Electronic evidence correlation analysis method

Abstract

The invention provides an electronic evidence correlation analysis method which comprises the following steps: analyzing and standardizing heterogeneous data of electronic evidences, extracting timestamp information according to data source characteristics, and uniformly converting data of each time precision into millisecond-level timestamps; extracting space information, including a physical space and a virtual space, according to the timestamp, and performing format unification and coordinate system conversion on the extracted information to obtain a comprehensive data set containing a standardized time sequence and multi-scale space information; constructing a space-time association graph model based on the electronic evidence group, setting the weight of an edge in combination with the space-time association distance between nodes, mapping the high-dimensional space-time association feature to a low-dimensional vector space, and obtaining the space-time association feature vector of the electronic evidence; and performing similarity calculation on the space-time association feature vectors, calculating the space-time association degree between different electronic evidences, and screening out associated electronic evidences as electronic evidence pairs according to a similarity threshold to form an association relationship network.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a method for analyzing the correlation of electronic evidence. Background Art

[0002] The spatiotemporal correlation analysis of electronic evidence faces a complex technical challenge: how to accurately capture and quantify spatiotemporal correlation features in massive heterogeneous data. This problem is particularly prominent in the application of electronic evidence collection and smart courts, because legal procedures require extremely high standards for the accuracy and reliability of evidence. Specifically, in the time dimension, different types of electronic evidence often have different time granularity and periodicity, which makes it difficult to align and normalize when building a unified time series model. For example, network logs may be recorded in seconds, while the operation records of some applications may only be accurate to minutes. This inconsistency in time scale makes it easy to produce deviations when conducting correlation analysis, which may lead to disputes in court about the order of events. In the spatial dimension, the spatial attributes of electronic evidence are often multi-level and multi-scale. These include physical space and virtual space: physical space covers countries and provinces at the macro level, cities, districts and counties at the meso level, and detailed addresses and latitude and longitude coordinates at the micro level, while virtual space includes IP addresses and network topology information. The geographic location information in the physical space and the network topology in the virtual space are intertwined to form a complex spatial relationship network. In electronic evidence collection, this complex spatial relationship is crucial to determining the authenticity of criminal behavior, because it can help verify the source and credibility of electronic evidence, as well as identify potential forgery or tampering. For example, time and space are not logically connected. For example, the distance from Beijing to Guangzhou only took ten minutes. This obviously unreasonable time-space relationship may suggest that the data has been tampered with or there are other hidden factors, which require further investigation. How to define and calculate the distance function in this mixed space has become a thorny problem. This is a major challenge for the smart court system because it needs to be able to accurately display and explain the time-space relationship between complex electronic evidence to help judges and juries understand the relevance and reliability of evidence. Even more challenging is that the time and space dimensions are not independent of each other, but there are complex interactions. For example, network delays can cause the timestamp to deviate from the actual time of the event, and this deviation is closely related to the network topology. How to accurately capture and quantify this complex time-space correlation feature in massive heterogeneous electronic evidence and build a reliable time-space correlation model is a technical problem that needs to be solved in the field of electronic evidence collection and smart courts. Summary of the invention

[0003] The present invention provides a method for analyzing the relevance of electronic evidence, which mainly includes:

[0004] Parse and standardize the heterogeneous data of electronic evidence, extract timestamp information according to the characteristics of the data source, and convert data of different time precisions into millisecond timestamps;

[0005] Extract spatial information based on timestamps, including physical space and virtual space, unify the format of the extracted information and transform the coordinate system to obtain a comprehensive data set containing standardized time series and multi-scale spatial information;

[0006] Based on the comprehensive data set of time series and multi-scale spatial information, the geographical location information of the physical space and the network topology information of the virtual space are indexed, the two types of spatial information are associated to obtain a unified multi-dimensional spatial representation, and the Euclidean distance in the time dimension and the network distance in the space dimension are calculated;

[0007] Based on the Euclidean distance in the time dimension and the network distance in the space dimension, a comprehensive distance calculation model integrating time and space features is constructed, and the weights of the time dimension and space dimension are adjusted to form an adaptive distance metric for reflecting the time and space correlation of electronic evidence.

[0008] Perform cluster analysis on the standardized electronic evidence data to determine whether the distance of the temporal and spatial correlation between the data is less than a preset threshold. If so, the data points are classified into the same category to identify electronic evidence groups with temporal and spatial correlations.

[0009] Based on the electronic evidence group, a spatiotemporal correlation graph model is constructed. The edge weights are set based on the spatiotemporal correlation distances between nodes. The high-dimensional spatiotemporal correlation features are mapped to a low-dimensional vector space to obtain the spatiotemporal correlation feature vector of the electronic evidence.

[0010] Perform similarity calculation on the spatiotemporal correlation feature vectors, calculate the spatiotemporal correlation degree between different electronic evidences, and select the related electronic evidences as electronic evidence pairs according to the similarity threshold to form a correlation relationship network;

[0011] Based on the correlation network of electronic evidence, analyze its abnormal patterns of temporal and spatial correlation, compare it with known trusted reference data, identify existing isolated nodes, abnormal clusters and unnatural correlation paths, and compare the credibility score of each electronic evidence with the preset scoring threshold to determine the authenticity of the electronic evidence.

[0012] The technical solution provided by the embodiment of the present invention may have the following beneficial effects:

[0013] The present invention discloses a method for analyzing the spatiotemporal correlation of electronic evidence. The method first preprocesses and standardizes heterogeneous electronic evidence data, extracts timestamps and multi-level spatial information. Then, a multidimensional index integrating physical and virtual space is constructed to calculate the spatiotemporal distance. Based on the comprehensive distance metric of adaptive weights, density clustering analysis is performed to identify evidence groups with spatiotemporal correlation. By constructing a spatiotemporal correlation graph model and mapping it to a low-dimensional vector space, the spatiotemporal correlation feature vector of the evidence is obtained. Finally, the similarity between the evidence is calculated to form an association network, and the abnormal pattern is analyzed to evaluate the credibility of the evidence. The present invention realizes the accurate analysis of the spatiotemporal correlation of electronic evidence, effectively improves the credibility assessment capability of electronic evidence, and provides important technical support for judicial practice. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 The present invention is a flowchart of a method for analyzing the correlation of electronic evidence. DETAILED DESCRIPTION

[0015] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0016] like Figure 1 In this embodiment, a method for analyzing the correlation of electronic evidence may specifically include:

[0017] S101. Parse and standardize the heterogeneous data of electronic evidence, extract timestamp information according to the characteristics of the data source, and uniformly convert data of various time precisions into millisecond-level timestamps.

[0018] A classification request carrying an electronic evidence file format identifier is received, the classification request being issued by a heterogeneous data source; a corresponding parsing method is determined according to the classification request, the parsing method being used to extract key information from different types of electronic evidence; time information in the key information is formatted to identify the accuracy level of the time information; a preset standardized data model is established, the standardized data model including data source, timestamp, content type, and content summary fields; the millisecond timestamp is mapped to the timestamp field of the standardized data model; an integrity check is performed on the mapped standardized data set to obtain data items with missing time information; for the data items with missing time information, the time difference between adjacent valid timestamps is calculated; the time difference is evenly distributed to the missing time points to obtain an estimated timestamp; the rationality of the estimated timestamp is verified to determine whether it conforms to the time series characteristics of the data source; if it conforms to the time series characteristics, the estimated timestamp is filled into the corresponding missing data item.

[0019] Specifically, heterogeneous data is classified and identified according to the file format of electronic evidence, and corresponding parsing methods are used to extract key information for different types of electronic evidence. The MIME parsing library is used to process email data, and time information is extracted from the email header and body. Regular expressions are used to match the timestamp field of log files. The creation time and modification time are extracted from document-type electronic evidence through metadata parsing tools. Time information is extracted from the parsing results and data source characteristics are recorded, including device type and software version. The extracted time information is formatted to identify whether its time precision is milliseconds, seconds or minutes. Times of different precisions are uniformly converted to millisecond timestamps through time unit conversion. For milliseconds, the time remains unchanged, and the second time is multiplied by 1000 to convert to milliseconds, and the minute time is multiplied by 60000 to convert to milliseconds. If the time precision cannot be identified, it is processed by seconds by default. A standardized data model is established to define a common field structure, including data source (device type, software version), timestamp, content type, content summary, etc. The parsed and converted electronic evidence information is mapped to the corresponding fields of the standard model to form structured standard data. During the mapping process, data validation is performed simultaneously to check the validity and consistency of timestamps and remove outliers. Standardized data is stored in JSON format to ensure the uniformity and readability of the data structure. The standardized data set is checked for integrity to identify data items with missing time information. For missing time information, a linear interpolation algorithm is used to estimate the time stamps of adjacent data items. The time difference between adjacent valid timestamps is calculated and the time difference is evenly distributed to the missing time points. The rationality of the interpolated estimated timestamp is verified to ensure that it conforms to the time series characteristics of the data source. Finally, a preprocessed standardized electronic evidence data set is generated to achieve unified processing of heterogeneous data and normalization of timestamps. In the preprocessing of electronic evidence, heterogeneous data is first classified and identified. For email types, the MIME parsing library is used to extract time information, such as

[0020] "Date: Thu, 22Aug202410:30:15+0800". The log file is matched by the regular expression "(\d{4}-

[0021] The document type uses metadata parsing tools to extract the "CreationDate" and "ModDate" fields. The parsing results record the data source characteristics, such as "Device Type: iPhone15", "Software Version: iOS17.0". In the time information formatting process, the time precision is identified and uniformly converted to milliseconds. For example, the second time "1661134215" is multiplied by 1000 to get

[0022] "1661134215000" milliseconds. The minute time "202408221030" multiplied by 60000 is converted to

[0023] "1724328600000" milliseconds. For the time "1661134215123" which is already in milliseconds, it remains unchanged. If the precision cannot be identified, such as "20240822", it is processed as seconds by default and converted to

[0024] "1724284800000" milliseconds. The standardized data model uses JSON format, and the definition fields include: {"data source": {"device type": "iPhone15", "software version": "iOS17.0"}, "timestamp

[0025] ":1661134215000,"Content Type":"Mail","Content Summary":"Meeting Arrangement Notice"}. Data validation is performed during the mapping process to check the validity of the timestamp, such as excluding 1893427200000 milliseconds corresponding to the future time "2030-01-0100:00:00". For data items with missing time information, a linear interpolation algorithm is used for estimation. Assuming that two adjacent valid timestamps are 1661134215000 and 1661134275000, and three time points are missing in the middle, the time difference of 60,000 milliseconds is evenly distributed to obtain the interpolation results of 1661134230000, 1661134245000 and 1661134260000. The interpolation results are verified for rationality to ensure that they are within the valid time range and conform to the time series characteristics of the data source.

[0026] S102, extracting spatial information according to the timestamp, including physical space and virtual space, unifying the format of the extracted information and converting the coordinate system to obtain a comprehensive data set including standardized time series and multi-scale spatial information.

[0027] According to the timestamp, the physical space information of the corresponding time point is obtained from the geographic location database, and the physical space information includes the country and province information at the macro level, the city and county information at the meso level, and the detailed address and longitude and latitude coordinates at the micro level; the IP address resolution tool is used to extract the IP address from the network log corresponding to the timestamp. If the IP address is a dynamic IP address, the IP address change record within the time window is used for tracking; the physical space information and virtual space information are formatted in a unified structured data format, and the longitude and latitude in different coordinate systems are converted into a coordinate system; the time series in the structured data format, multi-scale physical space information and virtual space information are associated and integrated to obtain a comprehensive data set containing spatiotemporal relationships.

[0028] Specifically, the physical space information of the corresponding time point is queried from the geographic location database according to the timestamp, and the timestamp range query or the nearest time matching method is used to extract the country and province information at the macro level, the city and county information at the meso level, and the detailed address and longitude and latitude coordinates at the micro level. For the longitude and latitude coordinates, the original coordinate system type is recorded, including WGS84, GCJ-02, BD-09, etc. The IP address is extracted from the network log corresponding to the timestamp through the IP address resolution tool. For dynamic IP addresses, the IP address change records within the time window are used for tracking. The geographic information of the virtual space is obtained by using the IP address geographic location mapping database, and the network structure information of the corresponding time point is extracted from the network topology database, including node connection relationships and routing information. The extracted network topology structure is simplified, and the key nodes and connections are retained to form a network graph structure that is easy to analyze. The GeoPandas library is used to unify the format of the extracted physical space and virtual space information, and the address information from different sources and formats is converted into a unified structured data format. The PROJ.4 library is used for coordinate system conversion, and the longitude and latitude under different coordinate systems are uniformly converted to the WGS84 coordinate system. For network topology information, the node coordinates are also converted to the WGS84 coordinate system, and the connection relationship between nodes is stored using a graph data structure. The standardized time series, multi-scale physical space information and virtual space information are associated and integrated using the spatiotemporal connection algorithm to construct a comprehensive data set containing spatiotemporal relationships. The R-tree index structure is used to optimize the storage and retrieval efficiency of geospatial data, and the time index is used to accelerate the query of the time dimension. For network topology data, an adjacency matrix between nodes is established and stored using a graph database to achieve efficient network structure query and analysis. In the process of multi-level spatial information extraction, the physical space information of the corresponding time point is first queried from the geographic location database according to the timestamp "2024-08-2210:30:15". The nearest time matching method is used to extract the country "China" and the province "GuangX Province" at the macro level, the city "ShenX City" and the district "X Mountain Area" at the meso level, and the detailed address "No. 1 KeXyuan Road" and the longitude and latitude coordinates at the micro level.

[0029] "2X.5431°N, 1X3.9417°E" (WGS84 coordinate system). At the same time, the IP address "20X.0.113.1" is extracted from the network log through the IP address resolution tool. For dynamic IP, the IP address change record within a 5-minute time window is used for tracking. The virtual space geographic information "China X Telecom" is obtained by using the IP address geographic location mapping database, and the network structure at the corresponding time point is extracted from the network topology database, including the connection relationship between the upstream and downstream nodes "20X.0.113.0 / 24" and "20X.0.114.0 / 24". Next, the GeoPandas library is used to unify the format of the extracted information and convert the address information into GeoJSON format. The coordinate conversion is performed through the PROJ.4 library to convert the longitude and latitude in the GCJ-02 coordinate system.

[0030] "2X.5492°N, 11X.9448°E" is converted to the WGS84 coordinate system "2X.5431°N, 11X.9417°E". For network topology information, the NetworkX library is used to build a graph structure, with nodes representing IP addresses and edges representing connection relationships. Finally, the spatiotemporal connection algorithm is used to integrate the standardized data, and the R-tree index is used to optimize spatial queries, such as quickly locating all network nodes within a radius of 1 km. The time index is used to speed up queries, such as obtaining activity records for a specific IP address in the past 24 hours. The network topology data is stored in the Neo4j graph database, which supports efficient path queries and node centrality analysis, and ultimately obtains a comprehensive data set containing standardized time series, multi-scale spatial information, and network topology structure.

[0031] S103. Based on the comprehensive data set of time series and multi-scale spatial information, the geographic location information of the physical space and the network topology information of the virtual space are indexed, the two types of spatial information are associated to obtain a unified multi-dimensional spatial representation, and the Euclidean distance in the time dimension and the network distance in the space dimension are calculated.

[0032] Acquire multi-scale geographic location information of the physical space, wherein the multi-scale geographic location information includes longitude and latitude coordinates; construct a time-series graph data structure to index the network topology information of the virtual space, wherein the time-series graph data structure uses network nodes as graph vertices and connection relationships as graph edges; generate unique hash values ​​of the geographic location information and the network topology information, and establish a mapping relationship between the physical space and the virtual space; obtain a unified multi-dimensional space representation containing geographic coordinates, network node identifiers and timestamp information for the mapping relationship; and calculate the Euclidean distance in the time dimension and the network distance in the space dimension based on the unified multi-dimensional space representation.

[0033] Specifically, a multi-resolution spatial index structure is used to spatially index the multi-scale geographic location information of the physical space. The quadtree and R-tree indexing methods are combined to map the longitude and latitude coordinates to the corresponding tree nodes. For geographic location information that spans multiple quadtree nodes, R-tree is used for supplementary indexing to achieve fast spatial query and proximity search. At the same time, B+ tree index is used to index time series data to improve the query efficiency of the time dimension, especially the support for range query. A time-series graph data structure is constructed to index the network topology information of the virtual space. The network nodes are used as the vertices of the graph, the connection relationships are used as the edges of the graph, and the adjacency table is used to represent the network topology. The time dimension is introduced to record the changes of the network topology over time. The A* algorithm is used to achieve fast traversal and query of network paths and improve the efficiency of network distance calculation. The geographic location information of the physical space is associated with the network topology information of the virtual space through the consistent hashing algorithm, and a unique hash value is generated for each geographic location and network node. The virtual node technology is used to solve the spatial hash conflict problem, establish the mapping relationship between the physical space and the virtual space, and obtain a unified multidimensional space representation. This multidimensional space representation contains geographic coordinates, network node identifiers and timestamp information. Based on the unified multidimensional spatial representation, the comprehensive distance of the time dimension and the spatial dimension is calculated. For the time dimension, the multidimensional Euclidean distance is calculated, taking into account the timestamp difference and the geographic coordinate difference. The timestamp difference is obtained by subtracting the millisecond timestamps, and the geographic coordinate difference is calculated using the spherical distance formula. For the network distance of the spatial dimension, the Dijkstra shortest path algorithm is used, taking into account the physical distance and the number of network hops. Finally, the Euclidean distance of the time dimension and the network distance of the spatial dimension are weightedly combined to obtain the final spatiotemporal distance measurement. In the process of implementing multidimensional spatial indexing and association, the multi-scale geographic location information of the physical space is first processed. Taking Shenzhen City as an example, a quadtree is used to divide the urban area into 16 sub-areas, each with a side length of about 7 kilometers. For large landmarks that span multiple quadtree nodes, such as Shenzhen Bay Park, R-tree is used for supplementary indexing. The time series data uses B+ tree index to split the timestamps by hour, such as "2024-08-22 10:00:00" to "2024-08-22 10:59:59" stored in the same node, supporting fast time range queries. The network topology of the virtual space is represented by a time series graph data structure, recording the connection status of each IP address node at different time points. For example, IP address

[0034] "20X.0.113.1" is connected to "20X.0.113.2" and "20X.0.113.3" from 10:00 to 11:00, and only to "20X.0.113.2" from 11:00 to 12:00. Use the A algorithm to calculate network paths, such as the shortest path from "20X.0.113.1" to "20X.0.114.10". The consistent hashing algorithm maps physical locations and network nodes to a hash ring of 0 to 2^32-1, using 100 virtual nodes to resolve hash conflicts. For example, the geographic coordinates of Shenzhen Bay Park (2X.5431°N, 11X.9417°E) and the IP address

[0035] "20X.0.113.1" may be mapped to adjacent hash values. Finally, when calculating the comprehensive distance, the Euclidean distance in the time dimension considers that the time difference of 1 hour is weighted as 0.5, the geographical distance of 100 meters is weighted as 0.3, and the weight of each increase in the number of network hops is 0.2. If the time difference between two data points is 30 minutes, the geographical distance is 50 meters, and the network distance is 2 hops, then the comprehensive distance is 0.5*0.5+0.3*0.5+0.2*2=0.9, realizing the unified representation and distance measurement of physical space and virtual space.

[0036] Build a spatial index for the geographic location information of the physical space, organize the two-dimensional or three-dimensional coordinate data into a hierarchical tree structure, build a graph index for the network topology information of the virtual space, store the connection relationship between nodes, associate the leaf nodes in the spatial index with the corresponding nodes in the graph index, form a unified multi-dimensional space representation, use the Euclidean distance formula to calculate the distance in the time dimension, and calculate the network distance in the virtual space.

[0037] The R-tree algorithm is used to construct the geographical location information index of the physical space, and the two-dimensional coordinate data is organized into a hierarchical tree structure. According to the R-tree structure, the geographical coordinate points are stored in the leaf nodes by recursively dividing the spatial area, and the non-leaf nodes contain the minimum bounding rectangle of the child nodes. The adjacency list structure is used in combination with the timing diagram to represent the dynamically changing virtual space network topology, and the adjacency list structure stores the connection relationship between nodes and the timestamp information of the connection. The geographical coordinates in the R tree leaf node are associated with the network nodes in the adjacency table through the spatial hash function, and a unique hash value is generated as the index key. The comprehensive distance of the time dimension and the space dimension is calculated, wherein the time dimension distance is calculated using the Euclidean distance formula, and the space dimension distance is calculated using the Floyd-Warshall algorithm. The time dimension distance and the space dimension distance are weighted and combined to obtain the final spatiotemporal distance measurement result.

[0038] Specifically, the R-tree algorithm combined with parallel processing technology is used to construct the geographic location information index of the physical space, organize the two-dimensional coordinate data into a hierarchical tree structure, and store the geographic coordinate points in the leaf nodes by recursively dividing the spatial area. The non-leaf node contains the minimum bounding rectangle of the child node, which is determined by calculating the minimum and maximum coordinate values ​​of all points contained in each child node. For three-dimensional coordinate data, the octree is used instead of the R-tree to divide the space into eight subspaces. Parallel processing technology improves the construction and query efficiency of the R-tree and octree through data sharding and multi-threaded computing. The adjacency list structure is combined with the timing graph to represent the dynamically changing virtual space network topology and store the connection relationship between nodes. Each node contains a linked list that records the information of other nodes directly connected to it and the timestamp of the connection. The double hashing method is used to optimize the node search efficiency. The first hash function is used to locate the bucket, and the second hash function is used to resolve collisions. The timing graph structure records the changes in the network topology over time and supports querying the network status at different time points. The geographic coordinates in the leaf nodes of the R-tree or octree are associated with the network nodes in the adjacency table through the spatial hash function, and a unique hash value is generated as the index key. The open addressing method is used to solve the spatial hash collision problem. When a collision occurs, the next available location is found through a predefined detection sequence. The information of physical space and virtual space is integrated into the hash table to form a unified multidimensional space representation, which includes geographic coordinates, network node identifiers and timestamps. Based on the multidimensional space representation, the comprehensive distance of the time dimension and the space dimension is calculated. The timestamp is converted into seconds since the epoch as the input value of the Euclidean distance calculation. The Euclidean distance formula is used to calculate the distance in the time dimension, while considering the difference in geographic coordinates. For the network distance in the virtual space, the Floyd-Warshall algorithm is used to calculate the shortest path between any two points, comprehensively considering the connection relationship between nodes and timestamp information. Finally, the time distance and network distance are combined in a weighted manner to obtain the final space-time distance measurement. In the process of constructing multidimensional space index and association, the geographic location data of Shenzhen City X is first processed. The two-dimensional coordinate data is organized into a hierarchical structure using the R-tree algorithm, such as dividing Shenzhen City X into 16 sub-regions, each with a side length of about 7 kilometers. For three-dimensional data, such as mountainous areas containing altitude information, an octree is used to divide the space into 512 cubic units, each with a side length of about 1 km. Parallel processing technology uses 8 threads to simultaneously build indexes for different areas, reducing the index building time from the original 10 minutes to 1.5 minutes. The virtual space network topology is represented by an adjacency list structure. For example, the adjacency list of the IP address "20X.0.113.1" contains two connected nodes "20X.0.113.2" and "20X.0.113.3". The timing diagram records network changes, showing that the connection between "20X.0.113.1" and "20X.0.113.2" was established at 10:00 and disconnected at 11:30.The double hashing method reduces the search time complexity from O(n) to O(1), the first hash function h1(key) = key%1000, the second hash function h2(key) = 1+(key%999). The spatial hash function maps the geographic coordinates (114.05, 22.54) and the IP address "203.0.113.1" to the hash value 7654321. Using the open addressing method, when a collision occurs, the detection sequence is 12, 22, 32... The multidimensional space representation stores the geographic coordinates, IP address and timestamp "2024-08-2210:30:15" in the same record. When calculating the distance, the timestamp is converted to the number of seconds since January 1, 1970, such as 1661134215. The Euclidean distance calculation takes into account the time difference (seconds) and the geographic coordinate difference. For example, if the time difference between two points is 3600 seconds and the geographic distance is 100 meters, the Euclidean distance is 3601.4. The Floyd-Warshall algorithm calculates the shortest path between any two points in the network. For example, the shortest path from "203.0.113.1" to "203.0.114.10" passes through 3 nodes, with a total weight of 5. Finally, the time distance and network distance are weighted in a ratio of 6:4 to obtain a comprehensive time-space distance metric.

[0039] S104. Based on the Euclidean distance in the time dimension and the network distance in the space dimension, a comprehensive distance calculation model integrating the time and space characteristics is constructed, and the weights of the time dimension and the space dimension are adjusted to form an adaptive distance measurement for reflecting the time and space correlation of electronic evidence.

[0040] The Euclidean distance of the time dimension and the network distance of the space dimension are obtained, and the Euclidean distance and the network distance are converted into a standard normal distribution according to the z-score standardization method; the standardized distance value is mapped to the range of 0 to 1 by the maximum and minimum value normalization method, and a unified distance measurement scale is obtained. The time density and spatial distribution characteristics of electronic evidence are calculated by the sliding window using the unified distance measurement scale; the weight coefficients of the time dimension and the space dimension are determined according to the change rate of the time density and the contraction and expansion trend of the spatial distribution. A multi-layer perceptron neural network is established, and after the input layer receives the standardized time distance and space distance, the time distance and the space distance are multiplied by the corresponding weight coefficients and then input into the neural network. The mean absolute error is obtained as the fitness function, and the mean absolute error is calculated by the predicted comprehensive distance and the manually marked reference distance; if the mean absolute error meets the preset conditions, it is judged that the optimization of the neural network model parameters is completed. According to the optimized neural network model parameters, an adaptive distance measurement model reflecting the temporal and spatial correlation of electronic evidence is obtained; the adaptive distance measurement model is used to calculate the comprehensive distance between electronic evidence.

[0041] Specifically, a spatiotemporal feature vector is constructed, and the Euclidean distance in the time dimension and the network distance in the space dimension are standardized. The z-score standardization method is used to solve the dimensional difference problem of the two distances, and the mean and standard deviation of each distance are calculated. The distance value is converted into a standard normal distribution through the (x-μ) / σ formula. Subsequently, the maximum and minimum normalization method is used to map the standardized distance value to the range of 0 to 1 to form a unified distance measurement scale. An adaptive weight adjustment mechanism is designed to dynamically calculate the weight coefficients of the time dimension and the space dimension based on the time density and spatial distribution characteristics of electronic evidence. The time density is defined as the number of events per unit time, and the spatial distribution characteristics are quantified by calculating the standard deviation ellipse of the event's geographical location. A 24-hour sliding window is used, updated every hour, to analyze the local spatiotemporal characteristics. The weight ratio is adjusted according to the rate of change of the time density and the contraction and expansion trend of the spatial distribution. The weight adjustment result directly affects the importance of the input features of the next neural network. A comprehensive distance calculation model integrating spatiotemporal features is constructed using a multi-layer perceptron neural network. The network structure includes 1 input layer with 2 nodes, corresponding to the standardized time distance and space distance respectively, 2 hidden layers with 10 nodes in each layer, using ReLU activation function, and 1 output layer with 1 node, representing the integrated distance value after fusion. The standardized time distance and space distance are used as input features, multiplied by the corresponding adaptive weights and then input into the neural network. Through the nonlinear transformation of the hidden layer, the complex relationship between spatiotemporal features is learned, considering the temporal sequence and geographical location correlation of electronic evidence. The genetic algorithm is used to optimize the parameters of the neural network model, and the fitness function is designed to evaluate the accuracy of the comprehensive distance calculation. The mean absolute error (MAE) is used as the fitness function, MAE = (1 / n) * Σ|ypred-ytrue|, where n is the number of samples, ypred is the predicted comprehensive distance, and ytrue is the manually annotated reference distance. New parameter combinations are generated through crossover and mutation operations, and the model performance is iteratively optimized. The crossover rate is set to 0.8, the mutation rate is 0.1, the population size is 100, and the iteration is 500 generations. Finally, an adaptive distance measurement model reflecting the spatiotemporal correlation of electronic evidence is obtained. In the process of constructing a comprehensive distance calculation model that integrates spatiotemporal features, the temporal Euclidean distance and spatial network distance of electronic evidence are first standardized. Assuming that the original temporal distance is 3600 seconds and the spatial distance is 5 hops, the standard scores of 0.8 and 1.2 are obtained after z-score standardization. Subsequently, the two values ​​are mapped to the range of 0 to 1 through maximum and minimum value normalization, resulting in a temporal distance of 0.6 and a spatial distance of 0.8. Next, an adaptive weight adjustment mechanism is designed to analyze the spatiotemporal features within a 24-hour sliding window. For example, within a certain period of time, the time density is 10 events / hour, and the standard deviation ellipse area of ​​the spatial distribution feature is 50 square kilometers.According to these characteristics, the weights are adjusted dynamically to obtain a time dimension weight of 0.4 and a space dimension weight of 0.6. The standardized distance value is multiplied by the corresponding weight as the input feature of the neural network. The multilayer perceptron neural network contains 1 input layer (2 nodes), 2 hidden layers (10 nodes in each layer), and 1 output layer (1 node). The network training uses the back propagation algorithm, the learning rate is set to 0.01, the batch size is 32, and the training is 1000 rounds. Finally, the genetic algorithm is used to optimize the model parameters, the population size is set to 100, the crossover rate is 0.8, and the mutation rate is 0.1. The fitness function uses the mean absolute error (MAE), such as the MAE of a certain iteration is 0.15. After 500 generations of iterative optimization, the optimal combination of neural network parameters is obtained, and the final MAE is reduced to 0.08, realizing an adaptive distance measurement model that accurately reflects the spatiotemporal correlation of electronic evidence.

[0042] Set the initial time dimension weight and space dimension weight, construct a comprehensive distance function, combine the temporal Euclidean distance and the spatial network distance, group the data using the current weight configuration, and evaluate the grouping effect. Based on the evaluation results and combined with the interaction effect between the dimensions, adjust the weights of the two dimensions and recalculate the comprehensive distance using the adjusted weights.

[0043] Obtain the standard deviation of the time dimension data and the space dimension data, and determine the time dimension weight and the space dimension weight according to the inverse ratio of the standard deviation. The time dimension weight and the space dimension weight are used to construct a comprehensive distance function, and the comprehensive distance function includes the time Euclidean distance, the space network distance and the cross term. Use the K-means clustering algorithm to group the data, and if the K value is from 2 to the square root of the number of data points, calculate the silhouette coefficient corresponding to each K value. The silhouette coefficient is obtained by calculating the average distance between the sample and other samples in the same cluster and the average distance between the sample and the sample in the nearest cluster. Determine the optimal K value according to the silhouette coefficient. Construct a weight adjustment function, and the weight adjustment function includes a clustering quality score, an inter-dimensional correlation coefficient and a current weight value. The inter-dimensional correlation coefficient is obtained by calculating the Pearson correlation coefficient of the time dimension data and the space dimension data. Use the gradient descent method to optimize the time dimension weight and the space dimension weight. If the initial value of the learning rate is a preset value, the learning rate is reduced by a preset percentage each iteration. The gradient in the gradient descent method is combined with the partial derivative of the clustering quality score to the weight and the inter-dimensional correlation calculation. The comprehensive distance is recalculated according to the optimized time dimension weight and space dimension weight, and the comprehensive distance matrix is ​​updated. The comprehensive distance matrix is ​​used for the next round of data grouping and evaluation. If the weight change of two consecutive iterations is less than the preset threshold or the maximum number of iterations is reached, the iteration process is terminated.

[0044] Specifically, the weights of the time dimension and space dimension are initialized according to the data distribution characteristics, the standard deviation of the time and space data is calculated, the weight is set to the inverse of the standard deviation, and the comprehensive distance function is constructed. This function combines the temporal Euclidean distance and the spatial network distance by weighted summation, and introduces cross terms to reflect the interaction effect between dimensions. The initial comprehensive distance matrix is ​​generated for subsequent data grouping and evaluation. The K-means clustering algorithm is used to group the data, and the silhouette coefficient is used to automatically select the optimal K value. K is traversed from 2 to sqrt(n) (n is the number of data points), and the silhouette coefficient corresponding to each K value is calculated. The silhouette coefficient is obtained by calculating the average distance a(i) between the sample and other samples in the same cluster and the average distance b(i) between the sample and the sample in the nearest cluster, s(i) = (b(i)-a(i)) / max(a(i), b(i)). The K value with the largest silhouette coefficient is selected as the optimal number of clusters. The comprehensive distance calculated according to the current weight configuration is used as the clustering basis to obtain the clustering quality score under the current weight configuration. Based on the group evaluation results, combined with the interaction effects of time and space dimensions, a weight adjustment function is constructed. This function takes into account the clustering quality score, the correlation coefficient between dimensions, and the current weight value. The Pearson correlation coefficient is used to calculate the correlation between dimensions, r = cov(X, Y) / (σX * σY), where X and Y represent the time and space dimension data, respectively. The gradient descent method is used to optimize the weight configuration, and the learning rate is initially set to 0.01 and reduced by 1% each iteration. The gradient calculation takes into account the partial derivative of the clustering quality score to the weight and the correlation between dimensions. The weight update formula is Where J is the loss function, which includes the clustering quality score and dimension correlation. The integrated distance is recalculated using the adjusted weights and the integrated distance matrix is ​​updated. The new weight configuration and distance matrix are input into the data grouping step to form an iterative optimization loop. The convergence condition is defined as the weight change between two consecutive iterations is less than 0.001 or the maximum number of iterations is 100. After each iteration, the integrated distance is recalculated, including the influence of cross terms. The cross term coefficient is dynamically adjusted according to the correlation between dimensions.

[0045] The stronger the correlation, the greater the impact of the cross-term. During the iteration process, the changes in weights and distance matrices directly affect the clustering results and evaluation of the next round. In the process of implementing the comprehensive distance calculation that integrates spatiotemporal features, the weights are first initialized according to the data distribution characteristics. Assuming that the standard deviation of the time dimension data is 5 hours and the standard deviation of the space dimension data is 10 kilometers, the initial weights are set to 0.67 for the time dimension and 0.33 for the space dimension. When constructing the comprehensive distance function, cross-terms are introduced, and the initial cross-term coefficients are set to 0.1. Next, the K-means algorithm is used to group the data, and the K value is traversed from 2 to 20. Taking K=5 as an example, the silhouette coefficient is calculated to be 0.68, which is selected as the optimal number of clusters. Based on the comprehensive distance of the current weight configuration, the clustering quality score is 0.75. Subsequently, the Pearson correlation coefficient of the time and space dimensions is calculated to be 0.6, indicating a moderate positive correlation. The weight adjustment function uses the gradient descent method, and the initial learning rate is 0.01. After the first iteration, the time dimension weight was adjusted to 0.65, the space dimension weight was 0.35, and the cross-term coefficient was increased to 0.15. The comprehensive distance was recalculated using the new weights and the distance matrix was updated. After 50 iterations, the weight change was less than 0.001, and the convergence condition was met. Finally, the optimized time dimension weight was 0.58, the space dimension weight was 0.42, and the cross-term coefficient was 0.22. Using this set of final weight configurations, the comprehensive distance between sample points A and B in the calculated comprehensive distance matrix was 7.5 units, which was significantly reduced compared to the initial distance of 9.2 units, reflecting that the optimized weight configuration better captures the spatiotemporal characteristics and correlation of the data.

[0046] S105. Perform cluster analysis on the standardized electronic evidence data to determine whether the distance of the temporal and spatial correlation between the data is less than a preset threshold. If so, the data points are classified into the same category to identify electronic evidence groups with temporal and spatial correlation.

[0047] Obtain standardized electronic evidence data, and calculate the local density of each data point based on the data. Use the K nearest neighbor algorithm to determine the neighborhood range, and select the optimal K value by calculating the silhouette coefficient. If the silhouette coefficient reaches the maximum value, determine the corresponding K value as the optimal neighborhood range. Construct a spatiotemporal distance calculation function D=wt*Dt+ws*Ds based on the local density, where Dt and Ds are the time and space distances, respectively, and wt and ws are the corresponding weights. The function weights the distances of the time dimension and the space dimension. Calculate the weights of the time and space dimensions to obtain the spatiotemporal distance matrix between any two data points. Based on the spatiotemporal distance matrix, use the DBSCAN algorithm for density clustering. Determine the density threshold, where the horizontal axis is the data point and the vertical axis is the distance from each point to the Kth nearest neighbor. Select the inflection point of the K distance graph curve as the density threshold to obtain a preliminary clustering result. Optimize the preliminary clustering result and calculate the average spatiotemporal distance within and between classes. If the intra-class distance is less than half of the inter-class distance, lower the clustering threshold; otherwise, increase the threshold. By iteratively updating the clustering results until the change in clustering results for two consecutive iterations is less than a preset threshold, electronic evidence groups with spatiotemporal correlation are obtained, wherein the spatiotemporal distance of data points in each group is less than the optimized threshold.

[0048] Specifically, the standardized electronic evidence data is preprocessed to calculate the local density of each data point. The neighborhood range is determined by the adaptive K nearest neighbor algorithm, and the optimal K value is selected using the silhouette coefficient. The silhouette coefficient is calculated for each K value from 1 to log(n), where n is the number of data points, and the K value with the largest silhouette coefficient is selected. The number of data points in the neighborhood is counted to obtain a density matrix that reflects the data density distribution. The density matrix is ​​used as input for subsequent distance calculation and cluster analysis. Based on the adaptive distance metric, a spatiotemporal distance calculation function is constructed. This function weights and fuses the distances of the time dimension and the space dimension in the form of D=wt*Dt+ws*Ds, where Dt and Ds are the time and space distances, respectively, and wt and ws are the corresponding weights. The weight is dynamically adjusted according to the data distribution characteristics, and the variance contribution rate method is used to calculate the variance of the time and space dimensions, and the weight is proportional to the variance. Combined with the aforementioned density matrix, the spatiotemporal distance between any two data points is calculated to generate a distance matrix. The initial clustering threshold is set, and the preset threshold is used as a reference value. The DBSCAN algorithm is used for density clustering, and the K distance graph is used to determine the density threshold. A K-distance graph is drawn, with the horizontal axis as the data point and the vertical axis as the distance from each point to the Kth nearest neighbor. The inflection point of the curve is selected as the density threshold. All data points are traversed, and points with density greater than the average density are defined as high-density points. If the number of high-density points in the neighborhood of a point exceeds the threshold, the point is marked as a core point, and the points in its neighborhood are classified into the same class to form a preliminary clustering result. The preliminary clustering results are optimized, and the clustering threshold is dynamically adjusted by calculating the average spatiotemporal distance within and between classes. The intra-class and inter-class distance ratio method is used to calculate the internal average distance of each class and the average distance between classes. If the intra-class distance is less than half of the inter-class distance, the clustering threshold is lowered; otherwise, the threshold is increased. The clustering results are updated iteratively, and the intra-class and inter-class distance ratio is recalculated after each iteration to adjust the threshold. The iteration is stopped when the clustering results of two consecutive iterations change less than 1% or the maximum number of iterations reaches 100. Finally, electronic evidence groups with spatiotemporal correlation are obtained, and the spatiotemporal distance of data points in each group is less than the optimized threshold. When performing density clustering analysis on electronic evidence data, 10,000 standardized data are first preprocessed. The adaptive K nearest neighbor algorithm is used to determine the neighborhood range. By calculating the silhouette coefficient of K values ​​from 1 to 7 (log10000≈7), the optimal K value is 5. Based on this K value, the local density of each data point is calculated to generate a 1000×1000 density matrix. Then, a spatiotemporal distance calculation function is constructed, with a time dimension variance of 25 hours2 and a spatial dimension variance of 100 kilometers2. The weights wt=0.2 and ws=0.8 are set accordingly. Combined with the density matrix, a 1000×1000 distance matrix is ​​calculated. Subsequently, DBSCAN density clustering is performed, and the density threshold is determined using the K-distance map. In the K distance map, it is observed that there is an obvious inflection point at the distance value of 0.15, which is set as the density threshold.After traversing the data points, 2000 high-density points were identified, with a density greater than the average density of 8. The initial clustering threshold was set to 0.2, and the first round of clustering was performed to obtain 50 initial categories. The clustering results were optimized, and the average intra-class distance was calculated to be 0.18, and the average inter-class distance was 0.45. According to the intra-class and inter-class distance ratio, the clustering threshold was adjusted to 0.22. After 27 iterations, the rate of change of clustering results dropped to 0.9%, which was lower than the threshold of 1%, and the iteration was stopped. Finally, 38 electronic evidence groups with spatiotemporal correlation were obtained, and the spatiotemporal distance of data points in each group was less than 0.22.

[0049] S106. Construct a spatiotemporal association graph model based on the electronic evidence group, set edge weights based on the spatiotemporal association distances between nodes, map high-dimensional spatiotemporal association features to low-dimensional vector space, and obtain the spatiotemporal association feature vector of the electronic evidence.

[0050] Generate a request based on the node to calculate the spatiotemporal distance between groups, the spatiotemporal distance is obtained by the weighted sum of the time difference and the spatial distance; set the weight of the edge to be the inverse of the spatiotemporal distance to generate a weighted undirected graph structure; calculate the importance score of each node in the weighted undirected graph structure, the importance score is used as the initial feature of the node; obtain a high-dimensional feature vector of the node, the high-dimensional feature vector includes node degree, clustering coefficient, and betweenness centrality topological features; use the t-SNE algorithm to map the high-dimensional feature vector to a low-dimensional space to obtain a low-dimensional embedding vector corresponding to each node; after the low-dimensional embedding vector has been obtained, construct the spatiotemporal correlation feature vector of the electronic evidence based on the low-dimensional embedding vector combined with the original spatiotemporal attribute information.

[0051] Specifically, a spatiotemporal association graph model is constructed based on the electronic evidence groups obtained by clustering. Each group is regarded as a node in the graph, and the center point of the group is used, which is the average value of the time and space coordinates to represent the entire group. The spatiotemporal distance between groups is calculated, combining the weighted sum of the time difference and the spatial distance, and the weight is set according to the data distribution characteristics. The weight of the edge is set to the inverse of the spatiotemporal distance to generate a weighted undirected graph structure. For the nodes inside the group, the average distance from the center point is calculated as an additional attribute of the node. The degree centrality algorithm is used to calculate the importance score of each node in the graph, and the score is used as the initial feature of the node. A high-dimensional feature vector of the node is constructed, which includes topological features such as node degree, clustering coefficient, and betweenness centrality. The node degree directly counts the number of edges connected to it. The clustering coefficient calculation formula is Ci=2ei / (ki(ki-1)), where ei is the number of edges between the neighbors of node i, and ki is the degree of node i. The betweenness centrality is obtained by calculating the proportion of all shortest paths passing through the node. At the same time, spatiotemporal attributes such as time span (latest time minus earliest time) and spatial range (maximum longitude and latitude difference) are added. The high-dimensional feature vector of the node is mapped to the low-dimensional space using the t-SNE algorithm. The perplexity parameter is set to 30 and the learning rate is set to 200. The similarity relationship between high-dimensional data points is retained in the low-dimensional space through an iterative optimization process, and the number of iterations is set to 1000. In each iteration, the samples are weighted using the node importance score calculated in the previous step to ensure that important nodes are better represented in the low-dimensional space. The two-dimensional or three-dimensional embedding vector corresponding to each node is obtained. Based on the low-dimensional embedding vector, combined with the original spatiotemporal attribute information, the spatiotemporal correlation feature vector of the electronic evidence is constructed. The feature splicing method is used to connect the low-dimensional embedding coordinates, key spatiotemporal attribute values, such as time span, spatial range, and graph structure features, such as node degree and clustering coefficient, into a vector. The spliced ​​vector is normalized to ensure that the values ​​of each dimension are in the same order of magnitude. Finally, principal component analysis (PCA) was performed on the feature vector, and the principal component with an explained variance ratio of 95% was selected to form the final feature representation. In the process of constructing the spatiotemporal association graph model of electronic evidence, the 38 clustered groups were first processed. The center point of each group was calculated. For example, the center time of group A was 2024-03-1514:30:00, and the spatial coordinates were (3X.9042°N, 11X.4074°E). The spatiotemporal distance between groups was the weighted sum of the time difference and the spatial distance, with the weight set to 0.4 for time and 0.6 for space. For example, the spatiotemporal distance between groups A and B was calculated to be 72.5 hours. The weight of the edge was set to the inverse of the spatiotemporal distance, and the weight of the A-B edge was 1 / 72.5=0.0138. The generated weighted undirected graph contains 38 nodes and 561 edges. Then the degree centrality of the node was calculated, such as the degree centrality of node A was 0.789. Construct a high-dimensional feature vector, including node degree A of 23, clustering coefficient A of 0.567, betweenness centrality A of 0.345, etc.In terms of spatiotemporal attributes, the time span of A is 120 hours and the spatial range is 50 kilometers. The t-SNE algorithm was then used for dimensionality reduction, with the perplexity set to 30, the learning rate set to 200, and the iterations set to 1000 times. In each iteration, the importance score of node A, 0.789, was used for sample weighting. Finally, a two-dimensional embedding vector was obtained, and the coordinates of A were (-0.532, 0.678). After feature concatenation, the initial length of the spatiotemporal correlation feature vector of A was 15, containing 2-dimensional embedding coordinates, 5 spatiotemporal attribute values, and 8 graph structure features. After normalization, PCA analysis was performed, and the first 7 principal components (explaining variance ratio 95.3%) were selected to form the final feature vector. The high-dimensional spatiotemporal correlation features are effectively mapped to low-dimensional space, providing a compact and information-rich representation for subsequent analysis.

[0052] S107, performing similarity calculation on the spatiotemporal correlation feature vectors, calculating the spatiotemporal correlation degree between different electronic evidences, and selecting the associated electronic evidences as electronic evidence pairs according to the similarity threshold, to form an association relationship network.

[0053] Obtain a spatiotemporal correlation feature vector, and calculate the variance contribution rate of each feature as a weight based on the feature vector. Use the minimum and maximum standardization method to normalize the feature vector to obtain a normalized feature vector. Calculate the Euclidean distance and cosine similarity based on the normalized feature vector, and construct a comprehensive similarity index through the Euclidean distance and cosine similarity. Determine whether the comprehensive similarity index meets the preset conditions. If so, calculate the spatiotemporal correlation degree. Cluster the spatiotemporal correlation degree and divide it into three categories: high, medium, and low. Calculate the mean and standard deviation of the high similarity category, and the similarity threshold is set to the mean minus the standard deviation. If the clustering result does not meet the preset conditions, perform density clustering and select the minimum value of the high-density cluster as the similarity threshold. According to the similarity threshold, filter out the electronic evidence pairs that meet the conditions and construct an association relationship network. In the association relationship network, each electronic evidence is used as a network node, and connections are established between evidence pairs with similarities greater than the threshold. Use the Kruskal minimum spanning tree algorithm to construct the skeleton of the association relationship network. For an isolated node in the association relationship network, a connected node with the highest similarity is obtained, and an additional connection is established to obtain an association relationship network.

[0054] Specifically, the spatiotemporal correlation feature vectors are normalized, and the weighted min-max normalization method is used. First, the variance contribution rate of each feature is calculated as the weight. For outliers, the percentile method is used to process them, and the values ​​exceeding the 99% percentile are set as the 99% percentile value. Then, the values ​​of each feature dimension are weighted and mapped to the range of 0-1 to ensure the accuracy of subsequent similarity calculations. A comprehensive similarity index is constructed by combining Euclidean distance and cosine similarity. When calculating the degree of spatiotemporal correlation, the weights of the time and space dimensions are considered, and the weight values ​​are dynamically adjusted according to the data distribution characteristics. Parallel computing is used to optimize the calculation efficiency of the similarity matrix, divide the data set into multiple subsets, and calculate the similarity between subsets at the same time. Pairwise similarity calculations are performed on all pairs of electronic evidence to generate a similarity matrix, in which each element represents the degree of spatiotemporal correlation between the corresponding two electronic evidences. The similarity threshold is determined by the adaptive threshold selection method based on clustering. First, the similarity values ​​are clustered by K-means, and the similarity is divided into three categories: high, medium, and low. Calculate the mean and standard deviation of high-similarity categories, and set the threshold to the mean minus the standard deviation. If the clustering result is not ideal, use the DBSCAN algorithm for density clustering, and select the minimum value of the high-density cluster as the threshold. Use the determined threshold to filter out the electronic evidence pairs that meet the conditions to form a set of candidate association pairs. Construct an association relationship network based on the screened electronic evidence pairs. Use the Kruskal minimum spanning tree algorithm to build the network skeleton to ensure the connectivity of the network. Take each electronic evidence as a node in the network, and establish connections between evidence pairs with similarities greater than the threshold, and set the weight of the connection to the similarity value. For isolated nodes in the network, find the connected nodes with the highest similarity to it and establish additional connections. Finally, use the force-directed layout algorithm to optimize the visualization of the network and form an association relationship network with a weighted undirected graph structure. The network reflects the spatiotemporal association strength and topological structure between electronic evidence. In the process of implementing the spatiotemporal association analysis of electronic evidence, the spatiotemporal association feature vectors of 10,000 electronic evidence are first normalized. The feature variance contribution rate is calculated, such as the time feature weight of 0.4 and the spatial feature weight of 0.6. The outliers were processed, and the values ​​above the 99% quantile, such as the time span exceeding 720 hours, were set to the 99% quantile value. The weighted min-max normalization was used to map the eigenvalues ​​to the range of 0-1. Then a comprehensive similarity index was constructed, combining the Euclidean distance and cosine similarity, with the temporal and spatial weights set to 0.45 and 0.55, respectively. Using 32 core parallel computing, the data was divided into 100 subsets, and 49,995,000 pairs of similarity values ​​were calculated, which took about 10 minutes. In the generated similarity matrix, the maximum value was 0.98, the minimum value was 0.02, and the average value was 0.35. K-means clustering was then used, where K = 3 pairs of similarity value classifications were obtained, and the mean of the high similarity category was 0.75, the standard deviation was 0.08, and the threshold was set to 0.67.The threshold was used to screen out 50,000 candidate association pairs. Finally, the association relationship network was constructed, and the Kruskal algorithm was used to generate a minimum spanning tree containing 9,985 nodes. For 15 isolated nodes, their neighbors with the highest similarity were connected, and the lowest similarity was 0.58. The force-directed layout algorithm was used to optimize the network layout, setting the repulsion coefficient to -1.2 and the attraction coefficient to 0.8. After 500 iterations, a stable structure was obtained. The final network contained 10,000 nodes, 50,015 edges, and an average degree of 10.003, reflecting the complex spatiotemporal association relationship between electronic evidence.

[0055] S108. Analyze the abnormal patterns of spatiotemporal associations based on the association relationship network of electronic evidence, compare with known credible reference data, identify the existing isolated nodes, abnormal clusters and unnatural association paths, and compare the credibility score of each electronic evidence with the preset score threshold to determine the authenticity of the electronic evidence.

[0056] The electronic evidence is sorted according to the timestamp, and the adjacent nodes are connected based on the spatial proximity relationship to obtain a complete trajectory chain; the mean and standard deviation of each indicator in the trajectory chain are calculated, and the threshold is set to the mean plus or minus a preset times the standard deviation; a dynamic time warping algorithm is used to calculate the similarity between the electronic evidence sequence and pre-established reference data, and the reference data includes a normal activity range, a common time pattern, and a reasonable speed range; the abnormal structure in the association relationship network formed by the trajectory chain is detected, and if an abnormal structure is detected, the abnormal structure is judged to be questionable evidence; for the questionable evidence, different scoring indicators are weighted, and the scoring indicators include the number of abnormal patterns, consistency with the reference data, and structural characteristics in the network, and the comprehensive score of the questionable evidence is obtained by calculating the weighted average.

[0057] Specifically, based on the association network, a spatiotemporal trajectory sequence is constructed. First, the electronic evidence is sorted according to the timestamp, and then the adjacent nodes are connected based on the spatial proximity relationship to form a complete trajectory chain. The spatiotemporal changes between adjacent nodes are calculated, including geographical distance, time interval and speed. The adaptive threshold setting method is used to dynamically adjust the abnormal judgment criteria according to the data distribution characteristics. The mean and standard deviation of each indicator are calculated, and the threshold is set to the mean plus or minus 3 times the standard deviation. These dynamic thresholds are used to identify abnormal patterns, such as geographic location jumps, time series breaks, or unreasonable speed changes. Reference data are extracted from a pre-established trusted database, including normal activity ranges, common time patterns, and reasonable speed ranges. The reference data and electronic evidence are normalized in spatiotemporal scales, with the time unit unified as hours and the space unit unified as kilometers. The dynamic time warping algorithm is used to calculate the similarity between the electronic evidence sequence and the reference data. The sliding window size is set to 24 hours and the step size is 1 hour. The Euclidean distance is calculated in each window as the similarity indicator. Potential contradictions and inconsistencies are identified, and the results are used for subsequent network structure analysis. The graph structure analysis algorithm is used to detect abnormal structures in the association network. Degree centrality algorithm was used to identify isolated nodes with a degree less than 3. DBSCAN algorithm was used for density clustering, with the neighborhood radius set to 1.5 times the average edge length and the minimum number of points set to 1% of the total number of nodes. Clusters with significantly higher density than the surrounding area were defined as abnormal clusters. The key paths connecting different clusters were analyzed, and path entropy was calculated to assess their uncertainty. Paths with path entropy higher than twice the network average were marked as unnatural association paths. Combined with the reference data comparison results, these abnormal structures were verified twice to improve the accuracy of anomaly detection. Based on the above analysis results, the credibility score was calculated for each piece of electronic evidence. The scoring indicators include the number of abnormal patterns, consistency with reference data, and structural characteristics in the network. The random forest algorithm was used to weight different scoring indicators, and the training data came from the sample set annotated by experts. The feature importance score of the random forest was used as the weight of each indicator, and the weighted average was calculated to obtain a comprehensive score. The scoring threshold was set to 0.7. If the score was lower than the threshold, it was judged as doubtful evidence. For doubtful evidence, its position and influence in the association network were further analyzed to provide a basis for subsequent evidence review and investigation. In the spatiotemporal correlation analysis of electronic evidence, a spatiotemporal trajectory sequence containing 10,000 nodes was first constructed. The nodes were sorted by timestamp, and the average time interval between adjacent nodes was 30 minutes. The change between nodes was calculated, and the mean geographical distance was 50 kilometers, with a standard deviation of 20 kilometers; the mean time interval was 1.5 hours, with a standard deviation of 0.5 hours; the mean speed was 60 kilometers per hour, with a standard deviation of 25 kilometers per hour. The dynamic threshold was set to ±3 times the standard deviation of the mean, and 150 geographical jump anomalies, 80 time break anomalies, and 100 speed anomalies were identified. Subsequently, 1,000 reference trajectories were extracted from the trusted database for spatiotemporal scale standardization.The dynamic time warping algorithm was used to calculate the similarity with a window size of 24 hours and a step size of 1 hour. The average similarity was 0.85, the standard deviation was 0.1, and 200 potentially contradictory evidences were identified. Then the DBSCAN algorithm was used for density clustering, with a neighborhood radius of 75 kilometers and a minimum number of points of 100, and 5 abnormal clusters were detected. Degree centrality analysis found 50 isolated nodes. Entropy analysis was performed on the key paths, and the average path entropy of the network was 1.2. 10 unnatural paths with entropy values ​​greater than 2.4 were identified. Finally, the random forest algorithm was used to calculate the credibility score, and the training set contained 1,000 labeled samples. The feature importance was obtained as 0.3 for the number of abnormal patterns, 0.4 for the consistency of reference data, and 0.3 for the network structure characteristics. The 10,000 pieces of evidence were scored with an average score of 0.82 and a standard deviation of 0.15. The threshold was set at 0.7, and 1,500 questionable evidences were identified. Of these, 500 were located within abnormal clusters and 300 were on unnatural paths, showing potential problems with these evidences in the association network.

[0058] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for analyzing the relevance of electronic evidence, characterized in that: The method comprises: Parse and standardize the heterogeneous data of electronic evidence, extract timestamp information according to the characteristics of the data source, and convert data of different time precisions into millisecond timestamps; Extract spatial information based on timestamps, including physical space and virtual space, unify the format of the extracted information and transform the coordinate system to obtain a comprehensive data set containing standardized time series and multi-scale spatial information; Based on the comprehensive data set of time series and multi-scale spatial information, the geographical location information of the physical space and the network topology information of the virtual space are indexed, the two types of spatial information are associated to obtain a unified multi-dimensional spatial representation, and the Euclidean distance in the time dimension and the network distance in the space dimension are calculated; Based on the Euclidean distance in the time dimension and the network distance in the space dimension, a comprehensive distance calculation model integrating time and space features is constructed, and the weights of the time dimension and space dimension are adjusted to form an adaptive distance metric for reflecting the time and space correlation of electronic evidence. Perform cluster analysis on the standardized electronic evidence data to determine whether the distance of the temporal and spatial correlation between the data is less than a preset threshold. If so, the data points are classified into the same category to identify electronic evidence groups with temporal and spatial correlations. Based on the electronic evidence group, a spatiotemporal correlation graph model is constructed. The edge weights are set based on the spatiotemporal correlation distances between nodes. The high-dimensional spatiotemporal correlation features are mapped to a low-dimensional vector space to obtain the spatiotemporal correlation feature vector of the electronic evidence. Perform similarity calculation on the spatiotemporal correlation feature vectors, calculate the spatiotemporal correlation degree between different electronic evidences, and select the related electronic evidences as electronic evidence pairs according to the similarity threshold to form a correlation relationship network; Based on the correlation network of electronic evidence, analyze its abnormal patterns of temporal and spatial correlation, compare it with known trusted reference data, identify existing isolated nodes, abnormal clusters and unnatural correlation paths, and compare the credibility score of each electronic evidence with the preset scoring threshold to determine the authenticity of the electronic evidence.

2. The method according to claim 1, characterized in that The said parsing and standardizing of the heterogeneous data of electronic evidence, extracting the timestamp information according to the characteristics of the data source, and converting the data of various time precisions into millisecond-level timestamps uniformly include: receiving a classification request carrying an electronic evidence file format identifier, wherein the classification request is issued by a heterogeneous data source; Determining a corresponding parsing method according to the classification request, wherein the parsing method is used to extract key information from different types of electronic evidence; Formatting the time information in the key information to identify the accuracy level of the time information; Establishing a preset standardized data model, wherein the standardized data model includes data source, timestamp, content type, and content summary fields; Mapping the millisecond timestamp to a timestamp field of the standardized data model; Perform integrity check on the mapped standardized data set to obtain data items with missing time information; For the data item whose time information is missing, calculate the time difference between adjacent valid timestamps; Evenly allocating the time difference to the missing time points to obtain an estimated timestamp; Performing rationality verification on the estimated timestamp to determine whether it conforms to the time series characteristics of the data source; If the time series characteristics are met, the estimated timestamp is filled into the corresponding missing data item.

3. The method according to claim 1, characterized in that The method extracts spatial information according to the timestamp, including physical space and virtual space, unifies the format of the extracted information and converts the coordinate system to obtain a comprehensive data set containing standardized time series and multi-scale spatial information, including: Obtaining physical space information of the corresponding time point from the geographic location database according to the timestamp, wherein the physical space information includes country and province information at the macro level, city and district and county information at the meso level, and detailed address and longitude and latitude coordinates at the micro level; Using an IP address resolution tool to extract the IP address from the network log corresponding to the timestamp, if the IP address is a dynamic IP address, then using the IP address change record within the time window for tracking; Unify the formats of physical space information and virtual space information to obtain a unified structured data format, and convert longitude and latitude in different coordinate systems into a coordinate system; The time series in structured data formats, multi-scale physical space information, and virtual space information are associated and integrated to obtain a comprehensive dataset containing spatiotemporal relationships.

4. The method according to claim 1, characterized in that The method of indexing the geographic location information of the physical space and the network topology information of the virtual space based on the comprehensive data set of time series and multi-scale spatial information, associating the two types of spatial information, obtaining a unified multi-dimensional spatial representation, and calculating the Euclidean distance in the time dimension and the network distance in the space dimension includes: Acquire multi-scale geographic location information of a physical space, wherein the multi-scale geographic location information includes longitude and latitude coordinates; Constructing a time-series graph data structure to index the network topology information of the virtual space, wherein the time-series graph data structure uses network nodes as graph vertices and connection relationships as graph edges; Generate a unique hash value of geographic location information and network topology information to establish a mapping relationship between physical space and virtual space; For the mapping relationship, a unified multi-dimensional space representation including geographic coordinates, network node identifiers and timestamp information is obtained; According to the unified multi-dimensional space representation, calculating the Euclidean distance of the time dimension and the network distance of the space dimension; It also includes: building a spatial index for the geographic location information of the physical space, organizing the two-dimensional or three-dimensional coordinate data into a hierarchical tree structure, building a graph index for the network topology information of the virtual space, storing the connection relationship between nodes, associating the leaf nodes in the spatial index with the corresponding nodes in the graph index to form a unified multi-dimensional space representation, using the Euclidean distance formula to calculate the distance in the time dimension, and calculating the network distance in the virtual space.

5. The method according to claim 4, characterized in that The method constructs a spatial index for the geographic location information of the physical space, organizes the two-dimensional or three-dimensional coordinate data into a hierarchical tree structure, establishes a graph index for the network topology information of the virtual space, stores the connection relationship between nodes, associates the leaf nodes in the spatial index with the corresponding nodes in the graph index, forms a unified multi-dimensional space representation, calculates the distance in the time dimension using the Euclidean distance formula, and calculates the network distance in the virtual space, including: The R-tree algorithm is used to construct the geographical location information index of the physical space, and the two-dimensional coordinate data is organized into a hierarchical tree structure; According to the R-tree structure, the geographic coordinate points are stored in leaf nodes by recursively dividing the spatial region, and the non-leaf nodes contain the minimum bounding rectangle of the child nodes; Using an adjacency list structure combined with a timing diagram to represent a dynamically changing virtual space network topology, the adjacency list structure storing connection relationships between nodes and connection timestamp information; Associating the geographic coordinates in the R tree leaf node with the network node in the adjacency table through a spatial hash function to generate a unique hash value as an index key; Calculating the comprehensive distance of the time dimension and the space dimension, wherein the time dimension distance is calculated using the Euclidean distance formula, and the space dimension distance is calculated using the Floyd-Warshall algorithm; The time dimension distance and the space dimension distance are weightedly combined to obtain a final time-space distance measurement result.

6. The method according to claim 1, characterized in that The method of constructing a comprehensive distance calculation model integrating spatiotemporal features based on the Euclidean distance in the time dimension and the network distance in the space dimension, adjusting the weights of the time dimension and the space dimension, and forming an adaptive distance metric for reflecting the spatiotemporal correlation of electronic evidence includes: Obtaining the Euclidean distance of the time dimension and the network distance of the space dimension, and converting the Euclidean distance and the network distance into a standard normal distribution according to a z-score standardization method; The maximum and minimum normalization method is used to map the standardized distance value to the range of 0 to 1 to obtain a unified distance measurement scale; Using the unified distance measurement scale, the temporal density and spatial distribution characteristics of electronic evidence are calculated through a sliding window; According to the changing rate of time density and the shrinking and expanding trend of spatial distribution, the weight coefficients of time dimension and space dimension are determined; A multi-layer perceptron neural network is established, and after the input layer receives the standardized time distance and space distance, the time distance and space distance are multiplied by corresponding weight coefficients and then input into the neural network; Obtaining the mean absolute error as the fitness function, wherein the mean absolute error is calculated from the predicted integrated distance and the manually annotated reference distance; If the mean absolute error meets the preset conditions, it is judged that the optimization of the neural network model parameters is completed; According to the optimized neural network model parameters, an adaptive distance measurement model reflecting the spatiotemporal correlation of electronic evidence is obtained; The adaptive distance measurement model is used to calculate the comprehensive distance between electronic evidences; It also includes: setting the initial time dimension weight and space dimension weight, constructing a comprehensive distance function, combining the temporal Euclidean distance and the spatial network distance, grouping the data using the current weight configuration, and evaluating the grouping effect. Based on the evaluation results and combined with the interaction effect between the dimensions, the weights of the two dimensions are adjusted, and the comprehensive distance is recalculated using the adjusted weights.

7. The method according to claim 1, characterized in that The cluster analysis is performed on the standardized electronic evidence data to determine whether the distance of the temporal and spatial correlation between the data is less than a preset threshold. If so, the data points are classified into the same category to identify electronic evidence groups with temporal and spatial correlation, including: Obtaining standardized electronic evidence data, and calculating the local density of each data point based on the data; The K nearest neighbor algorithm is used to determine the neighborhood range, and the optimal K value is selected by calculating the silhouette coefficient; If the silhouette coefficient reaches a maximum value, the corresponding K value is determined as the optimal neighborhood range; According to the local density, a spatiotemporal distance calculation function D=wt*Dt+ws*Ds is constructed, where Dt and Ds are time and space distances respectively, wt and ws are corresponding weights, and the function performs weighted fusion of the distances in the time dimension and the space dimension; Calculate the weights of the time and space dimensions to obtain the space-time distance matrix between any two data points; Based on the spatiotemporal distance matrix, DBSCAN algorithm is used for density clustering; Determine the density threshold, where the horizontal axis is the data point and the vertical axis is the distance from each point to the Kth nearest neighbor; Select the inflection point of the K distance graph curve as the density threshold to obtain the preliminary clustering results; Optimizing the preliminary clustering results, and calculating the average spatiotemporal distances within and between classes; If the intra-class distance is less than half of the inter-class distance, the clustering threshold is lowered; Otherwise, the threshold is raised; By iteratively updating the clustering results until the change in clustering results for two consecutive iterations is less than a preset threshold, electronic evidence groups with spatiotemporal correlation are obtained, wherein the spatiotemporal distance of data points in each group is less than the optimized threshold.

8. The method according to claim 1, characterized in that The spatiotemporal association graph model is constructed based on the electronic evidence group, and the edge weight is set in combination with the distance of the spatiotemporal association between nodes, and the high-dimensional spatiotemporal association features are mapped to the low-dimensional vector space to obtain the spatiotemporal association feature vector of the electronic evidence, including: Calculating the spatiotemporal distance between groups according to the node generation request, wherein the spatiotemporal distance is obtained by a weighted sum of a time difference and a spatial distance; Setting the weight of the edge to be inversely proportional to the space-time distance to generate a weighted undirected graph structure; Calculating the importance score of each node in the weighted undirected graph structure, wherein the importance score is used as an initial feature of the node; Obtaining a high-dimensional feature vector of the node, wherein the high-dimensional feature vector includes topological features of node degree, clustering coefficient, and betweenness centrality; The high-dimensional feature vector is mapped to a low-dimensional space using the t-SNE algorithm to obtain a low-dimensional embedding vector corresponding to each node; After the low-dimensional embedding vector is obtained, the spatiotemporal correlation feature vector of the electronic evidence is constructed based on the low-dimensional embedding vector combined with the original spatiotemporal attribute information.

9. The method according to claim 1, characterized in that: The similarity calculation is performed on the spatiotemporal correlation feature vectors, the spatiotemporal correlation degree between different electronic evidences is calculated, and the associated electronic evidences are selected as electronic evidence pairs according to the similarity threshold to form an association relationship network, including: Obtaining a spatiotemporal correlation feature vector, and calculating a variance contribution rate of each feature as a weight according to the feature vector; Normalizing the feature vector using a minimum-maximum normalization method to obtain a normalized feature vector; Calculating the Euclidean distance and the cosine similarity according to the normalized feature vector, and constructing a comprehensive similarity index through the Euclidean distance and the cosine similarity; Determine whether the comprehensive similarity index meets the preset conditions, and if so, calculate the spatiotemporal correlation degree; Clustering the spatiotemporal correlation levels into three categories: high, medium, and low; Calculating the mean and standard deviation of the high similarity categories, wherein the similarity threshold is set to the mean minus the standard deviation; If the clustering result does not meet the preset conditions, density clustering is performed and the minimum value of the high-density cluster is selected as the similarity threshold; According to the similarity threshold, electronic evidence pairs that meet the conditions are screened out, and an association relationship network is constructed; In the association relationship network, each electronic evidence is used as a network node, and a connection is established between pairs of evidence with a similarity greater than a threshold; The Kruskal minimum spanning tree algorithm is used to construct the skeleton of the association relationship network; For an isolated node in the association relationship network, a connected node with the highest similarity is obtained, and an additional connection is established to obtain an association relationship network.

10. The method according to claim 1, characterized in that The method of analyzing the abnormal patterns of spatiotemporal associations based on the association relationship network of the electronic evidence, comparing known credible reference data, identifying isolated nodes, abnormal clusters, and unnatural association paths, and comparing the credibility scores of each electronic evidence with a preset score threshold to determine the authenticity of the electronic evidence includes: Sort the electronic evidence according to timestamps and connect adjacent nodes based on spatial proximity to obtain a complete trajectory chain; Calculate the mean and standard deviation of each indicator in the trajectory chain, and set the threshold to the mean plus or minus a preset times the standard deviation; Using a dynamic time warping algorithm to calculate the similarity between the electronic evidence sequence and pre-established reference data, the reference data includes normal activity ranges, common time patterns, and reasonable speed ranges; Detecting an abnormal structure in the association relationship network formed by the trajectory chain, and if an abnormal structure is detected, determining that the abnormal structure is questionable evidence; For the questionable evidence, different scoring indicators are weighted, and the scoring indicators include the number of abnormal patterns, consistency with reference data, and structural characteristics in the network. The comprehensive score of the questionable evidence is obtained by calculating the weighted average.

Images