavior in real time, identify abnormal behavior and generate forensics reports.

[0058] Step 7: Verify and store evidence: Perform hash verification and digital signature on key evidence and store it on the blockchain to ensure the credibility and integrity of the evidence.

[0059] In an exemplary embodiment, Figure 5 As shown in FIG, a training flow chart of a federated learning model is shown. Taking Party A, Party B and Party C as an example, Party A and Party B are data providers (both Party A and Party B are enterprises in this embodiment), and Party C is the evidence collector.

[0060] Party C first defines the scope of the enterprise that needs to be collected, including but not limited to basic information such as enterprise name, registered address, main business, and affiliated companies. According to the nature of the case or the needs of the investigation, the specific direction of evidence collection is clarified, and then the ID is aligned, and the privacy set intersection (PSI) RSA scheme is adopted to achieve the alignment of the sample ID and determine the specific ID of the evidence collection object.

[0061] Based on the specific direction determined by Party C, Party A and Party B provide corresponding data. Party A and Party B obtain data locally and clean the data to obtain cleaned data. After the cleaned data is encrypted and entity (id) aligned, the local model (A model for Party A and B model for Party B) is trained, and the gradients and losses of the A model and the B model are calculated and encrypted and transmitted to Party C.

[0062] After decryption, Party C calculates the loss and gradient and returns the updated model parameters to the sub-model for updating and iteration until convergence.

[0063] Finally, based on the trained model A and model B, the total forensic information parameters of the forensic objects A and B are obtained respectively.

[0064] Figure 6 is a structural diagram of an online evidence collection device shown in an exemplary embodiment. The present application embodiment provides an online evidence collection device, such as Figure 6 As shown, the online evidence collection device includes a monitoring sensor 102, a target terminal 103 and a central server 104: The monitoring sensors 102 are deployed in each target area in the cloud platform with authorization permission from each target area; One of the target terminals 103 corresponds to one of the target areas, and the target terminal 103 is connected to the monitoring sensor 601 in the corresponding target area to obtain the monitored data from the monitoring sensor 601 based on the data transmission encryption protocol; The central server 104 is connected to the target terminal 103 by signal. The central server 104 is used to establish a federated learning model based on the objective function and transmit the federated learning model to each target terminal; based on the set number of iterations or convergence conditions, iterative training of the federated learning model is performed until the set number of iterations or convergence conditions are reached to obtain a trained federated learning model, and each iterative training includes: obtaining the model gradient and model loss transmitted by each target terminal, and aggregating the model gradient and model loss transmitted by each target terminal 103 to obtain a weight matrix and transmit it to each target terminal respectively; the target terminal updates the federated learning model based on the weight matrix; wherein the model gradient and model loss transmitted by the target terminal 103 are obtained by training the federated learning model using a data set, and the data set is constructed by the target terminal according to the data fed by the monitoring sensor 601; The central server 104 is also used to monitor and analyze the behavior of the cloud platform in real time based on the trained federated learning model and using the output data of the monitoring sensor as input, identify abnormal behavior and generate a forensic report; perform hash verification and digital signature on the forensic report, and store it on the blockchain.

[0065] In some embodiments, the data transmission encryption protocol is represented by the following formula (1): C = E(M, k) (1) In the formula, C represents the encrypted data; E represents the encryption function; M represents the original data; and k represents the encryption key.

[0066] In some embodiments, the objective function is expressed as: (2) In the formula, y is the target variable, x 1, x 2, ..., x n Represents different feature variables, β 0, β 1, ..., β n represents the weight parameter of the federated learning model, and ϵ represents the error term.

[0067] In some embodiments, the target terminal trains the federated learning model to obtain the model gradient and model loss by the following method: Based on the monitoring sensor, the real-time data stream generated on the cloud platform is obtained, and the streaming processing technology is used for real-time cleaning to obtain data samples; Using a privacy set intersection scheme to compare the data sample with data samples of other target terminals to obtain a data set; The federated learning model configured on the target terminal is trained using the data set to obtain a model gradient and a model loss.

[0068] In some embodiments, the target terminal uses the data set to train the federated learning model configured on the target terminal, and calculates the model loss using the following formula (3) or formula (4): (3) (4) In the formula, Indicates i The model loss of the target terminal, Indicates i The dataset size of the target terminal, Indicates j The true value of the data sample, represents the model parameters, Indicates i Among the target terminals j data samples, Indicates that the model has parameters Next pair The predicted value of represents the regularization parameter.

[0069] In some embodiments, the target terminal uses the data set to train the federated learning model configured on the target terminal, and calculates the model gradient using the following formula (5): (5) In the formula, represents the model gradient.

[0070] The online evidence collection device provided in this embodiment can be used to execute the above-mentioned online evidence collection method. Its implementation principle and technical effects are similar, and this embodiment will not be repeated here.

[0071] An embodiment of the present application provides an electronic device, which may include: a processor and a memory, wherein the processor and the memory can communicate; exemplarily, the processor and the memory communicate via a communication bus, the memory is used to store computer execution instructions, and the processor is used to call the computer execution instructions in the memory to execute the online forensics method shown in any of the above method embodiments.

[0072] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the present application may be directly implemented as being executed by a hardware processor, or may be implemented by a combination of hardware and software modules in the processor.

[0073] The present application provides a computer-readable storage medium, on which computer-executable instructions are stored; when the computer-executable instructions are executed by a processor, they are used to implement an online forensics method as in any of the above embodiments.

[0074] An embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the above-mentioned online forensics method is implemented.

[0075] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0076] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. An online evidence collection method, characterized in that: include: With authorization from each target area, at least one monitoring sensor is deployed in each target area in the cloud platform; wherein each target area corresponds to a target terminal, and the monitoring sensor feeds the monitored data to the target terminal based on a data transmission encryption protocol; Establishing a federated learning model based on the objective function, and transmitting the federated learning model to each target terminal; Based on the set number of iterations or convergence conditions, iterative training of the federated learning model is performed until the set number of iterations or convergence conditions are reached, and a trained federated learning model is obtained, wherein each iterative training includes: obtaining the model gradient and model loss transmitted by each target terminal, and aggregating the model gradient and model loss transmitted by each target terminal to obtain a weight matrix and transmit it to each target terminal respectively, and each target terminal updates the federated learning model based on the weight matrix; wherein the model gradient and model loss transmitted by the target terminal are obtained by training the federated learning model using a data set, and the data set is constructed by the target terminal according to the data fed by the monitoring sensor; Based on the trained federated learning model, the output data of the monitoring sensor is used as input to monitor and analyze the behavior of the cloud platform in real time, identify abnormal behavior and generate a forensic report; The forensic report is hash-checked and digitally signed and stored on the blockchain.

2. The method according to claim 1, characterized in that The data transmission encryption protocol is expressed by the following formula (1): C = E(M, k) (1) In the formula, C represents the encrypted data; E represents the encryption function; M represents the original data; and k represents the encryption key.

3. The method according to claim 1, characterized in that: The objective function is expressed as: （2） In the formula, y is the target variable, x 1, x 2, ..., x n Represents different feature variables, β 0, β 1, ..., β n represents the weight parameter of the federated learning model, and ϵ represents the error term.

4. The method according to claim 1, characterized in that: The target terminal trains the federated learning model to obtain the model gradient and model loss by the following method: Based on the monitoring sensor, the real-time data stream generated on the cloud platform is obtained, and the streaming processing technology is used for real-time cleaning to obtain data samples; Using a privacy set intersection scheme to compare the data sample with data samples of other target terminals to obtain a data set; The federated learning model configured on the target terminal is trained using the data set to obtain a model gradient and a model loss.

5. The method according to claim 4, characterized in that The federated learning model configured on the target terminal is trained using the data set, and the model loss is calculated using the following formula (3) or formula (4): （3） （4） In the formula, Indicates i The model loss of the target terminal, Indicates i The dataset size of the target terminal, Indicates j The true value of the data sample, represents the model parameters, Indicates i Among the target terminals j data samples, Indicates that the model has parameters Next pair The predicted value of represents the regularization parameter.

6. The method according to claim 5, characterized in that The federated learning model configured on the target terminal is trained using the data set, and the model gradient is calculated using the following formula (5): （5） In the formula, represents the model gradient.

7. An online evidence collection device, characterized in that: Including monitoring sensors, target terminals and central servers: The monitoring sensors are deployed in each target area in the cloud platform with authorization permission from each target area; One of the target terminals corresponds to one of the target areas, and the target terminal is connected to a monitoring sensor in the corresponding target area to obtain monitored data from the monitoring sensor based on a data transmission encryption protocol; The central server is signal-connected to the target terminal, and the central server is used to establish a federated learning model based on the objective function and transmit the federated learning model to each target terminal; Based on the set number of iterations or convergence conditions, iterative training of the federated learning model is performed until the set number of iterations or convergence conditions are reached to obtain a trained federated learning model, wherein each iterative training includes: obtaining a model gradient and a model loss transmitted by each target terminal, and aggregating the model gradient and the model loss transmitted by each target terminal to obtain a weight matrix and transmit it to each target terminal respectively; the target terminal updates the federated learning model based on the weight matrix; wherein the model gradient and the model loss transmitted by the target terminal are obtained by training the federated learning model using a data set, and the data set is constructed by the target terminal according to the data fed by the monitoring sensor; The central server is also used to monitor and analyze the behavior of the cloud platform in real time based on the trained federated learning model and using the output data of the monitoring sensor as input, identify abnormal behavior and generate a forensic report; perform hash verification and digital signature on the forensic report and store it on the blockchain.

8. An electronic device, characterized in that: The electronic device comprises: a processor and a memory; the memory is used to store instructions; the processor is used to execute the instructions in the memory, so that the electronic device executes the method as claimed in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

10. A computer program product, characterized in that The method comprises a computer program, which implements the method according to any one of claims 1 to 6 when being executed by a processor.

Images