Network violation trace evidence collection sample library construction method based on wavelet transformation algorithm

Abstract

The invention provides a network violation trace evidence obtaining sample library construction method based on a wavelet transformation algorithm, and belongs to the technical field of network violation evidence obtaining. The network violation trace evidence obtaining sample library construction method based on the wavelet transformation algorithm comprises the following steps: S1, summarizing and storing mastered display behavior data, internet data continuously mined by using a web crawler within a certain time interval and official data obtained by a third-party channel, and forming non-institution data and structured data marts after storage; s2, analyzing high-frequency daily behavior characteristics by using a traditional CNN neural network, and depicting basic characteristics and behavior modes of related parties; by using the scheme, a traditional investigation method leaps out from a backward mode by applying a deep learning mathematical model of a wavelet theory and Fourier transform, and dimensionality reduction strike is realized from the perspective of high-dimensional signal and information system processing.

Description

Technical Field

[0001] The present invention belongs to the technical field of network violation evidence collection, and in particular relates to a method for constructing a network violation trace evidence collection sample library based on a wavelet conversion algorithm. Background Art

[0002] The analysis of network violation trace evidence is to combine existing data with Internet synchronized data, track and dig deep into the relationship map between each other, etc., a mailbox, an account or an IP address left at the scene of network violation... This information is information data that everyone who uses the Internet must generate, and this data is unique and stable, but when it comes to illegal behavior, it has the characteristics of suddenness and instability as the time domain expands;

[0003] To extract valuable information from massive amounts of information and identify relevant parties and traces of violations, the traditional method is to use pattern matching and deep learning algorithms for similarity matching to improve the accuracy of data analysis. For example, it is necessary to define the violation pattern, roughly define the characteristics of the relevant party through pattern matching, and then use Fourier transform to find the approximate high-frequency behavior in daily behavior, so as to discover the possible behavior pattern of the relevant party.

[0004] In the existing technology, general normal life, work and study behaviors are universal and high-frequency. For example, ordering takeout online happens almost every day and many times. The Fourier transform can accurately capture this behavior, and through correlation analysis with other events, a rough description and behavior trend analysis can be obtained. Because the Fourier transform does not consider low-frequency events at a specific time or time period, that is to say, this analysis method can only obtain the daily behavior characteristics of a person. The violation of a violating party is not a high-frequency event in the entire time domain, but must be a low-frequency event at a specific time or time period, and it does not occur periodically and smoothly. Use the traditional deep learning algorithm based on the CNN neural network. Summary of the invention

[0005] The purpose of the present invention is to provide a method for constructing a network violation trace forensics sample library based on a wavelet transform algorithm, aiming to solve the problems of using traditional deep learning algorithms based on CNN neural networks in the prior art.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] A method for constructing a network violation trace forensics sample library based on a wavelet transform algorithm comprises the following steps:

[0008] S1. Aggregate and store the acquired display behavior data, Internet data continuously mined by web crawlers within a certain period of time, and official data obtained from third-party channels into a database, and form non-institutional data and structured data marts after storage;

[0009] S2. Use the traditional CNN neural network to analyze the high-frequency daily behavior characteristics and characterize the basic characteristics and behavior patterns of the relevant parties;

[0010] S3. Using wavelet algorithm, we extract mutation-specific data as a supplement to abnormal mutations of normal behavior, identify relevant parties, and further characterize the significant characteristics of relevant parties and changes in their behavior trajectories;

[0011] S4. Establish a violation pattern matching library to classify cases and conduct trend analysis on the relevant parties analyzed above;

[0012] S5. Perform manual data correction on the calculation results, and then further correct and improve the parameter value range of the mathematical model to improve the accuracy of the mathematical model.

[0013] As a preferred solution of the present invention, in step S1, the unstructured data and structured data marts include social networks, browsing operation websites, APPs and communications.

[0014] As a preferred solution of the present invention, in step S1, the official data obtained from the third-party channel includes telecommunication, banking, insurance and other data.

[0015] As a preferred solution of the present invention, in step S3, the comprehensive portrait of the relevant party is determined through behavioral traces, location traces, financial traces and communication traces.

[0016] As a preferred solution of the present invention, in step S4, the empirical model and pattern recognition related party design case correlation analysis, related party and other person relationship analysis and related party analysis.

[0017] As a preferred solution of the present invention, after step S5, the analysis data is displayed and an early warning is issued for future violation trends.

[0018] As a preferred solution of the present invention, unstructured and structured data are divided into a daily behavior database and an abnormal behavior event database.

[0019] As a preferred solution of the present invention, a deep learning algorithm model is used to analyze the daily behavior database.

[0020] As a preferred solution of the present invention, wavelet transform is used to analyze the abnormal behavior event library.

[0021] As a preferred solution of the present invention, a related party analysis is performed to manually correct the parameters.

[0022] Compared with the prior art, the present invention has the following beneficial effects:

[0023] 1. In the present invention, by using this scheme and applying the deep learning mathematical model of wavelet theory and Fourier transform, the traditional investigation method is leapt out of the backward model rut, and dimensionality reduction is achieved from the perspective of high-dimensional signal and information system processing.

[0024] 2. In the present invention, by applying the theories and methods of this article, the investigation rate and evidence collection efficiency have been significantly improved. Basically, from the perspective of probability theory, the efficiency can reach 90%. With the continuous deepening of the application of mathematical models in the actual investigation process, it is believed that no matter how science and technology develop in the future, no matter how high-tech is used to implement illegal methods, illegal behaviors will have nowhere to hide under the dimensionality reduction attack. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0026] Figure 1 It is a flowchart of the present invention. DETAILED DESCRIPTION

[0027] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] Example 1

[0029] See also Figure 1 , the present invention provides the following technical solutions:

[0030] A method for constructing a network violation trace forensics sample library based on a wavelet transform algorithm comprises the following steps:

[0031] S1. Aggregate and store the acquired display behavior data, Internet data continuously mined by web crawlers within a certain period of time, and official data obtained from third-party channels into a database, and form non-institutional data and structured data marts after storage;

[0032] S2. Use the traditional CNN neural network to analyze the high-frequency daily behavior characteristics and characterize the basic characteristics and behavior patterns of the relevant parties;

[0033] S3. Using wavelet algorithm, we extract mutation-specific data as a supplement to abnormal mutations of normal behavior, identify relevant parties, and further characterize the significant characteristics of relevant parties and changes in their behavior trajectories;

[0034] S4. Establish a violation pattern matching library to classify cases and conduct trend analysis on the relevant parties analyzed above;

[0035] S5. Perform manual data correction on the calculation results, and then further correct and improve the parameter value range of the mathematical model to improve the accuracy of the mathematical model.

[0036] In a specific embodiment of the present invention, in order to better portray all behavioral characteristics of the parties involved in the entire time domain, it is necessary to aggregate the unstructured data that has been mastered, the official data obtained from third-party channels, such as telecommunications, banks, insurance, etc., and the network data obtained through web crawler technology, and store them in a database. Note that continuous data within a certain period of time is required here, and it cannot be independent data of a single point or surface. After storage, unstructured data and structured data marts are formed. For example, pictures, audio and video, communication records, location trajectory information, social networking site data, browsing records, financial insurance APP operation information, etc.; using traditional CNN neural networks, high-frequency daily behavioral characteristics are analyzed to portray the basic characteristics and behavior patterns of the parties involved; using wavelet algorithms, mutation-specific data is extracted as an abnormal mutation supplement to normal behavior, thereby locking the parties involved. Further portray the significant characteristics of the parties involved, as well as changes in behavioral trajectories; such as the triangular intersection positioning of the place where the case occurred, special behaviors before, during, and after the action, etc., establish a violation pattern matching library, and classify and trend the parties analyzed above;

[0037] The illegal behavior of a violating party is not a high-frequency event in the entire time domain, but a low-frequency event at a specific time or time period, and it does not occur periodically and steadily. In this way, our traditional deep learning algorithm based on CNN neural network is not up to the task. Moreover, the deep learning model requires a huge amount of data to process, which results in huge system overhead and extended time. This is why this analysis mode has been successfully applied in signal processing, image processing, and financial, communication and marketing behavior analysis, but has not been successfully applied in the analysis of violating parties.

[0038] Therefore, we introduced wavelet theory to correct or make up for the shortcomings of deep learning based on the characteristics of illegal behaviors;

[0039] 3. Introduction to Wavelet Transform Theory (I) The Great Historical Contribution of Fourier Transform and Its Limitations

[0040] 1. Fourier transform

[0041] In 1807, Jean Baptistle Joseph Fourier (1786-1830), a French mathematician and physicist who accompanied Napoleon on his expedition to Egypt, proposed that any function f(t) with a period of T (= 2π) can be expressed by a trigonometric series:

[0042]

[0043] a k =C k +C -k b k =i(C k -C -k ) (3)

[0044] The theory of Fourier transform is a milestone in the history of human mathematical development. It started in 1807 and lasted until 1966 (in 1807, Fourier proposed that any periodic function can be expressed as a Fourier series, which was wrong. It was not until 1966 that it was proved that L 2 It took more than a century and a half for Fourier theory to mature. It has had a profound impact in various fields, has been widely used, and has promoted the development of human civilization. The reason is that Fourier theory not only has great theoretical value in mathematics, but more importantly, the spectrum information obtained by Fourier transform or Fourier integral has physical significance. Therefore, Fourier theory is immortal.

[0045] Unfortunately, this theory has certain limitations:

[0046] (1) The Fourier coefficients in the three forms of Fourier transform are all constants and do not change with time t. Therefore, they can only process stationary signals with unchanged spectral components. On the contrary, they will cause large errors when processing non-stationary signals, which may even be completely different from the actual situation.

[0047] We can use an example to illustrate the above errors.

[0048] For example, a person usually uses online banking to handle his financial activities, which is a stable event. Through analysis, it can be concluded that this person is highly dependent on the Internet and mobile phones. However, on a certain day or a few days, he no longer uses online banking, but appears in the bank many times to operate funds. This is a non-stationary signal in the concept of signal processing.

[0049] In actual signals, if the high frequency and low frequency are very different, in the same time interval, the high frequency signal has decayed while the low frequency signal has not decayed, so at different times, the spectrum components of the signal are different. If you insist on using Fourier transform to find the spectrum components at all times, and insist on compensating the amplitude changes with the frequency changes, not only the high frequency Fourier coefficients will have errors, but also the low frequency Fourier coefficients will have large errors, including the obtained frequency.

[0050] (2) The Fourier coefficient is the weighted average in the entire time domain, which can be clearly seen from the above formula. Local mutation information is averaged out, and the role of local mutation information is difficult to reflect. Very different signals, such as square waves, triangle waves, and sine waves, can all get the same frequency, so the sensitivity of processing and capturing mutation signals such as fault signals is very poor. Let's take the above-mentioned personal online banking as an example. When we use Fourier transform to analyze, the mutation behavior of those days will be averaged out, thereby hiding the illegal behavior in the high-frequency events and not being paid attention to. Therefore, the transformation that reflects local information should be used to process and capture mutation signals.

[0051] (3) In order to overcome the above two limitations, it is required that: (1) the transformation coefficients are regarded as time-varying, and the series summation is changed from one-fold to two-fold. (2) transformations that reflect local information are used, so the function group cannot use functions on the entire domain, but can only use functions with so-called compact support, namely "wavelet functions".

[0052] (II) Wavelet Analysis

[0053] The time history function f(t) is expressed as the following wavelet series:

[0054]

[0055] ψ j，k =ψ(2 j tk)

[0056] Among them, Ψ(t) is the wavelet function, d j , k is the wavelet coefficient, and

[0057]

[0058] From the formula, we can see that the wavelet series is a double summation, and the indicators of the wavelet coefficients include not only frequency indicators, but also time indicators. In other words, the wavelet coefficients not only change with frequency like the Fourier coefficients, but also for the same frequency indicator, the wavelet coefficients are different at different times. This overcomes the first deficiency mentioned above. Since the wavelet function has the property of compact support, that is, it is zero outside a certain interval. In this way, when calculating the wavelet coefficients at different times of each frequency level, only the local information near that time is used, thus overcoming the second deficiency mentioned above;

[0059] In the past, technical investigation and network investigation departments mostly used manual and some traditional experimental methods to obtain evidence of the actions of the parties involved in the violations. In recent years, with the application of information systems and big data mining algorithms, some manual experience has been applied to the information-based systematic analysis of case detection through pattern recognition, which has greatly improved the timeliness and accuracy of investigations.

[0060] However, with the booming development of the virtual world, traditional models are facing huge challenges. Whether it is academic or empirical, there is no way to break out of the pattern recognition rut. The limited pattern library cannot face the challenge of the endless high-tech illegal methods. The summary of the model will always lag behind the development of the means;

[0061] The deep learning mathematical model using wavelet theory and Fourier transform can help traditional investigation methods break away from the old paradigm and achieve dimensionality reduction from the perspective of high-dimensional signal and information system processing.

[0062] Through practice, the application of the theories and methods in this article has significantly improved the investigation rate and evidence collection efficiency. Basically, from the perspective of probability theory, the efficiency can reach 90%. With the continuous deepening of the application of mathematical models in the actual investigation process, I believe that no matter how technology develops in the future, no matter how high-tech is used to implement violations, violations will have nowhere to hide under the dimensionality reduction attack.

[0063] The working principle and use process of the present invention: When using this solution, firstly, the acquired display behavior data, the Internet data continuously mined by web crawlers within a certain time interval, and the official data obtained from third-party channels are summarized and stored in the database, and non-institutional data and structured data marts are formed after storage; the traditional CNN neural network is used to analyze the high-frequency daily behavior characteristics, and the basic characteristics and behavior patterns of the relevant parties are portrayed; the wavelet algorithm is used to extract mutation-specific data as an abnormal mutation supplement to a normal behavior, lock the relevant parties, and further portray the significant characteristics of the relevant parties, as well as the changes in the behavior trajectory; a violation pattern matching library is established, and the relevant parties analyzed above are subjected to case classification and trend analysis; the calculation results are manually corrected, and then the parameter value range of the mathematical model is further corrected and improved to improve the accuracy of the mathematical model; by using this solution, the deep learning mathematical model of wavelet theory and Fourier transform is applied to leap out of the backward model rut of the traditional investigation and handling method, and realize dimensionality reduction from the perspective of high-dimensional signal and information system processing.

[0064] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for constructing a network violation trace forensics sample library based on wavelet transform algorithm, characterized in that: The steps include: S1. Aggregate and store the acquired display behavior data, Internet data continuously mined by web crawlers within a certain period of time, and official data obtained from third-party channels into a database, and form non-institutional data and structured data marts after storage; S2. Use the traditional CNN neural network to analyze the high-frequency daily behavior characteristics and characterize the basic characteristics and behavior patterns of the relevant parties; S3. Using wavelet algorithm, we extract mutation-specific data as a supplement to abnormal mutations of normal behavior, lock in the relevant parties, and further characterize the significant characteristics of the relevant parties and changes in their behavior trajectories; S4. Establish a violation pattern matching library to classify cases and conduct trend analysis on the relevant parties analyzed above; S5. Perform manual data correction on the calculation results, and then further correct and improve the parameter value range of the mathematical model to improve the accuracy of the mathematical model.

2. According to the method for constructing a network violation trace forensics sample library based on wavelet transform algorithm in claim 1, it is characterized by: In step S1, the unstructured data and structured data marts include social networks, browsing operation websites, APPs and communications.

3. According to claim 2, a method for constructing a network violation trace forensics sample library based on a wavelet transform algorithm is characterized by: In step S1, the official data obtained from the third-party channel includes telecommunication, banking, insurance and other data.

4. According to claim 3, a method for constructing a network violation trace forensics sample library based on a wavelet transform algorithm is characterized by: In step S3, the comprehensive portrait of the relevant party is determined through behavioral traces, location traces, financial traces and communication traces.

5. According to claim 4, a method for constructing a network violation trace forensics sample library based on a wavelet transform algorithm is characterized by: In step S4, the empirical model and pattern recognition are used to analyze the correlation between the design cases of the stakeholders, the relationship between the stakeholders and others, and the stakeholders.

6. The method for constructing a network violation trace evidence sample library based on a wavelet transform algorithm according to claim 5 is characterized by: After step S5, the analysis data is displayed and an early warning is issued for future violation trends.

7. The method for constructing a network violation trace evidence sample library based on a wavelet transform algorithm according to claim 6 is characterized by: Unstructured and structured data are divided into daily behavior database and abnormal behavior event database.

8. The method for constructing a network violation trace evidence sample library based on a wavelet transform algorithm according to claim 7 is characterized by: Use deep learning algorithm models to analyze daily behavior databases.

9. The method for constructing a network violation trace evidence sample library based on wavelet transform algorithm according to claim 8 is characterized by: Analyze abnormal behavior event library using wavelet transform.

10. The method for constructing a network violation trace evidence sample library based on wavelet transform algorithm according to claim 9, characterized in that: Stakeholder analysis was performed to manually correct parameters.

Images