Judicial compliance verification method for electronic data forensics environment

Abstract

The invention discloses a judicial compliance verification method for an electronic data evidence obtaining environment, and the method is characterized in that the method comprises the following steps: S100, network connection state detection: judging whether the network connection state of the electronic data evidence obtaining environment is normal or not, if yes, executing the step S200, and if not, executing the step S500; s200, DNS hijacking detection: judging whether the DNS of the electronic data evidence obtaining environment is hijacked or not, if yes, executing the step S500, and if not, executing the step S300; s300, virus detection: judging whether the computer terminal for electronic data evidence collection is infected by viruses or not, if so, executing the step S400, and otherwise, executing the step S500; the step S300 comprises the following steps: S400: detection of time calibration: judging whether a computer end clock for electronic data evidence collection is synchronous or not, if so, executing the step S600, and otherwise, executing the step S500; s500, when judicial compliance verification is abnormal, detection is terminated, the reason of verification abnormity is output, and the process is ended; and S600, if judicial compliance verification is normal, ending the process.

Description

Technical Field

[0001] The invention belongs to the field of electronic data forensics and relates to a judicial compliance verification method for an electronic data forensics environment. Background Art

[0002] Electronic data forensics refers to the use of technology to obtain, preserve, analyze and present electronic data for use as evidence in legal proceedings, investigations or other legal proceedings. When conducting electronic data forensics, it is crucial to ensure legal compliance, which means that relevant laws, regulations and judicial procedures must be followed to ensure that the evidence obtained is valid and legal in court.

[0003] In the prior art, electronic data compliance detection has the following disadvantages:

[0004] 1. Manual and subjective: The original compliance verification is usually carried out manually, requiring manual review of documents, records and processes. This method is subjective and easily influenced by personal experience and judgment, resulting in less objective and consistent results.

[0005] 2. Inefficiency: Since compliance verification is done manually, it takes a lot of human resources and time. For large organizations or complex compliance requirements, manual verification is often inefficient and difficult to meet real-time and timely requirements.

[0006] 3. Error-prone: Manual compliance verification is prone to errors, especially when a large amount of documents and data need to be reviewed. People’s attention and energy are limited, and they are prone to missing or misjudging some important information, resulting in compliance issues not being discovered or handled in a timely manner.

[0007] 4. Lack of standardization and automation: The existing compliance verification usually lacks standardized processes and specifications, which easily leads to inconsistent or incomparable verification results. At the same time, due to the lack of support from automated tools, it is impossible to achieve automation and continuous monitoring of compliance verification.

[0008] 5. High cost: The original compliance verification is often costly because it requires a lot of human resources and time for manual verification. Especially when compliance verification is carried out for a long time or frequently, the cost will increase further, which will burden the organization's resources.

[0009] Therefore, new technologies and methods, such as automated tools, intelligent algorithms and data analysis, are needed to improve the efficiency, accuracy and sustainability of compliance verification in existing technologies. Summary of the invention

[0010] The present invention aims at the deficiencies of the prior art and provides a method for verifying the judicial compliance of an electronic data forensics environment. The method realizes efficient, low-cost, high-accuracy and sustainable verification of the judicial compliance of an electronic data forensics environment through network connection status detection, DNS hijacking detection, virus detection and time calibration detection, and includes the following steps:

[0011] S100: Network connection status detection: determine whether the network connection status of the electronic data forensics environment is normal, if yes, execute step S200, otherwise, execute step S500;

[0012] S200: DNS hijacking detection: determine whether the DNS of the electronic data forensics environment is hijacked, if yes, execute step S500, otherwise, execute step S300;

[0013] S300: Virus detection: Determine whether the computer terminal of the electronic data forensics is infected by a virus. If yes, execute step S400; otherwise, execute step S500. Step S300 includes the following steps:

[0014] S301: using the system API to execute a system command to query service information and obtain the installation path of the antivirus software;

[0015] S302: using the system API to start the main program of the antivirus software under the installation path;

[0016] S303: Using a screenshot tool to screenshot the virus detection area included in the homepage of the antivirus software;

[0017] S304: Use Sikuli to match the virus detection area of ​​the computer page to determine whether the match is successful. If so, execute step S305; otherwise, execute step S500;

[0018] S305: Use Sikuli to simulate clicking on the virus killing area on the computer, use a screenshot tool to screenshot the quick killing area contained in the antivirus software page, and use Sikuli to match the quick killing area on the computer page to determine whether the match is successful. If so, execute step S306, otherwise, execute step S500;

[0019] S306: using Sikuli to simulate clicking on the quick scan area on the computer, using a screenshot tool to screenshot the area being quickly scanned contained in the antivirus software page, and using Sikuli to match the area being quickly scanned on the computer page to determine whether the match is successful. If so, executing step S306, otherwise, executing step S307;

[0020] S307: Using a screenshot tool to take a screenshot of the area on the computer page where no risk is found in this scan, and using Sikuli to match the area on the computer page where no risk is found in this scan, to determine whether the match is successful. If so, executing step S400, otherwise, executing step S500;

[0021] S400: Time calibration detection: determine whether the clock of the computer terminal of the electronic data forensics is synchronized, if yes, execute step S600, otherwise, execute step S500;

[0022] S500: If the judicial compliance check is abnormal, the check is terminated and the reason for the abnormal check is output, and the process ends;

[0023] S600: Judicial compliance verification is normal, and the process ends.

[0024] Preferably, step S100 includes the following steps:

[0025] S101: configuring a test website list used for network connection status detection;

[0026] S102: For a website in the test website list, a threshold value of the number of ping successes is set to N, where N is a natural number not less than 2;

[0027] S103: traverse each URL in the URL list, and for each URL, use the system API to execute a ping command respectively and record the number of ping successes to test the network connectivity and network connection speed;

[0028] S104: Determine whether the number of ping successes is not less than N. If so, execute step S200; otherwise, execute step S500.

[0029] Preferably, step S200 includes the following steps:

[0030] S201: configuring multiple domain names and their corresponding IP addresses used for DNS hijacking detection, and configuring them as a domain name list, obtaining the first domain name in the domain name list as the current domain name, wherein the domain names are not less than 3;

[0031] S202: Configure multiple domain name resolution servers and set them as a DNS list, and obtain the first DNS in the DNS list as the current DNS, wherein the number of DNS is no less than 3;

[0032] S203: For each website in the domain name list, a threshold value of the number of times that the domain name has not been hijacked by the DNS is set to M, where M is an integer and its initial value is 0;

[0033] S204: For each DNS in the DNS list, a threshold value of the number of times that a domain name has not been hijacked by the DNS is set to K, where K is an integer and its initial value is 0;

[0034] S205: adopt the current DNS in the DNS list and resolve the current domain name in the domain name list;

[0035] S206: Determine whether the IP address of the current domain name resolved by the current DNS is consistent with the IP address corresponding to the current domain name in the domain name list. If yes, execute step S207; otherwise, execute step S208;

[0036] S207: The threshold K is incremented by 1 to determine whether K is greater than 3. If so, execute step S209; otherwise, execute step S208.

[0037] S208: Get the next DNS in the DNS list and execute step S205;

[0038] S209: The threshold M is incremented by 1 to determine whether M is greater than 2. If so, execute step S20B; otherwise, execute step S20A.

[0039] S20A: Get the next domain name in the domain name list and the first DNS in the DNS list, and execute step S205;

[0040] S20B: If the DNS hijacking detection result is normal, execute step S300.

[0041] Preferably, the system API command nslookup is used to resolve the domain name.

[0042] Preferably, step S400 includes the following steps:

[0043] S401: Select an NTP server;

[0044] S402: Start the time synchronization service of the computer terminal for electronic data forensics;

[0045] S403: Setting and synchronizing / updating the time service of the computer terminal of the electronic data forensics, so as to synchronize / update the clock of the computer terminal of the electronic data forensics with the NTP server;

[0046] S404: Analyze the response result of step S403 to determine whether the computer side of the electronic data forensics is synchronized / updated successfully. If yes, execute step S600; otherwise, execute step S500.

[0047] The beneficial effects of the present invention are:

[0048] 1. Improve efficiency: Automated compliance verification can greatly improve efficiency and save human resources and time. Compared with manual verification, automated tools can quickly scan and analyze large amounts of documents, records, and data to achieve rapid compliance assessment and inspection.

[0049] 2. Reduce errors: Automated compliance verification can reduce the incidence of human errors. Automated tools can accurately execute predefined rules and policies, avoid human subjective judgment and misoperation, and improve the accuracy and reliability of compliance verification.

[0050] 3. Continuous monitoring: Automated compliance verification can achieve continuous monitoring and real-time inspection. By running automated tools regularly or continuously, compliance issues and violations can be discovered in a timely manner, reducing potential risks and losses.

[0051] 4. Standardization and consistency: Automated compliance verification can achieve standardized processes and consistent results. Through unified rules and standards, it can ensure that different compliance checks have consistent standards and results, which is convenient for comparison and analysis.

[0052] 5. Reduce costs: Compared with manual verification, automated verification can greatly reduce costs, saving human resources and time costs, and reducing additional costs caused by human errors.

[0053] 6. Comprehensive protection: Comprehensively guarantee the security and reliability of the indoor network. Monitor and protect different aspects of network security to make the entire network system more robust and secure.

[0054] 7. Real-time and automation: It can monitor and detect network status, DNS hijacking, virus attacks and other problems in real time, and can automatically trigger alarms and countermeasures. This real-time and automation greatly improves the response speed and accuracy of network security incidents and reduces the need for human intervention.

[0055] 8. Multi-level protection: Monitor and protect the network from different angles. Network connection status detection focuses on the online status of network devices, DNS hijacking detection focuses on the legitimacy of DNS queries, virus detection focuses on the intrusion of malware, and time calibration ensures the accuracy of the system clock. This multi-level protection strategy can improve overall security.

[0056] 9. Targeted defense: Targeted defense against different threats to network security. For example, network connection status detection monitors the connectivity of network devices, DNS hijacking detection focuses on detecting whether DNS queries have been tampered with, and virus detection focuses on whether there is malware in the network. This targeted defense makes network security strategies more refined and efficient.

[0057] 10. Improved overall security: Through real-time monitoring, automated response, multi-level protection and targeted defense, these technologies work together on the indoor network system to improve the overall security and reliability, and ensure the normal operation of the monitoring system and the security of data. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 is a flow chart of the present invention;

[0059] Figure 2 A flowchart of DNS hijacking detection in an embodiment of the present invention;

[0060] Figure 3 Flow chart of virus detection in an embodiment of the present invention. DETAILED DESCRIPTION

[0061] The reference terms of the present invention are as follows:

[0062] API: Application Programming Interface (API) is a set of predefined functions that aims to provide applications and developers with the ability to access a set of routines based on certain software or hardware without having to access the source code or understand the details of the internal working mechanism.

[0063] nslookup: is a network management command line tool that can be used to query DNS domain names and IP addresses.

[0064] Sikuli: Sikuli is a novel graphical scripting language designed by researchers at MIT. Computer users only need to have basic programming skills (such as being able to write print "hello world"). They do not need to write lines of code, but can use screenshots to combine the captured graphic elements to create magical programs.

[0065] Huorong is a security software that integrates anti-virus, prevention and control, with products for individuals and enterprises. It has a simple interface, rich functions and a good experience. Especially in response to domestic security trends, it independently develops a high-performance anti-virus engine, which was created by former core R&D members of Rising and has many years of network security experience.

[0066] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0067] like Figure 1 As shown, the method of the present invention comprises the following steps:

[0068] S100: Network connection status detection: determine whether the network connection status of the electronic data forensics environment is normal, if yes, execute step S200, otherwise, execute step S500;

[0069] Step S100 includes the following steps:

[0070] S101: configuring a test website list used for network connection status detection;

[0071] In this embodiment, the test website is www.baidu.com, www.taobao.com, www.tencent.com, etc.

[0072] It should be understood that the test website is a relatively popular website, such as a mainstream portal website and some other portal websites, such as Phoenix.com, People.cn, etc., as long as it is a website that can be normally accessed, and is not limited to the website used in this embodiment.

[0073] S102: For a website in the test website list, a threshold value of the number of ping successes is set to N, where N is a natural number not less than 2;

[0074] S103: Traverse each URL in the URL list, that is, www.baidu.com, www.taobao.com, www.tencent.com, etc. For each URL, use the system API to execute the ping command and record the number of ping successes to test the network connectivity and network connection speed; if the response result is "the request cannot find the host", it will not be recorded as the number of ping successes.

[0075] S104: Determine whether the number of ping successes is not less than N. If so, execute step S200; otherwise, execute step S500.

[0076] S200: DNS hijacking detection: determine whether the DNS of the electronic data forensics environment is hijacked, if yes, execute step S500, otherwise, execute step S300;

[0077] Figure 2 FIG. 4 is a flowchart of DNS hijacking detection in an embodiment of the present invention. Figure 2 As shown, step S200 includes the following steps:

[0078] S201: configuring multiple domain names and their corresponding IP addresses used for DNS hijacking detection, and configuring them as a domain name list, obtaining the first domain name in the domain name list as the current domain name, wherein the domain names are not less than 3;

[0079] In this embodiment, the selected domain names are baidu.com 110.242.68.66, taobao.com 106.11.226.158 and tencent.com 109.244.194.121. The domain names and their corresponding IP addresses are configured as a domain name list, and the first domain name in the domain name list is obtained as the current domain name.

[0080] It should be understood that any domain name of a website that can be normally accessed is acceptable and is not limited to the domain name used in this embodiment.

[0081] S202: configuring multiple domain name resolution servers (ie, DNS) and setting them as a DNS list, obtaining the first DNS in the DNS list as the current DNS, wherein the number of DNS is no less than 3;

[0082] In this embodiment, the domain name resolution server selected is 114's DNS, whose IP addresses are 114.114.144.114 and 114.114.115.115, Google's DNS, whose IP addresses are 8.8.8.8 and 8.8.4.4, and Alibaba's DNS, whose IP addresses are 223.5.5.5 and 223.6.6.6.

[0083] It should be understood that any DNS that can be used normally is acceptable and is not limited to the DNS used in this embodiment.

[0084] S203: For each website in the domain name list, a threshold value of the number of times that the domain name has not been hijacked by the DNS is set to M, where M is an integer and its initial value is 0;

[0085] S204: For each DNS in the DNS list, a threshold value of the number of times that a domain name has not been hijacked by the DNS is set to K, where K is an integer and its initial value is 0;

[0086] S205: adopt the current DNS in the DNS list and resolve the current domain name in the domain name list;

[0087] In this embodiment, the system API command nslookup is used to resolve the domain name. For example,

[0088] nslookup baidu.com 114.114.114.114, the response result is:

[0089] Server:public1.114dns.com

[0090] Address:114.114.114.114

[0091] Non-authoritative response:

[0092] Name: baidu.com

[0093] Addresses:110.242.68.66 39.156.66.10

[0095] It can be seen that the DNS 114.114.114.114 is selected to resolve the domain name baidu.com, and one of the Addresses in the result 110.242.68.66 matches the baidu.com110.242.68.66 in the domain name list, and so on.

[0096] S206: Determine whether the IP address of the current domain name resolved by the current DNS is consistent with the IP address corresponding to the current domain name in the domain name list. If yes, execute step S207; otherwise, execute step S208;

[0097] S207: The threshold K is incremented by 1 to determine whether K is greater than 3. If so, execute step S209; otherwise, execute step S208.

[0098] S208: Get the next DNS in the DNS list and execute step S205;

[0099] S209: The threshold M is incremented by 1 to determine whether M is greater than 2. If so, execute step S20B; otherwise, execute step S20A.

[0100] S20A: Get the next domain name in the domain name list and the first DNS in the DNS list, and execute step S205;

[0101] In other words, for the same domain name, if three DNS resolutions are normal, the next domain name is obtained and resolution and detection are started from the first DNS.

[0102] S20B: If the DNS hijacking detection result is normal, execute step S300.

[0103] S300: Virus detection: determine whether the computer terminal of the electronic data forensics is infected by a virus. If yes, execute step S400; otherwise, execute step S500;

[0104] Figure 3 FIG. 2 shows a flow chart of virus detection in an embodiment of the present invention. Figure 3 As shown, step S300 includes the following steps:

[0105] In this embodiment, Huorong computer antivirus software is selected as an embodiment of virus detection.

[0106] S301: Use system API to execute system commands to query service information and obtain the installation path of Huorong antivirus software;

[0107] In this embodiment, the system API is used to execute the wmic service where "caption = 'HuorongInternet Security Daemon'" get caption, state, PathName command to query the service information to obtain the installation path of Huorong.

[0108] S302: Using the system API, start the main program of the Huorong antivirus software in the installation path;

[0109] In this embodiment, the system API is used to start Huorong, and the system API is: Huorong installation path\HipsMain.exe, where HipsMain.exe is the main program of Huorong antivirus software.

[0110] S303: Using a screenshot tool to screenshot the “Virus Scanning” area included in the homepage of the Huorong antivirus software;

[0111] S304: Use Sikuli to match the "virus detection" area of ​​the computer page to determine whether the match is successful. If so, execute step S305; otherwise, execute step S500;

[0112] S305: Use Sikuli to simulate clicking the "Virus Killing" area on the computer; use a screenshot tool to screenshot the "Quick Killing" area contained in the Huorong antivirus software page, and use Sikuli to match the "Quick Killing" area on the computer page to determine whether the match is successful. If so, execute step S306, otherwise, execute step S500;

[0113] S306: Use Sikuli to simulate clicking the "Quick Scan" area on the computer; use a screenshot tool to screenshot the "Quick Scan in Progress" area contained in the Huorong antivirus software page, and use Sikuli to match the "Quick Scan in Progress" area on the computer page to determine whether the match is successful. If so, execute step S306, otherwise, execute step S307;

[0114] S307: Use a screenshot tool to capture the area "No risk found in this scan" contained in the computer page, and use Sikuli to match the area "No risk found in this scan" contained in the computer page to determine whether the match is successful. If so, it means that no virus is scanned, and step S400 is executed. Otherwise, step S500 is executed.

[0115] S400: Time calibration detection: determine whether the clock of the computer terminal of the electronic data forensics is synchronized, if yes, execute step S600, otherwise, execute step S500;

[0116] Step S400 includes the following steps:

[0117] S401: Select an NTP server;

[0118] For example, you can choose time.windows.com of Microsoft NTP server, ntp.ntsc.ac.cn of National Time Service Center NTP server, ntp.aliyun.com of Alibaba Cloud NTP server, or build an NTP server yourself.

[0119] S402: Start the time synchronization service of the computer terminal for electronic data forensics;

[0120] In this embodiment, net start "windows time" is used to start the time synchronization service on the computer side of electronic data forensics;

[0121] S403: Setting and synchronizing / updating the time service of the computer terminal of the electronic data forensics, so as to synchronize / update the clock of the computer terminal of the electronic data forensics with the NTP server;

[0122] In this embodiment, w32tm / config / manualpeerlist:ntp.aliyun.com / syncfromflags:manual / update is used to synchronize / update the clock of the computer used for electronic data forensics with the Alibaba Cloud NTP server ntp.aliyun.com.

[0123] S404: Analyze the response result of step S403 to determine whether the computer side of the electronic data forensics is synchronized / updated successfully. If yes, execute step S600; otherwise, execute step S500.

[0124] Parse the response data. If the response result contains "The command was successfully executed", it means that the local time synchronization is successful.

[0125] S500: If the judicial compliance check is abnormal, the check is terminated and the reason for the abnormal check is output, and the process ends;

[0126] S600: Judicial compliance verification is normal, and the process ends.

[0127] The method provided by the present invention solves the technical problem that there is no judicial compliance verification method for an electronic data forensics environment in the prior art.

[0128] It should be understood that the present invention is not limited to the above examples. For those skilled in the art, improvements or changes can be made based on the above description. All these improvements and changes should fall within the scope of protection of the claims attached to the present invention.

Claims

1. A judicial compliance verification method for an electronic data forensics environment, characterized in that The following steps are involved: S100: Network connection status detection: determine whether the network connection status of the electronic data forensics environment is normal, if yes, execute step S200, otherwise, execute step S500; S200: DNS hijacking detection: determine whether the DNS of the electronic data forensics environment is hijacked, if yes, execute step S500, otherwise, execute step S300; S300: Virus detection: Determine whether the computer terminal of the electronic data forensics is infected by a virus. If yes, execute step S400; otherwise, execute step S500. Step S300 includes the following steps: S301: using the system API to execute a system command to query service information and obtain the installation path of the antivirus software; S302: using the system API to start the main program of the antivirus software under the installation path; S303: Using a screenshot tool to screenshot the virus detection area included in the homepage of the antivirus software; S304: Use Sikuli to match the virus detection area of ​​the computer page to determine whether the match is successful. If so, execute step S305; otherwise, execute step S500; S305: Use Sikuli to simulate clicking on the virus killing area on the computer, use a screenshot tool to screenshot the quick killing area contained in the antivirus software page, and use Sikuli to match the quick killing area on the computer page to determine whether the match is successful. If so, execute step S306, otherwise, execute step S500; S306: using Sikuli to simulate clicking on the quick scan area on the computer, using a screenshot tool to screenshot the area being quickly scanned contained in the antivirus software page, and using Sikuli to match the area being quickly scanned on the computer page to determine whether the match is successful. If so, executing step S306, otherwise, executing step S307; S307: Using a screenshot tool to take a screenshot of the area on the computer page where no risk is found in this scan, and using Sikuli to match the area on the computer page where no risk is found in this scan, to determine whether the match is successful. If so, executing step S400, otherwise, executing step S500; S400: Time calibration detection: determine whether the clock of the computer terminal of the electronic data forensics is synchronized, if yes, execute step S600, otherwise, execute step S500; S500: If the judicial compliance check is abnormal, the check is terminated and the reason for the abnormal check is output, and the process ends; S600: Judicial compliance verification is normal, and the process ends.

2. A judicial compliance verification method for an electronic data forensics environment according to claim 1, characterized in that: Step S100 includes the following steps: S101: configuring a test website list used for network connection status detection; S102: For a website in the test website list, a threshold value of the number of ping successes is set to N, where N is a natural number not less than 2; S103: traverse each URL in the URL list, and for each URL, use the system API to execute a ping command respectively and record the number of ping successes to test the network connectivity and network connection speed; S104: Determine whether the number of ping successes is not less than N. If so, execute step S200; otherwise, execute step S500.

3. A judicial compliance verification method for an electronic data forensics environment according to claim 1, characterized in that: Step S200 includes the following steps: S201: configuring multiple domain names and their corresponding IP addresses used for DNS hijacking detection, and configuring them into a domain name list, obtaining the first domain name in the domain name list as the current domain name, wherein the domain names are not less than 3; S202: Configure multiple domain name resolution servers and set them as a DNS list, and obtain the first DNS in the DNS list as the current DNS, wherein the number of DNS is no less than 3; S203: For each website in the domain name list, a threshold value of the number of times that the domain name has not been hijacked by the DNS is set to M, where M is an integer and its initial value is 0; S204: For each DNS in the DNS list, a threshold value of the number of times that a domain name has not been hijacked by the DNS is set to K, where K is an integer and its initial value is 0; S205: adopt the current DNS in the DNS list and resolve the current domain name in the domain name list; S206: Determine whether the IP address of the current domain name resolved by the current DNS is consistent with the IP address corresponding to the current domain name in the domain name list. If yes, execute step S207; otherwise, execute step S208; S207: The threshold K is incremented by 1 to determine whether K is greater than 3. If so, execute step S209; otherwise, execute step S208; S208: Get the next DNS in the DNS list and execute step S205; S209: The threshold M is incremented by 1 to determine whether M is greater than 2. If so, execute step S20B; otherwise, execute step S20A. S20A: Get the next domain name in the domain name list and the first DNS in the DNS list, and execute step S205; S20B: If the DNS hijacking detection result is normal, execute step S300.

4. A judicial compliance verification method for an electronic data forensics environment according to claim 3, characterized in that: Use the system API command nslookup to resolve the domain name.

5. The judicial compliance verification method of an electronic data forensics environment according to claim 1 is characterized in that: Step S400 includes the following steps: S401: Select an NTP server; S402: Start the time synchronization service of the computer terminal for electronic data forensics; S403: Setting and synchronizing / updating the time service of the computer terminal of the electronic data forensics, so as to synchronize / update the clock of the computer terminal of the electronic data forensics with the NTP server; S404: Analyze the response result of step S403 to determine whether the computer side of the electronic data forensics is synchronized / updated successfully. If yes, execute step S600; otherwise, execute step S500.

Images