Evidence obtaining method and system based on virtual knowledge graph and big data

Abstract

The invention provides an evidence obtaining method and system based on a virtual knowledge graph and big data. The method comprises the steps that a field knowledge graph of an evidence obtaining field is constructed, data sources involved in evidence obtaining are obtained, and a mapping set between the field knowledge graph and the data sources is established; constructing evidence extraction and analysis rules based on the mapping set; obtaining an evidence obtaining request issued by a user, and segmenting the evidence obtaining request based on the domain knowledge graph to obtain a plurality of sub evidence obtaining requests; according to the method, the answer set is determined based on the multiple sub evidence obtaining requests, the answer set is converted into the knowledge graph format to obtain the evidence obtaining set, accurate and comprehensive results can be provided in multi-level evidence analysis, powerful technical support is provided for the fields of judicial expertise and the like, and the method has wide application prospects.

Description

Technical Field

[0001] The present invention belongs to the technical field of electronic virtual forensics, and specifically relates to a forensics method and system based on virtual knowledge graph and big data. Background Art

[0002] With the acceleration of digitalization and the widespread use of cloud computing, more and more data is stored in the cloud. In a cloud computing environment, data storage and transmission span multiple layers such as the virtual layer, application layer, and service layer, and user behavior also presents complex and changeable characteristics. This makes data forensics in cloud environments face many challenges, such as wide distribution of data, diverse formats, dynamic changes, and privacy protection. Traditional forensic technology has many difficulties when facing cloud environments, such as difficulty in evidence collection, data dispersion, and complex storage. Existing technologies are difficult to effectively perform comprehensive forensic analysis in cloud environments. Therefore, there is an urgent need for a new forensic method that can integrate multiple data sources to meet the multi-level and complex forensic needs in cloud environments. Summary of the invention

[0003] In order to solve the above technical problems, the present invention provides a forensics method and system based on virtual knowledge graph and big data, which are used to solve the technical problems in the prior art.

[0004] On the one hand, the present invention provides the following technical solution, a forensics method based on virtual knowledge graph and big data, comprising: Construct a domain knowledge graph in the field of forensics, obtain the data source involved in forensics and establish a mapping set between the domain knowledge graph and the data source; constructing evidence extraction and analysis rules based on the mapping set; Obtaining a forensic request issued by a user, and dividing the forensic request based on the domain knowledge graph to obtain a plurality of sub-forensic requests; An answer set is determined based on the plurality of sub-forensic requests, and the answer set is converted into a format of a knowledge graph to obtain a forensic set.

[0005] Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention maps multi-source, heterogeneous and distributed data sources related to forensics to a unified knowledge graph. Forensic personnel can obtain data related to forensics through the knowledge graph, establish semantic associations between data, and mine implicit and contradictory information in the data source through the reasoning ability of the knowledge graph. In addition, the constructed rule base related to forensics can help forensics personnel perform automatic forensics operations, establish evidence chain analysis, and generate forensics reports. The present invention realizes multi-level and dynamic evidence collection and analysis through a unified semantic layer, which can effectively solve the main problems faced in the prior art to improve the efficiency, accuracy and reliability of forensics, and ensure the interpretability of forensics results. It can also provide accurate and comprehensive results in multi-level evidence analysis, provide strong technical support for fields such as forensic identification, and has broad application prospects.

[0006] Preferably, the steps of constructing the domain knowledge graph in the field of forensics are specifically as follows: Construct several prompt templates, continuously send the prompt templates to the large language model, extract the semantic relations in the forensic field, iteratively repeat the prompt template sending and semantic relation extraction process to obtain the domain knowledge graph.

[0007] Preferably, the semantic relationship includes semantic relationship between concepts in the field of forensics, semantic relationship between attributes in the field of forensics, and semantic relationship between concepts and attributes in the field of forensics.

[0008] Preferably, the mapping set for: ; ; In the formula, It is shaped like The set of mappings of Map the data in each data source to the domain knowledge graph. Indicates that for The query statement of a data source, Represents a class or attribute in a domain knowledge graph, Represents a transformation function, which describes how to transform data in the data source into entities or objects in the knowledge graph.

[0009] Preferably, the step of constructing evidence extraction and analysis rules based on the mapping set is specifically as follows: Based on the vocabulary in the domain knowledge graph, the review and judgment rules of evidence described in natural language in legal documents are formalized to obtain evidence extraction and analysis rules: ; In the formula, Represents the antecedents or reasoning premises of evidence extraction and analysis rules, Represents the consequent or reasoning conclusion of the evidence extraction and analysis rules.

[0010] Preferably, the step of obtaining a forensic request issued by a user and dividing the forensic request based on the domain knowledge graph to obtain a plurality of sub-forensic requests includes: Get the evidence collection request issued by the user , rewrite the evidence collection request and encode the knowledge of the domain knowledge graph to obtain a rewritten request ; The rewrite request is mapped according to the mapping between each data source and the domain knowledge graph in the mapping set. Split into several sub-forensic requests .

[0011] Preferably, the step of determining an answer set based on the plurality of sub-forensic requests and converting the answer set into a knowledge graph format to obtain a forensic set includes: Converting the sub-forensic request into a request supported by the corresponding data source through the mapping set to obtain a converted request; Responding to the conversion request on the corresponding data source according to the evidence extraction and analysis rules to obtain a sub-answer set; Merging a plurality of sub-answer sets according to the segmentation method of the evidence collection request to obtain an answer set; The answer tracing information of each of the sub-answer sets in each of the answer sets is obtained, and the answer tracing information and the answer set are converted into a format corresponding to the domain knowledge graph to obtain a forensics set.

[0012] In a second aspect, the present invention provides the following technical solution: a forensics system based on virtual knowledge graph and big data, the system comprising: A construction module is used to construct a domain knowledge graph in the field of forensics, obtain the data source involved in forensics and establish a mapping set between the domain knowledge graph and the data source; A rule module, used for constructing evidence extraction and analysis rules based on the mapping set; A segmentation module is used to obtain a forensic request issued by a user, and segment the forensic request based on the domain knowledge graph to obtain a plurality of sub-forensic requests; The forensics module is used to determine an answer set based on the plurality of forensics sub-requests, and convert the answer set into a format of a knowledge graph to obtain a forensics set.

[0013] In a third aspect, the present invention provides the following technical solution: a computer comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the forensics method based on virtual knowledge graph and big data as described above is implemented.

[0014] In a fourth aspect, the present invention provides the following technical solution: a storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the forensics method based on virtual knowledge graph and big data as described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 A flowchart of a method for obtaining evidence based on a virtual knowledge graph and big data provided in Example 1 of the present invention; Figure 2 A structural block diagram of a forensics system based on virtual knowledge graph and big data provided in the second embodiment of the present invention; Figure 3 A schematic diagram of the hardware structure of a computer provided in another embodiment of the present invention.

[0017] The embodiments of the present invention will be further described below with reference to the accompanying drawings. DETAILED DESCRIPTION

[0018] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the embodiments of the present invention, and should not be construed as limiting the present invention.

[0019] In the description of the embodiments of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside" and "outside" etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the embodiments of the present invention and simplifying the description, and do not indicate or imply that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the present invention.

[0020] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0021] In the embodiments of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the embodiments of the present invention can be understood according to specific circumstances.

[0022] Embodiment 1 In the first embodiment of the present invention, Figure 1 As shown, a forensics method based on virtual knowledge graph and big data includes: S1. Construct a domain knowledge graph in the field of forensics, obtain the data source involved in forensics and establish a mapping set between the domain knowledge graph and the data source; Specifically, the step S1 is as follows: Constructing several prompt templates, continuously sending the prompt templates to the large language model, extracting semantic relations in the forensic domain, and iteratively repeating the prompt template sending and semantic relation extraction process to obtain a domain knowledge graph; The semantic relationship includes the semantic relationship between concepts in the field of forensics, the semantic relationship between attributes in the field of forensics, and the semantic relationship between concepts and attributes in the field of forensics.

[0023] It should be noted that the prompt template can be generated through literature, books, legal documents and cases in the field of forensics. Combined with the large language model, the prompt template is input into the large language model for repeated training, so that the large language model can repeatedly extract concepts and attributes in the field of forensics and establish corresponding semantic relationships, such as "physical evidence "Evidence", "witness "Evidence", "Physical Evidence Witnesses”, among which " indicates a subcategory relationship, " " indicates a disjoint relationship until the process is terminated, and the corresponding domain knowledge graph can be generated. The obtained domain knowledge graph provides a unified semantic view for the multi-source, heterogeneous and distributed data sources involved in forensics. In addition, the domain knowledge graph also provides a unified standard semantic vocabulary set for the forensics field and forensics personnel, as well as a structured description of the knowledge in the forensics field.

[0024] At the same time, in collecting and determining the data sources involved in the forensics In the process of big data, in order to ensure the diversity and richness of evidence, it is necessary to obtain evidence information from multiple data sources, such as log files and user behavior data. In addition, it is necessary to record the access method of each data source to lay the foundation for the subsequent dynamic and real-time access to the data in the data source through the domain knowledge graph. For example, if the data source It is a database that needs to record information such as username, URL, and password for accessing the database. At the same time, in order to establish a unified semantic view, it is necessary to build a mapping relationship between the domain knowledge graph and the data source, that is, a mapping set. This mapping relationship formally describes how to map the data in each data source to the concepts and attributes in the domain knowledge graph. It is the core of dynamically and real-time acquisition of evidence-related data from multi-source, heterogeneous and distributed data sources from the domain knowledge graph, that is, a unified semantic view. In addition, this mapping relationship is also the key to enhancing the semantic association and interoperability of data in different data sources through the domain knowledge graph.

[0025] Among them, the mapping set for: ; ; In the formula, It is shaped like The set of mappings of Map the data in each data source to the domain knowledge graph. Indicates that for The query statement of a data source, Represents a class or attribute in a domain knowledge graph, Represents a transformation function, which describes how to transform data in the data source into entities or objects in the knowledge graph.

[0026] It should be noted that only the data source needs to be The data that needs to be accessed in the process is mapped to the domain knowledge graph, rather than All data in the database, that is, data not related to the forensics field, does not need to be mapped.

[0027] S2. constructing evidence extraction and analysis rules based on the mapping set; Specifically, in order to automatically review and analyze the authenticity, legality, and relevance of the evidence collection results, corresponding evidence extraction and analysis rules can be determined based on the domain knowledge graph, data source, and mapping set. The specific step S2 includes: Based on the vocabulary in the domain knowledge graph, the review and judgment rules of evidence described in natural language in legal documents are formalized to obtain evidence extraction and analysis rules: ; In the formula, Represents the antecedents or reasoning premises of evidence extraction and analysis rules, Represents the consequent or inference conclusion of evidence extraction and analysis rules; The review and judgment rules are the authenticity, legality and relevance of the evidence, and when the reasoning premise After being satisfied, the conclusion of the reasoning can be obtained .

[0028] S3, obtaining a forensic request issued by a user, and dividing the forensic request based on the domain knowledge graph to obtain a plurality of sub-forensic requests; Wherein, the step S3 comprises: S31. Obtain the evidence collection request issued by the user , rewrite the evidence collection request and encode the knowledge of the domain knowledge graph to obtain a rewritten request ; Specifically, for a rewrite request, the knowledge in the knowledge graph is encoded therein. For example, if the evidence collection request is to query "evidence", then after the knowledge in the domain knowledge graph, the rewrite request will also query "witnesses", "physical evidence", etc.

[0029] S32, according to the mapping between each data source in the mapping set and the domain knowledge graph, the rewrite request Split into several sub-forensic requests ; Specifically, for the evidence information that satisfies the rewrite request, it may be distributed in several different data sources, that is, the corresponding evidence information cannot be obtained by answering the evidence request on a certain data source. Therefore, it is necessary to decompose the rewrite request into several sub-evidence requests according to the mapping between each data source and the domain knowledge graph in the mapping set, so that each sub-evidence request can be independently answered on one or several data sources.

[0030] S4, determining an answer set based on the plurality of sub-forensic requests, and converting the answer set into a format of a knowledge graph to obtain a forensic set; Wherein, the step S4 comprises: S41. Convert the sub-forensic request into a request supported by the corresponding data source through the mapping set to obtain a converted request.

[0031] S42. Respond to the conversion request on the corresponding data source according to the evidence extraction and analysis rules to obtain a sub-answer set.

[0032] S43. According to the segmentation method of the evidence collection request, several sub-answer sets are merged to obtain an answer set.

[0033] S44, obtaining the answer tracing information of each of the sub-answer sets in each of the answer sets, converting the answer tracing information and the answer set into a format corresponding to the domain knowledge graph to obtain a forensics set; Specifically, in order to facilitate the presentation of forensic results in a graphical form to help forensic personnel intuitively understand the relationship between data and evidence, the traceability information of each data source is recorded, including which data source each data source comes from and how the data is obtained. The information is then converted together with the answer set into a format corresponding to the domain knowledge graph, that is, a set of RDF triples, and the corresponding forensic set can be output.

[0034] It should be noted that after obtaining the evidence collection set, it is necessary to combine the domain knowledge graph and the evidence extraction and analysis rules to verify whether there is contradictory information in the evidence collection set. For example, in the big data scenario, the information of the same person will be distributed in multiple data sources. Through the unified knowledge graph, the relevant information distributed in multiple data sources will be extracted. It is necessary to verify whether there is a conflict between these information through the pre-built evidence extraction and analysis rules and knowledge graph. For example, the same person cannot appear in two different physical locations at the same time. In addition, it is also necessary to review and analyze the legality and authenticity of the knowledge graph corresponding to the evidence collection results through the evidence extraction and analysis rules, knowledge graph and data source, and establish a chain of evidence. Finally, the pre-defined evidence report template is used to automatically generate a forensic report. In addition to recording the evidence collection process and results in detail, the report will also generate a complete and traceable chain of evidence, providing strong support for legal proceedings and case investigations.

[0035] The first embodiment of the present invention provides a forensics method based on a virtual knowledge graph and big data. The present invention maps multi-source, heterogeneous and distributed data sources related to forensics to a unified knowledge graph. Forensics personnel can obtain data related to forensics through the knowledge graph, establish semantic associations between data, and mine implicit and contradictory information in the data source through the reasoning ability of the knowledge graph. In addition, the constructed rule base related to forensics can help forensics personnel perform automatic forensics operations, establish evidence chain analysis, and generate forensics reports. The present invention realizes multi-level and dynamic evidence collection and analysis through a unified semantic layer, which can effectively solve the main problems faced in the prior art to improve the efficiency, accuracy and reliability of forensics, and ensure the interpretability of forensics results. It can also provide accurate and comprehensive results in multi-level evidence analysis, provide strong technical support for forensic identification and other fields, and has broad application prospects.

[0036] Embodiment 2 like Figure 2 As shown, in the second embodiment of the present invention, a forensics system based on virtual knowledge graph and big data is provided, and the system includes: Construction module 1 is used to construct a domain knowledge graph in the field of forensics, obtain the data source involved in forensics and establish a mapping set between the domain knowledge graph and the data source; A rule module 2, used for constructing evidence extraction and analysis rules based on the mapping set; A segmentation module 3 is used to obtain a forensic request issued by a user, and segment the forensic request based on the domain knowledge graph to obtain a plurality of sub-forensic requests; The evidence collection module 4 is used to determine an answer set based on the plurality of sub-evidence collection requests, and convert the answer set into a format of a knowledge graph to obtain an evidence collection set; The building block 1 is specifically used for: Construct several prompt templates, continuously send the prompt templates to the large language model, extract the semantic relations in the forensic field, iteratively repeat the prompt template sending and semantic relation extraction process to obtain the domain knowledge graph.

[0037] The rule module 2 is specifically used for: Based on the vocabulary in the domain knowledge graph, the review and judgment rules of evidence described in natural language in legal documents are formalized to obtain evidence extraction and analysis rules: ; In the formula, Represents the antecedents or reasoning premises of evidence extraction and analysis rules, Represents the consequent or reasoning conclusion of the evidence extraction and analysis rules.

[0038] The segmentation module 3 comprises: The encoding submodule is used to obtain the forensic request sent by the user , rewrite the evidence collection request and encode the knowledge of the domain knowledge graph to obtain a rewritten request ; The segmentation submodule is used to rewrite the request according to the mapping between each data source and the domain knowledge graph in the mapping set. Split into several sub-forensic requests .

[0039] The evidence collection module 4 comprises: A conversion submodule, used to convert the sub-forensic request into a request supported by the corresponding data source through the mapping set to obtain a conversion request; A response submodule, used to respond to the conversion request on the corresponding data source according to the evidence extraction and analysis rules to obtain a sub-answer set; A fusion submodule, used to fuse a plurality of sub-answer sets according to the segmentation method of the evidence collection request to obtain an answer set; The output submodule is used to obtain the answer tracing information of each sub-answer set in each answer set, and convert the answer tracing information and the answer set into a format corresponding to the domain knowledge graph to obtain a forensics set.

[0040] In some other embodiments of the present invention, the embodiments of the present invention provide the following technical solutions: a computer, comprising a memory 102, a processor 101, and a computer program stored in the memory 102 and executable on the processor 101; when the processor 101 executes the computer program, the forensics method based on virtual knowledge graph and big data as described above is implemented.

[0041] Specifically, the processor 101 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiment of the present invention.

[0042] Among them, the memory 102 may include a large-capacity memory for data or instructions. By way of example and not limitation, the memory 102 may include a hard disk drive (HDD), a floppy disk drive, a solid state drive (SSD), a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive, or a combination of two or more of these. Where appropriate, the memory 102 may include a removable or non-removable (or fixed) medium. Where appropriate, the memory 102 may be inside or outside the data processing device. In a specific embodiment, the memory 102 is a non-volatile memory. In a specific embodiment, the memory 102 includes a read-only memory (ROM) and a random access memory (RAM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically alterable ROM (EAROM) or a flash memory (FLASH), or a combination of two or more of these. Under appropriate circumstances, the RAM can be a static random access memory (SRAM) or a dynamic random access memory (DRAM), wherein the DRAM can be a fast page mode dynamic random access memory (FPMDRAM), an extended data output dynamic random access memory (EDODRAM), a synchronous dynamic random access memory (SDRAM), etc.

[0043] The memory 102 may be used to store or cache various data files that need to be processed and / or used for communication, as well as possible computer program instructions executed by the processor 101 .

[0044] The processor 101 implements the forensic method based on virtual knowledge graph and big data by reading and executing computer program instructions stored in the memory 102.

[0045] In some embodiments, the computer may further include a communication interface 103 and a bus 100. Figure 3 As shown, the processor 101, the memory 102, and the communication interface 103 are connected via a bus 100 and communicate with each other.

[0046] The communication interface 103 is used to implement communication between the modules, devices, units and / or equipment in the embodiment of the present invention. The communication interface 103 can also implement data communication with other components such as: external devices, image / data acquisition equipment, databases, external storage, and image / data processing workstations.

[0047] The bus 100 includes hardware, software or both, and couples the components of the computer device to each other. The bus 100 includes but is not limited to at least one of the following: a data bus, an address bus, a control bus, an expansion bus, and a local bus. By way of example and not limitation, bus 100 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses or a combination of two or more of these. Where appropriate, bus 100 may include one or more buses. Although embodiments of the present invention describe and illustrate a particular bus, the present invention contemplates any suitable bus or interconnect.

[0048] The computer can execute the forensics method based on virtual knowledge graph and big data of the present invention based on the acquisition of the forensics system based on virtual knowledge graph and big data, thereby realizing forensics based on virtual knowledge graph and big data.

[0049] In some further embodiments of the present invention, in combination with the above-mentioned forensics method based on virtual knowledge graph and big data, the embodiments of the present invention provide the following technical solutions: a storage medium having a computer program stored thereon, and the computer program implements the above-mentioned forensics method based on virtual knowledge graph and big data when executed by a processor.

[0050] Those skilled in the art will appreciate that the logic and / or steps represented in the flowchart or otherwise described herein, for example, may be considered as an ordered list of executable instructions for implementing logical functions, and may be specifically implemented in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For purposes of this specification, "computer-readable medium" may be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0051] More specific examples of readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0052] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or a combination thereof: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0053] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0054] The above-mentioned embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A forensics method based on virtual knowledge graph and big data, characterized in that: include: Construct a domain knowledge graph in the field of forensics, obtain the data source involved in forensics and establish a mapping set between the domain knowledge graph and the data source; constructing evidence extraction and analysis rules based on the mapping set; Obtaining a forensic request issued by a user, and dividing the forensic request based on the domain knowledge graph to obtain a plurality of sub-forensic requests; An answer set is determined based on the plurality of sub-forensic requests, and the answer set is converted into a format of a knowledge graph to obtain a forensic set.

2. The forensics method based on virtual knowledge graph and big data according to claim 1 is characterized in that: The steps of constructing the domain knowledge graph in the field of forensics are specifically as follows: Construct several prompt templates, continuously send the prompt templates to the large language model, extract the semantic relations in the forensic field, iteratively repeat the prompt template sending and semantic relation extraction process to obtain the domain knowledge graph.

3. The forensics method based on virtual knowledge graph and big data according to claim 2 is characterized in that: The semantic relations include the semantic relations between concepts in the field of forensics, the semantic relations between attributes in the field of forensics, and the semantic relations between concepts and attributes in the field of forensics.

4. The forensics method based on virtual knowledge graph and big data according to claim 1 is characterized in that: The mapping set for: ； ； In the formula, It is shaped like The set of mappings of Map the data in each data source to the domain knowledge graph. Indicates that for The query statement of a data source, Represents a class or attribute in a domain knowledge graph, Represents a transformation function, which describes how to transform data in the data source into entities or objects in the knowledge graph.

5. The forensics method based on virtual knowledge graph and big data according to claim 1 is characterized in that: The step of constructing evidence extraction and analysis rules based on the mapping set is specifically as follows: Based on the vocabulary in the domain knowledge graph, the review and judgment rules of evidence described in natural language in legal documents are formalized to obtain evidence extraction and analysis rules: ； In the formula, Represents the antecedents or reasoning premises of evidence extraction and analysis rules, Represents the consequent or reasoning conclusion of the evidence extraction and analysis rules.

6. The forensics method based on virtual knowledge graph and big data according to claim 1 is characterized in that: The step of obtaining a forensic request issued by a user and dividing the forensic request based on the domain knowledge graph to obtain a plurality of sub-forensic requests includes: Get the evidence collection request issued by the user , rewrite the evidence collection request and encode the knowledge of the domain knowledge graph to obtain a rewritten request ; The rewrite request is mapped according to the mapping between each data source and the domain knowledge graph in the mapping set. Split into several sub-forensic requests .

7. The forensics method based on virtual knowledge graph and big data according to claim 1 is characterized in that: The step of determining an answer set based on the plurality of sub-forensic requests and converting the answer set into a knowledge graph format to obtain a forensic set includes: Converting the sub-forensic request into a request supported by the corresponding data source through the mapping set to obtain a converted request; Responding to the conversion request on the corresponding data source according to the evidence extraction and analysis rules to obtain a sub-answer set; Merging a plurality of sub-answer sets according to the segmentation method of the evidence collection request to obtain an answer set; The answer tracing information of each of the sub-answer sets in each of the answer sets is obtained, and the answer tracing information and the answer set are converted into a format corresponding to the domain knowledge graph to obtain a forensics set.

8. A forensics system based on virtual knowledge graph and big data, characterized in that: The system comprises: A construction module is used to construct a domain knowledge graph in the field of forensics, obtain the data source involved in forensics and establish a mapping set between the domain knowledge graph and the data source; A rule module, used for constructing evidence extraction and analysis rules based on the mapping set; A segmentation module is used to obtain a forensic request issued by a user, and segment the forensic request based on the domain knowledge graph to obtain a plurality of sub-forensic requests; The forensics module is used to determine an answer set based on the plurality of forensics sub-requests, and convert the answer set into a format of a knowledge graph to obtain a forensics set.

9. A computer comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the forensics method based on virtual knowledge graph and big data is implemented as described in any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, implements the forensics method based on virtual knowledge graph and big data as described in any one of claims 1 to 7.

Images