Virtual currency wallet evidence obtaining method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention discloses a virtual currency wallet evidence obtaining method and device, electronic equipment and a storage medium. The method comprises the steps that target electronic equipment is acquired, and at least one piece of target equipment data is extracted from the target electronic equipment; extracting text information of each piece of target equipment data, and generating at least one mnemonic word sequence based on each piece of text information; generating reference assistant word sequences according to the assistant word sequences, and verifying the reference assistant word sequences; generating a wallet address of at least one virtual currency wallet matched with the target reference mnemonic word sequence under the condition that the target reference mnemonic word sequence passes the verification; and determining a target wallet address according to each wallet address of the virtual currency wallet, and obtaining a crime record of the target crime user based on the target wallet address. According to the scheme provided by the embodiment of the invention, the wallet address of the virtual currency wallet can be quickly and accurately generated, so that the crime record of a criminal user is obtained.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a virtual currency wallet evidence collection method, device, electronic device and storage medium. Background Art

[0002] With the rapid development of digital currency, virtual currency has become an important part of the financial field. However, it is also widely used in various illegal and criminal activities. The anonymity and untraceability of virtual currency pose huge challenges to relevant institutions in collecting evidence.

[0003] At present, relevant personnel mainly screen the electronic devices used by criminal users to determine the files that may contain mnemonics, and further obtain the wallet address of the virtual currency wallet. However, this method often ignores important information, resulting in incomplete generated wallet addresses, making it difficult to accurately obtain the criminal records of criminal users.

[0004] How to quickly and accurately generate the wallet address of a virtual currency wallet and obtain the criminal record of the criminal user is a key issue in industry research. Summary of the invention

[0005] The present invention provides a virtual currency wallet evidence collection method, device, electronic device and storage medium, which can quickly and accurately generate a wallet address of a virtual currency wallet, thereby obtaining the criminal record of the criminal user.

[0006] According to one aspect of the present invention, a method for obtaining evidence of a virtual currency wallet is provided, the method comprising:

[0007] Acquire a target electronic device, and extract at least one target device data from the target electronic device; wherein the target electronic device is a terminal device used by a target criminal user;

[0008] Extracting text information of each of the target device data, and generating at least one mnemonic sequence based on each of the text information;

[0009] Generating a reference mnemonic sequence according to each of the mnemonic sequences, and verifying each of the reference mnemonic sequences;

[0010] If the target reference mnemonic sequence passes verification, generating a wallet address of at least one virtual currency wallet matching the target reference mnemonic sequence;

[0011] A target wallet address is determined according to each wallet address of the virtual currency wallet, and a criminal record of the target criminal user is obtained based on the target wallet address.

[0012] According to another aspect of the present invention, a virtual currency wallet evidence collection device is provided, the device comprising:

[0013] A target device data extraction module, used to obtain a target electronic device and extract at least one target device data from the target electronic device; wherein the target electronic device is a terminal device used by a target criminal user;

[0014] a mnemonic sequence generation module, configured to extract text information of each target device data and generate at least one mnemonic sequence based on each text information;

[0015] A verification module, used to generate a reference mnemonic sequence according to each of the mnemonic sequences, and verify each of the reference mnemonic sequences;

[0016] A wallet address generation module for a virtual currency wallet, configured to generate a wallet address of at least one virtual currency wallet matching the target reference mnemonic sequence when the target reference mnemonic sequence is verified;

[0017] The target wallet address determination module is used to determine the target wallet address according to the wallet addresses of the virtual currency wallet, and obtain the criminal record of the target criminal user based on the target wallet address.

[0018] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0019] at least one processor; and

[0020] a memory communicatively connected to the at least one processor; wherein,

[0021] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the virtual currency wallet forensics method described in any embodiment of the present invention.

[0022] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the virtual currency wallet forensics method described in any embodiment of the present invention when executed.

[0023] According to another aspect of the present invention, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the method for collecting evidence of a virtual currency wallet according to any embodiment of the present invention is implemented.

[0024] The technical solution of the embodiment of the present invention is to obtain a target electronic device and extract at least one target device data from the target electronic device; wherein the target electronic device is a terminal device used by a target criminal user; extract text information of each target device data, and generate at least one mnemonic sequence based on each text information; generate a reference mnemonic sequence according to each mnemonic sequence, and verify each reference mnemonic sequence; if the target reference mnemonic sequence is verified, generate at least one wallet address of a virtual currency wallet that matches the target reference mnemonic sequence; determine the target wallet address according to each wallet address of the virtual currency wallet, and obtain the criminal record of the target criminal user based on the target wallet address, so as to quickly and accurately generate the wallet address of the virtual currency wallet, thereby obtaining the criminal record of the criminal user.

[0025] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0027] Figure 1 is a flow chart of a method for obtaining evidence of a virtual currency wallet provided according to the first embodiment of the present invention;

[0028] Figure 2 This is a flow chart of a method for obtaining evidence of a virtual currency wallet provided in accordance with Embodiment 2 of the present invention;

[0029] Figure 3 2 is a schematic diagram of the structure of a virtual currency wallet evidence collection device provided according to Embodiment 3 of the present invention;

[0030] Figure 4 It is a structural schematic diagram of an electronic device for implementing the virtual currency wallet evidence collection method of an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0033] Embodiment 1

[0034] Figure 1 This is a flowchart of a virtual currency wallet evidence collection method provided according to the first embodiment of the present invention. This embodiment is applicable to the case where the target user's criminal record is determined based on the terminal device used by the target criminal user. The method can be executed by a virtual currency wallet evidence collection device. The virtual currency wallet evidence collection device can be implemented in the form of hardware and / or software. The virtual currency wallet evidence collection device can be configured in electronic devices such as computers, servers or tablet computers. Figure 1 As shown, the method includes:

[0035] Step 110: Acquire a target electronic device, and extract at least one target device data from the target electronic device.

[0036] The target electronic device is a terminal device used by the target criminal user, such as a smart phone, tablet computer or smart watch, etc., which has online transaction functions. It can be understood that in this embodiment, the target criminal user may also be a suspected criminal user, who may not be a user who has been confirmed to have committed a crime.

[0037] In an optional implementation of this embodiment, after obtaining the target electronic device used by the target criminal user, multiple target device data can be further extracted from the target electronic device; in this embodiment, the target device can be data in different forms such as images, text or audio, which is not limited in this embodiment.

[0038] Optionally, in this embodiment, extracting at least one target device data from the target electronic device may include: traversing each application of the target electronic device, extracting image data, text data or audio data in each of the applications, and obtaining each of the target device data.

[0039] The applications of the target electronic device may be a gallery, a chat application, a financial application, or a text recording application, etc., which are not limited in this embodiment.

[0040] In an optional implementation of this embodiment, each application installed in the target electronic device can be traversed in turn to obtain the image data, text data and audio data stored or cached in each application, and determine these data as the target device data of the target electronic device.

[0041] Step 120: extract text information of each target device data, and generate at least one mnemonic sequence based on each text information.

[0042] The mnemonic sequence can be composed of multiple mnemonics, for example, 12, 15 or 21, etc., which are not limited in this embodiment. The mnemonic sequence can be used to generate and manage a memorable phrase for a cryptocurrency wallet, which converts a complex private key into a sequence of words that is easy to remember and write, helping users remember and manage private keys.

[0043] In an optional implementation of this embodiment, after acquiring each target device data of the target electronic device, text information of each target data may be further extracted, and each mnemonic sequence may be generated based on the extracted text information.

[0044] Optionally, in this embodiment, extracting text information of each target device data may include: identifying the image data to obtain at least one item of text information; or, extracting the text data to obtain at least one item of text information; or, performing semantic understanding on the audio data to obtain at least one item of text information.

[0045] In an optional implementation of this embodiment, if the target device data is image data, the image data may be identified, thereby identifying text content contained in the image data, and determining the text content as various items of text information.

[0046] In another optional implementation of this embodiment, if the target device data is text data, the text data can be directly extracted to obtain various text information.

[0047] In another optional implementation of this embodiment, if the target device data is audio data, the audio data may be semantically understood to obtain text content contained in the audio data, and the text content may be determined as various text information items.

[0048] Further, at least one mnemonic sequence can be generated based on each of the text information acquired as described above; optionally, in the present embodiment, generating at least one mnemonic sequence based on each of the text information may include: performing keyword search on each of the text information to obtain each target text information, and performing regular expression matching on each of the target text information to obtain at least one mnemonic sequence.

[0049] In an optional implementation of this embodiment, after obtaining each item of text information, a keyword search can be further performed on each item of text information to obtain each target text information; wherein the target text information can be each item of text information that matches the keyword; for example, if the keyword is a transaction, then the target text information obtained by the search can be all text information related to the transaction, which is not limited in this embodiment. Furthermore, each target text information can be matched with a regular expression to obtain each mnemonic sequence.

[0050] Step 130: Generate a reference mnemonic sequence according to each of the mnemonic sequences, and verify each of the reference mnemonic sequences.

[0051] In an optional implementation of this embodiment, a reference mnemonic sequence can be further generated based on each mnemonic sequence, and after each reference mnemonic sequence is generated, each reference mnemonic sequence is verified to determine whether each reference mnemonic sequence meets a preset standard; wherein the preset standard may be the BIP39 standard, which defines the length, order, and generation rules of valid mnemonics.

[0052] Optionally, in this embodiment, generating a reference mnemonic sequence according to each of the mnemonic sequences and verifying each of the reference mnemonic sequences may include: determining the number of mnemonics included in a first mnemonic sequence, and if it is determined that the number does not meet a preset number requirement, performing mnemonic completion or mnemonic filtering on the first mnemonic sequence to obtain a reference mnemonic sequence; or, if it is determined that the number of mnemonics in a second mnemonic sequence meets a preset number requirement, but the order of each mnemonic does not meet a preset order requirement, reordering each mnemonic in the second mnemonic sequence to obtain a reference mnemonic sequence; and verifying each of the reference mnemonics based on the BIP39 standard to determine whether each of the reference mnemonic sequences meets the BIP39 standard.

[0053] The first mnemonic sequence and the second mnemonic sequence may be any mnemonic sequence generated in the above steps, which is only for the convenience of description in this embodiment and is not a limitation of this embodiment.

[0054] In this embodiment, the preset quantity requirement can be determined according to the BIP39 standard, for example, it can be 12 or 15, etc., which is not limited in this embodiment.

[0055] In an optional implementation of the present embodiment, the number of mnemonics included in the first mnemonic sequence can be determined, and the number of mnemonics included in the first mnemonic sequence can be compared with the number of mnemonics included in the mnemonic sequence specified by a preset quantity requirement. If the number of mnemonics included in the first mnemonic sequence is less than the number of mnemonics included in the mnemonic sequence specified by the preset quantity requirement, it can be determined that the preset quantity requirement is not met; further, the mnemonics in the first mnemonic sequence can be supplemented; illustratively, if the first mnemonic sequence contains 8 mnemonics and the number of mnemonics included in the mnemonic sequence specified by the preset quantity requirement is 12, then the mnemonics in the first mnemonic sequence can be supplemented to 12, thereby obtaining a reference mnemonic sequence.

[0056] In another optional implementation of the present embodiment, if the number of mnemonics included in the first mnemonic sequence is greater than the number of mnemonics included in the mnemonic sequence specified by a preset number requirement, it can be determined that the preset number requirement is not met; further, the mnemonics in the first mnemonic sequence can be filtered out; illustratively, if the first mnemonic sequence contains 13 mnemonics and the number of mnemonics included in the mnemonic sequence specified by the preset number requirement is 12, then one mnemonic in the first mnemonic sequence can be filtered out to obtain a reference mnemonic sequence.

[0057] In another optional implementation of this embodiment, if it is determined that the number of mnemonics in the second mnemonic sequence meets the preset number requirement, but the order of the mnemonics does not meet the preset order requirement, the mnemonics can be further reordered based on the preset order requirement to obtain a reference mnemonic sequence.

[0058] Among them, the preset sorting requirements can also be determined according to the BIP39 standard, which is not limited in this embodiment.

[0059] Furthermore, each of the reference mnemonics may be verified based on the BIP39 standard to determine whether each of the reference mnemonics sequences meets the BIP39 standard.

[0060] It should be noted that, in this embodiment, after each reference mnemonic sequence is generated, each reference mnemonic sequence can also be added to the mnemonic dictionary, so that the reference mnemonic sequence can be quickly determined in subsequent operations, providing a basis for extracting useful criminal records.

[0061] It should also be noted that, in this embodiment, the reference mnemonic sequence can also be directly extracted from a third-party virtual wallet application, so that each reference mnemonic sequence can be quickly obtained, providing a basis for quickly extracting useful criminal records.

[0062] Step 140: When the target reference mnemonic sequence passes verification, generate a wallet address of at least one virtual currency wallet that matches the target reference mnemonic sequence.

[0063] The target reference mnemonic sequence may be any reference mnemonic generated in the above steps, which is not limited in this embodiment.

[0064] In an optional implementation of this embodiment, after the target reference mnemonic sequence is verified based on the BIP39 standard, wallet addresses of virtual currency wallets matching the target reference mnemonic sequence may be further generated.

[0065] Optionally, in this embodiment, a private key matching the target electronic device can be generated based on the target reference mnemonic sequence, and further, wallet addresses of virtual currency wallets matching the target reference mnemonic sequence can be generated based on the private key.

[0066] Step 150: determine a target wallet address according to the wallet addresses of the virtual currency wallet, and obtain the criminal record of the target criminal user based on the target wallet address.

[0067] Optionally, in this embodiment, after determining each wallet address, each wallet address can be further screened to obtain a target wallet address, and further, the criminal record of the target criminal user can be obtained based on the target wallet address.

[0068] In an optional implementation of this embodiment, the wallet addresses of the virtual currency wallet may be screened based on the wallet addresses recorded in the blockchain network. For example, the wallet addresses of the virtual currency wallet that are not included in the wallet addresses recorded in the blockchain network may be filtered out to obtain the target wallet address; further, the transaction records of the target wallet address may be tracked to determine the criminal record of the target criminal user.

[0069] The technical solution of this embodiment is to obtain a target electronic device and extract at least one target device data from the target electronic device; wherein the target electronic device is a terminal device used by a target criminal user; extract text information of each target device data, and generate at least one mnemonic sequence based on each text information; generate a reference mnemonic sequence according to each mnemonic sequence, and verify each reference mnemonic sequence; if the target reference mnemonic sequence passes the verification, generate a wallet address of at least one virtual currency wallet that matches the target reference mnemonic sequence; determine the target wallet address according to each wallet address of the virtual currency wallet, and obtain the criminal record of the target criminal user based on the target wallet address, so as to quickly and accurately generate the wallet address of the virtual currency wallet, thereby obtaining the criminal record of the criminal user.

[0070] Embodiment 2

[0071] Figure 2 1 is a flowchart of a virtual currency wallet evidence collection method provided according to the second embodiment of the present invention. This embodiment is a further refinement of the above technical solution. The technical solution in this embodiment can be combined with various optional solutions in one or more of the above embodiments. Figure 2 As shown, the method includes:

[0072] Step 210: Acquire a target electronic device, and extract at least one target device data from the target electronic device.

[0073] Step 220: extract text information of each target device data, and generate at least one mnemonic sequence based on each text information.

[0074] Step 230: Generate a reference mnemonic sequence according to each of the mnemonic sequences, and verify each of the reference mnemonic sequences.

[0075] Step 240: Determine at least one reference information that matches the target reference mnemonic sequence, and generate wallet addresses of virtual currency wallets that match the target reference mnemonic sequence based on each of the reference information.

[0076] The reference information includes: the type, node, derivation standard and derivation path of the virtual currency; the type of the virtual currency may be Bitcoin or Ethereum, etc.; the derivation standard may be the BIP32 standard or the BIP44 standard; and, for example, a derivation path may be m / 44' / 0' / 0' / 0 / 0. In this embodiment, the reference information may be determined by relevant personnel or automatically by the system, and is not limited in this embodiment.

[0077] In an optional implementation of this embodiment, after the target reference mnemonic sequence is verified, each reference information matching the target reference mnemonic sequence can be further determined, and each wallet address of the virtual currency wallet matching the target reference mnemonic sequence can be generated based on each reference information.

[0078] In an optional implementation of this embodiment, a wallet address may be generated according to the type, node, derivation standard, and derivation path of the virtual currency; it is understandable that different wallet addresses may be generated for different derivation paths.

[0079] It can be understood that in this embodiment, each wallet address is generated according to the selected reference information, which can ensure that each generated wallet address matches the type and derivation standard of the virtual currency.

[0080] Step 250: Compare each wallet address of the virtual currency wallet with each target wallet address recorded in the blockchain network, and determine the target wallet address according to the comparison result.

[0081] The target wallet address is a traded address stored in any block of the blockchain network.

[0082] In an optional implementation of the present embodiment, after the wallet addresses of the virtual currency wallets are generated, each wallet address can be further compared with each target wallet address of transactions recorded in the blockchain network. During the comparison process, each wallet address can be screened to obtain the target wallet address.

[0083] In an example of this embodiment, if three wallet addresses are generated based on the above steps, namely wallet address A, wallet address B and wallet address C; these three wallet addresses are compared with the transaction addresses recorded in the blockchain network, and it is determined that wallet address A is recorded in the blockchain network, while wallet address B and wallet address C are not recorded in the blockchain network, then wallet address A can be determined as the target wallet address.

[0084] Step 260: determine each virtual currency transaction record realized based on the target wallet address; determine the transaction content matching each virtual currency transaction record, and determine the criminal record of the target criminal user based on the transaction content.

[0085] Optionally, in this embodiment, after determining the target wallet address, the target criminal user's transaction records of each virtual currency based on each target wallet address can be further determined based on the target wallet address; further, the transaction content matching each transaction record can be determined. And the criminal record of the target criminal user can be mined based on the transaction content.

[0086] For example, in an example of this embodiment, after determining the target wallet address, the flow of virtual currency funds can be determined based on the target wallet address, the upstream and downstream parties of the transaction can be determined, and suspected criminal users related to the target criminal user can be determined, providing a basis for solving the case.

[0087] The solution of this embodiment reduces the complexity of manual operations and possible omissions and errors through the automated mnemonic extraction and reorganization method; through the process of converting wallet addresses through mnemonics, forensic support for multi-currency virtual currency wallets is achieved; in addition, the automated wallet address verification step enables investigators to confirm crime-related wallet addresses more quickly, thereby improving the efficiency of case detection.

[0088] Embodiment 3

[0089] Figure 3 1 is a schematic diagram of a virtual currency wallet evidence collection device according to Embodiment 3 of the present invention. Figure 3 As shown, the apparatus includes: a target device data extraction module 310, a mnemonic sequence generation module 320, a verification module 330, a wallet address generation module 340 of a virtual currency wallet, and a target wallet address determination module 350.

[0090] The target device data extraction module 310 is used to obtain a target electronic device and extract at least one target device data from the target electronic device; wherein the target electronic device is a terminal device used by the target criminal user;

[0091] A mnemonic sequence generating module 320, configured to extract text information of each target device data and generate at least one mnemonic sequence based on each text information;

[0092] A verification module 330, configured to generate a reference mnemonic sequence according to each of the mnemonic sequences, and verify each of the reference mnemonic sequences;

[0093] A virtual currency wallet wallet address generation module 340, configured to generate at least one virtual currency wallet wallet address matching the target reference mnemonic sequence when the target reference mnemonic sequence is verified;

[0094] The target wallet address determination module 350 is used to determine the target wallet address according to the wallet addresses of the virtual currency wallet, and obtain the criminal record of the target criminal user based on the target wallet address.

[0095] The scheme of this embodiment is to obtain a target electronic device through a target device data extraction module, and extract at least one target device data from the target electronic device; extract text information of each target device data through a mnemonic sequence generation module, and generate at least one mnemonic sequence based on each text information; generate a reference mnemonic sequence according to each mnemonic sequence through a verification module, and verify each reference mnemonic sequence; generate at least one virtual currency wallet wallet address matching the target reference mnemonic sequence through a wallet address generation module of a virtual currency wallet when the target reference mnemonic sequence verification passes; determine a target wallet address according to each wallet address of the virtual currency wallet through a target wallet address determination module, and obtain the criminal record of the target criminal user based on the target wallet address, so that the wallet address of the virtual currency wallet can be generated quickly and accurately, thereby obtaining the criminal record of the criminal user.

[0096] In an optional implementation of this embodiment, the target device data includes an image, text or audio;

[0097] Correspondingly, the target device data extraction module 310 is specifically used to traverse each application of the target electronic device, extract image data, text data or audio data in each application, and obtain each target device data.

[0098] In an optional implementation of this embodiment, the mnemonic sequence generation module 320 is specifically used to identify the image data to obtain at least one text information;

[0099] Alternatively, extracting the text data to obtain at least one item of text information;

[0100] Alternatively, semantic understanding is performed on the audio data to obtain at least one item of text information;

[0101] Keyword retrieval is performed on each of the text information to obtain each target text information, and regular expression matching is performed on each of the target text information to obtain at least one mnemonic word sequence.

[0102] In an optional implementation of this embodiment, the verification module 330 is specifically used to determine the number of mnemonics included in the first mnemonic sequence, and if it is determined that the number does not meet the preset number requirement, perform mnemonic completion or mnemonic filtering processing on the first mnemonic sequence to obtain a reference mnemonic sequence;

[0103] Alternatively, if it is determined that the number of mnemonics in the second mnemonic sequence meets the preset number requirement, but the order of the mnemonics does not meet the preset order requirement, then reorder the mnemonics in the second mnemonic sequence to obtain a reference mnemonic sequence;

[0104] Each of the reference mnemonics is verified based on the BIP39 standard to determine whether each of the reference mnemonics sequences meets the BIP39 standard.

[0105] In an optional implementation of this embodiment, the wallet address generation module 340 of the virtual currency wallet is specifically used to determine at least one reference information matching the target reference mnemonic sequence, and generate each wallet address of the virtual currency wallet matching the target reference mnemonic sequence based on each reference information;

[0106] The reference information includes: type, node, derivation standard and derivation path of virtual currency.

[0107] In an optional implementation of this embodiment, the target wallet address determination module 350 is specifically used to compare each wallet address of the virtual currency wallet with each target wallet address recorded in the blockchain network, and determine the target wallet address according to the comparison result;

[0108] The target wallet address is a traded address stored in the blockchain network.

[0109] In an optional implementation of this embodiment, the target wallet address determination module 350 is further specifically used to determine each virtual currency transaction record implemented based on the target wallet address;

[0110] Transaction content matching each of the virtual currency transaction records is determined, and the criminal record of the target criminal user is determined based on the transaction content.

[0111] The virtual currency wallet evidence collection device provided in the embodiment of the present invention can execute the virtual currency wallet evidence collection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0112] In the technical solutions of the embodiments of the present invention, the collection, storage, use, processing, transmission, provision and disclosure of user personal information are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0113] Embodiment 4

[0114] Figure 4 The present invention is a block diagram of an electronic device 10 that can be used to implement an embodiment of the present invention. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0115] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0116] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0117] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a virtual currency wallet forensics method, the method comprising: obtaining a target electronic device and extracting at least one target device data from the target electronic device; wherein the target electronic device is a terminal device used by a target criminal user; extracting text information of each of the target device data, and generating at least one mnemonic sequence based on each of the text information; generating a reference mnemonic sequence based on each of the mnemonic sequences, and verifying each of the reference mnemonic sequences; generating at least one virtual currency wallet wallet address matching the target reference mnemonic sequence when the target reference mnemonic sequence is verified; determining a target wallet address based on each of the wallet addresses of the virtual currency wallet, and obtaining the criminal record of the target criminal user based on the target wallet address.

[0118] In some embodiments, the forensic method of a virtual currency wallet may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the forensic method of the virtual currency wallet described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the forensic method of the virtual currency wallet in any other appropriate manner (e.g., by means of firmware).

[0119] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0120] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0121] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0122] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0123] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0124] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0125] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0126] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for obtaining evidence of a virtual currency wallet, characterized in that: include: Acquire a target electronic device, and extract at least one target device data from the target electronic device; wherein the target electronic device is a terminal device used by a target criminal user; Extracting text information of each of the target device data, and generating at least one mnemonic sequence based on each of the text information; Generating a reference mnemonic sequence according to each of the mnemonic sequences, and verifying each of the reference mnemonic sequences; If the target reference mnemonic sequence passes verification, generating a wallet address of at least one virtual currency wallet matching the target reference mnemonic sequence; A target wallet address is determined according to each wallet address of the virtual currency wallet, and a criminal record of the target criminal user is obtained based on the target wallet address.

2. The virtual currency wallet evidence collection method according to claim 1, characterized in that: The target device data includes images, text or audio; Accordingly, extracting at least one target device data from the target electronic device includes: Traverse each application of the target electronic device, extract image data, text data or audio data in each application, and obtain each target device data.

3. The virtual currency wallet evidence collection method according to claim 2, characterized in that: Extracting text information of each target device data, and generating at least one mnemonic sequence based on each text information, including: Recognize the image data to obtain at least one item of text information; Alternatively, extracting the text data to obtain at least one item of text information; Alternatively, semantic understanding is performed on the audio data to obtain at least one item of text information; Keyword retrieval is performed on each of the text information to obtain each target text information, and regular expression matching is performed on each of the target text information to obtain at least one mnemonic word sequence.

4. The virtual currency wallet evidence collection method according to claim 1, characterized in that: The step of generating a reference mnemonic sequence according to each of the mnemonic sequences and verifying each of the reference mnemonic sequences comprises: Determining the number of mnemonics included in the first mnemonic sequence, and if it is determined that the number does not meet a preset number requirement, performing mnemonic completion or mnemonic filtering processing on the first mnemonic sequence to obtain a reference mnemonic sequence; Alternatively, if it is determined that the number of mnemonics in the second mnemonic sequence meets the preset number requirement, but the order of the mnemonics does not meet the preset order requirement, then reorder the mnemonics in the second mnemonic sequence to obtain a reference mnemonic sequence; Each of the reference mnemonics is verified based on the BIP39 standard to determine whether each of the reference mnemonics sequences meets the BIP39 standard.

5. The virtual currency wallet evidence collection method according to claim 1, characterized in that: The generating of the wallet address of at least one virtual currency wallet matching the target reference mnemonic sequence comprises: Determine at least one reference information matching the target reference mnemonic sequence, and generate wallet addresses of virtual currency wallets matching the target reference mnemonic sequence based on each of the reference information; The reference information includes: type, node, derivation standard and derivation path of virtual currency.

6. The virtual currency wallet evidence collection method according to claim 1, characterized in that: The determining the target wallet address according to each wallet address of the virtual currency wallet comprises: Compare each wallet address of the virtual currency wallet with each target wallet address recorded in the blockchain network, and determine the target wallet address according to the comparison result; The target wallet address is a traded address stored in the blockchain network.

7. The virtual currency wallet evidence collection method according to claim 1, characterized in that: The obtaining the criminal record of the target criminal user based on the target wallet address includes: Determine each virtual currency transaction record implemented based on the target wallet address; Transaction content that matches each of the virtual currency transaction records is determined, and the criminal record of the target criminal user is determined based on the transaction content.

8. A virtual currency wallet evidence collection device, characterized in that: include: A target device data extraction module, used to obtain a target electronic device and extract at least one target device data from the target electronic device; wherein the target electronic device is a terminal device used by a target criminal user; a mnemonic sequence generation module, configured to extract text information of each target device data and generate at least one mnemonic sequence based on each text information; A verification module, used to generate a reference mnemonic sequence according to each of the mnemonic sequences, and verify each of the reference mnemonic sequences; A wallet address generation module for a virtual currency wallet, configured to generate a wallet address of at least one virtual currency wallet matching the target reference mnemonic sequence when the target reference mnemonic sequence is verified; The target wallet address determination module is used to determine the target wallet address according to the wallet addresses of the virtual currency wallet, and obtain the criminal record of the target criminal user based on the target wallet address.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the virtual currency wallet forensics method described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the virtual currency wallet forensics method described in any one of claims 1-7 when executed.

Images