A method and system for generating forensic analysis plug-in based on large model

Abstract

The present application relates to a method and system for generating a forensic analysis plug-in based on a large model, which belongs to the technical field of forensic analysis, and comprises the following steps: obtaining a file to be collected for evidence and performing file format recognition, preprocessing and structural feature extraction, wherein the structural features include: structural complexity, field type distribution, field naming rules and file size and data volume; constructing a forensic intelligent prompt word framework based on the task requirements of the forensic analysis plug-in generation and the structural features of the file to be collected for evidence; selecting an adapted large model based on the structural features of the file to be collected for evidence, and using the structural features of the file to be collected for evidence and the forensic intelligent prompt word framework as inputs of the selected large model, wherein the selected large model outputs a forensic analysis plug-in code snippet according to the forensic requirements; integrating the generated code snippet into a complete forensic analysis plug-in code through a code merging tool, and verifying the forensic analysis plug-in using a plug-in platform, and deploying and applying the verified forensic analysis plug-in.

Description

Technical Field

[0001] The present application relates to the technical field of forensic analysis, and more specifically, to a method and system for generating a forensic analysis plug-in based on a large model. Background Art

[0002] In the current forensic analysis work, plug-in development faces problems such as slow iteration speed and complex development process. In the traditional way, both simple and complex plug-ins rely on manual coding, which is not only inefficient, but also difficult to ensure the standardization and maintainability of the code. At the same time, when faced with new forensic needs, it often takes nearly a week from R&D research to plug-in launch, which seriously affects the timeliness of forensic work. In addition, when parsing data related to illegal Internet applications, traditional methods require searching and interpreting the meaning of fields one by one, which is inefficient and difficult to guarantee accuracy.

[0003] Prior art, such as the Chinese patent application with publication number "CN116991369A", discloses a forensics system and method based on a large language model, which includes: a training library, a forensics solution library, a language model, a problem library, and a forensics script generation module. The invention pre-configures a training library for maintaining solutions to forensics problems, and trains the language model according to the solutions in the training library, inputs the user's problem into the trained language model, generates a corresponding forensics script, and stores the generated forensics script in the forensics solution library, and finally outputs the generated forensics script to the user to solve the forensics problem. It can not only automatically generate an effective forensics script based on the forensics problem input by the user, but also, by maintaining the user's problem and the corresponding solution, it can help the forensics tool understand the user's problem and select the most suitable solution, thereby generating an effective forensics script, which can better adapt to various forensics scenarios and needs.

[0004] The problem with the above-mentioned prior art is that this method directly generates a forensic script based on user questions through a large language model, which has application limitations for forensic data of different format types and requirements, and lacks flexibility in the selection of a large language model and the determination of a forensic script, which may affect the actual effect of forensics. Summary of the invention

[0005] In order to solve the above technical problems, the present invention proposes a method and system for generating a forensic analysis plug-in based on a large model.

[0006] The technical solution of the present invention is as follows:

[0007] The present invention proposes a method for generating a forensic analysis plug-in based on a large model, comprising the following steps:

[0008] Step S1, obtaining the file to be forensically collected and performing file format recognition, preprocessing and structural feature extraction. The structural features include: structural complexity, field type distribution, field naming rules, file size and data volume;

[0009] Step S2, based on the task requirements generated by the forensic analysis plug-in and the structural characteristics of the file to be forensically collected, a framework of intelligent prompt words for forensics is constructed, and the framework of intelligent prompt words for forensics includes: role setting, target description, skill assignment, restriction conditions and learning sample design;

[0010] Step S3, selecting an adaptive large model based on the structural features of the file to be collected, and taking the structural features of the file to be collected and the intelligent prompt word framework for evidence collection as inputs of the selected large model, and the selected large model outputs a forensic analysis plug-in code snippet according to the evidence collection requirements;

[0011] Step S4, integrating the generated code snippets into a complete forensic analysis plug-in code through a code merging tool, and verifying the forensic analysis plug-in using a plug-in platform, and deploying the verified forensic analysis plug-in for application.

[0012] As a preferred implementation, in the step of obtaining the file to be collected and performing file format identification and preprocessing, the step of performing file format identification includes:

[0013] Identify common text, database files, binary data and unconventional data formats by analyzing the header bytes and content features of the files to be forensically collected;

[0014] In the preprocessing step, for ordinary text and database files, the forensic related content is directly obtained through text editors and corresponding database management tools;

[0015] For unconventional data formats, they are converted into JSON format based on regular expression field mapping rules. The conversion process follows the consistency principle of data structure and semantics.

[0016] For binary data, key information is extracted based on the type and application scenario of the binary data and converted into a standard readable text format.

[0017] As a preferred implementation, the method of obtaining the file to be forensically collected and performing file format recognition, preprocessing and structural feature extraction, wherein the feature extraction step includes:

[0018] Extract structural complexity features and use the nested level depth as the structural complexity indicator. The specific formula is:

[0019] ;

[0020] Where: The complexity characteristics of the structure of the document to be collected; is the nesting depth of the i-th layer in the forensic file; n is the total number of nested layers in the forensic file;

[0021] Extract the type distribution characteristics of the field. The specific formula is:

[0022] ;

[0023] Where: is the type distribution characteristic of the field; is the frequency of occurrence of the mth data type; N is the total number of fields; M is the total number of data types;

[0024] Extract the regular features of field naming. The specific formula is:

[0025] ;

[0026] Where: Name the regular features for the fields; is the naming length of the xth field; is the degree of match between the xth field and the naming pattern; X is the total number of fields;

[0027] Extract file size and data volume features. The specific formula is:

[0028] ;

[0029] Where: The size and data volume characteristics of the file to be collected; is the byte size of the file to be forensically collected; is the number of records in the file to be collected.

[0030] As a preferred implementation, in the step of constructing a forensic intelligent prompt word framework:

[0031] Role setting is used to determine professional roles according to the type of files to be collected, and locate the processing perspective of the selected large model;

[0032] The goal description is used to formulate the task objectives and guide the selected large model to generate effective code for extracting and processing data and following the example framework;

[0033] Skills empowerment is used to empower general and professional skill sets, giving selected large models the ability to parse data and write qualified codes;

[0034] Constraints are used to impose multiple restriction rules on the selected large model, and each restriction rule is used to regulate the code structure, security and compatibility;

[0035] The learning sample design is used to guide the selected large model to learn the standardized code logic and framework.

[0036] As a preferred implementation, in the step of selecting an adaptive large model based on the structural features of the file to be forensically collected, the adaptive large model is selected by a feature matching function; the feature matching function is specifically:

[0037] ;

[0038] Where: is the feature matching result; is the weight of the pth node in the decision tree; is the value of the qth feature in the document to be forensically collected; is the time trend factor; is the time trend weight; is the user feedback factor; is the user feedback weight; P is the total number of nodes in the decision tree.

[0039] As a preferred implementation, the step of verifying the forensic analysis plug-in using the plug-in platform includes: functional integrity verification, code stability verification and data accuracy verification; wherein:

[0040] The specific formula for functional integrity verification is:

[0041] ;

[0042] Where: It is a function for functional integrity verification; F is a set of functions that the large model generation plug-in should implement; The verification function of the bth function that the large model generation plug-in should implement; l is the input test data set; B is the total number of functions that the large model generation plug-in should implement;

[0043] The specific formula for code stability verification is:

[0044] ;

[0045] Where: Score code stability; is the jth stability test result; is the mean of the stability test results; J is the total number of stability tests;

[0046] The specific formula for data accuracy verification is:

[0047]

[0048] Where: A(O,C) is the accuracy verification result; O is the selected large model output plug-in data set is the kth data value of the selected large model output plug-in data set; K is the total number of the selected large model output plug-in data set; C is the set of standard plug-in data corresponding to the selected large model output plug-in data set; For The corresponding standard plugin data value; Is a comparison function used to judge and Are they equal or within the preset error range? Are they equal or within the preset error range? , otherwise 0 for and The cosine similarity of The weight is configurable.

[0049] As a preferred implementation, after the verification step of the forensic analysis plug-in using the plug-in platform, for the forensic analysis plug-in that does not meet the verification requirements, the selection of the large model and the forensic intelligent prompt word framework are adjusted through an intelligent feedback mechanism and a predefined decision tree model, and a new forensic analysis plug-in is regenerated.

[0050] On the other hand, the present invention also provides a large model-based forensic analysis plug-in generation system, comprising:

[0051] The data processing and feature extraction module obtains the forensic files and performs file format recognition, preprocessing, and structural feature extraction. The structural features include: structural complexity, field type distribution, field naming rules, file size, and data volume;

[0052] The prompt word framework construction module generates task requirements and structural characteristics of the forensic file based on the forensic analysis plug-in, and constructs the forensic intelligent prompt word framework. The forensic intelligent prompt word framework includes: role setting, target description, skill assignment, restriction conditions and learning sample design;

[0053] The model selection and plug-in generation module selects an appropriate large model based on the structural features of the file to be forensic, and uses the structural features of the file to be forensic and the intelligent prompt word framework for forensic collection as input for the selected large model. The selected large model outputs the forensic analysis plug-in code snippet according to the forensic requirements;

[0054] The plug-in verification and deployment module integrates the generated code snippets into a complete forensic analysis plug-in code through the code merging tool, and uses the plug-in platform to verify the forensic analysis plug-in, and deploys the verified forensic analysis plug-in for application.

[0055] On the other hand, the present invention further provides an electronic device having a computer program stored thereon, wherein when the computer program is executed by a processor, the method for generating a forensic analysis plug-in based on a large model as described in any embodiment of the present invention is implemented.

[0056] On the other hand, the present invention also provides a computer-readable medium for storing one or more programs, which, when executed by the one or more processors, enables the one or more processors to implement a large model-based forensic analysis plug-in generation method as described in any embodiment of the present invention.

[0057] The present invention has the following beneficial effects:

[0058] The present invention discloses a method and system for generating a forensic analysis plug-in based on a large model, and a unique forensic code generation framework is constructed based on the large model. By designing a special forensic intelligent prompt word framework and code examples, the automatic generation of forensic requirements described in natural language by the user to executable forensic analysis plug-in code is realized. This method greatly reduces the workload of manually writing code, and the proportion of manual writing of complex plug-ins is reduced from 100% to 20%. Simple plug-ins can even be generated entirely by machines, which significantly improves the efficiency of plug-in development and changes the traditional development mode that relies on a large amount of manual coding. The present invention discloses a method and system for generating a forensic analysis plug-in based on a large model, and the constructed prompt word template covers multi-dimensional content such as roles, goals, skills and sample codes, and can guide the large model to generate forensic analysis plug-in code for various applications. And by continuously optimizing prompt words and samples, the large model can automatically understand the configuration information and accurately extract the meaning of internal fields, and can automatically distinguish the application type according to the input data, effectively deal with the diversity of illegal applications involving the Internet, and break through the previous single function or specific application prompt word design limitations. The present invention discloses a method and system for generating a forensic analysis plug-in based on a large model. The method adopts a suitable preprocessing method to solve the problem of parsing multiple types of data formats involved in complex application plug-ins. For niche and unconventional data formats, they are first converted into common formats and then analyzed. For binary data, they are first manually pre-processed and then the code is generated. The large model of the forensic plug-in framework is dynamically and intelligently selected to ensure that complex application data can be fully and accurately parsed, which solves the difficulties of traditional methods in processing complex data formats and improves the integrity and accuracy of forensic analysis. The present invention discloses a method and system for generating a forensic analysis plug-in based on a large model. When dealing with situations in actual combat where existing forensic analysis plug-ins do not support forensics, the method utilizes the forensic intelligent prompt word framework and the existing work foundation, and by simply fine-tuning the prompt words or workflow, a large amount of coding and debugging processes are omitted, and the plug-in launch time is greatly shortened from the traditional nearly one week to one or two days, which greatly improves the response speed to forensic needs and enhances the practicality and flexibility in forensic violation scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 This is a schematic diagram of the method flow of Example 1;

[0060] Figure 2 Choose a process flow diagram for a large model. DETAILED DESCRIPTION

[0061] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0062] It should be understood that the step numbers used in this document are only for convenience of description and are not intended to limit the order in which the steps are executed.

[0063] It should be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0064] The terms “include” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0065] The term "and / or" means and includes any and all possible combinations of one or more of the associated listed items.

[0066] Embodiment 1:

[0067] In order to make the purpose, technical solutions and advantages of the present invention more clear, the following will be combined with the specific embodiments of the present application and refer to the attached Figure 1 , clearly and completely describe the technical solution of the present invention.

[0068] To solve the problems in the prior art, this embodiment provides a method for generating a forensic analysis plug-in based on a large model, comprising the following steps:

[0069] Step S1, obtaining the file to be forensically collected and performing file format recognition, preprocessing and structural feature extraction. The structural features include: structural complexity, field type distribution, field naming rules, file size and data volume;

[0070] In the step of obtaining the file to be collected and performing file format identification and preprocessing, the step of performing file format identification includes:

[0071] Identify common text, database files, binary data and unconventional data formats by analyzing the header bytes and content features of the files to be forensically collected;

[0072] In the preprocessing step, for ordinary text and database files, the forensic related content is directly obtained through text editors and corresponding database management tools;

[0073] For unconventional data formats, they are converted into JSON format based on regular expression field mapping rules. The conversion process follows the consistency principle of data structure and semantics.

[0074] For binary data, extract key information based on the type and application scenario of the binary data and convert it into a standard readable text format; for example, use a Hex editor to extract metadata, or parse mobile application data based on an APK decompilation tool.

[0075] The steps of structural feature extraction include:

[0076] Extract structural complexity features and use the nested level depth as the structural complexity indicator. The specific formula is:

[0077] ;

[0078] Where: The complexity characteristics of the structure of the document to be collected; is the nesting depth of the i-th layer in the forensic file; n is the total number of nested layers in the forensic file;

[0079] Extract the type distribution characteristics of the field. The specific formula is:

[0080] ;

[0081] Where: is the type distribution characteristic of the field; is the frequency of occurrence of the mth data type; N is the total number of fields; M is the total number of data types;

[0082] Extract the regular features of field naming. The specific formula is:

[0083] ;

[0084] Where: Name the regular features for the fields; is the naming length of the xth field; is the degree of match between the xth field and the naming pattern; X is the total number of fields;

[0085] Extract file size and data volume features. The specific formula is:

[0086] ;

[0087] Where: The size and data volume characteristics of the file to be collected; is the byte size of the file to be forensically collected; is the number of records in the file to be collected.

[0088] Step S2, based on the forensic analysis plug-in generating task requirements and the structural characteristics of the file to be forensically collected, constructing a forensic intelligent prompt word framework, including: role setting, target description, skill assignment, restriction conditions and learning sample design;

[0089] The intelligent forensic word prompt framework is constructed, and the intelligent forensic word prompt framework includes: role setting, target description, skill assignment, restriction conditions and learning sample design; wherein:

[0090] Role setting is used to determine professional roles according to the type of files to be collected, and locate the processing perspective of the selected large model;

[0091] Example:

[0092] # Custom part + python data parsing expert.

[0093] The custom part gives roles with parsing capabilities in related fields according to the type of parsing application. For example, for virtual machine configuration file parsing, the role is set as virtual machine configuration file and Python data parsing expert.

[0094] The goal description is used to formulate the task objectives and guide the selected large model to generate effective code for extracting and processing data and following the example framework;

[0095] Example:

[0096] # Generate accurate Python code based on the configuration file information provided by the user and the framework provided by the sample code.

[0097] # Ensure that the generated code follows the sample code framework structure provided by the user and is generated completely,

[0098] # Ability to parse fields in the configuration file according to your understanding.

[0099] # Custom Section

[0100] The custom part needs to set goals in combination with the application type to be parsed. For example, for virtual machine configuration file parsing, you can set the main configuration of the virtual machine to be parsed, and the fields of the table are generated according to the file content.

[0101] Skills are assigned to assign general and professional skill combinations, and to grant the ability to parse data and write qualified code for selected large models; skills include understanding the meaning of input data fields and proficiently using Python for data parsing and coding. The ability to understand data fields can deeply analyze the meaning of each field in the input data, accurately determine its data type, business purpose, etc., and can generate table structure and field code according to the sample code framework, thus assigning clear skills.

[0102] Example:

[0103] # Proficient in Python programming language,

[0104] # Familiar with data parsing and processing techniques,

[0105] # Understand and apply configuration file reading and parsing methods.

[0106] # Custom Section

[0107] The customized part gives it professional skills in combination with the specific application type. For example, for virtual machine configuration file parsing, it is given the ability to be proficient in parsing the virtual machine configuration file format and data content.

[0108] Constraints are used to impose multiple restrictions on the selected large model. Each restriction is used to standardize the code structure, security, and compatibility. In order to prevent the large model from generalizing the output, we need to restrict some conditions to ensure the accuracy of the output code.

[0109] Example:

[0110] # Do not change the skeleton structure of the provided sample code.

[0111] # Do not use config, file, db, error custom module keywords.

[0112] # Make sure the value of each field is stored in string form.

[0113] # The code cannot be omitted and must be generated completely.

[0114] # Custom Section

[0115] The custom part mainly analyzes the restrictions that need to be added based on the specific application type.

[0116] The learning sample design is used to guide the selected large model to learn the standardized code logic and framework. Because Python syntax is concise, easy to understand and quickly write and debug code, and has many high-level abstractions and rich library support, the design of the sample code includes the following aspects:

[0117] ① Define the table structure of the plug-in, including the table name and description information, column name and description information, and call the forensic software data operation interface to create a database table according to the defined table structure;

[0118] ② Define the initialization method. When the forensic plug-in is running, it triggers the forensic software to call the initialization operation and create the database and other initial operations according to the defined table structure;

[0119] ③ Traverse the file system and select the files to be analyzed based on the characteristics of the files to be analyzed, such as matching the specified folder directory or file name, files ending with a certain file suffix, etc.;

[0120] ④ Define the entry function for parsing the file, call the created application parsing class, and implement the specific parsing process in the application parsing class. Perform corresponding operations on the selected files, obtain information, insert it into the database, and update the number of display node records;

[0121] ⑤The main interfaces for connecting to the forensic plug-in engine are as follows:

[0122] Interface 1: Describes the definition of data items in the database table

[0123] forensics.config.FieldCfg(name,description,data_type='text')

[0124] Interface 2: Describe plugin configuration

[0125] forensics.config.PluginCfg(name,version='1.0.0')

[0126] Interface 3: Describe database table definition

[0127] forensics.config.TableCfg(name,description)

[0128] Interface 4: Database table insertion, reading and other operations

[0129] forensics.db.TableStore(table_name)

[0130] Interface 5: Get the full name of the file path, extension, export the file path to the specified directory, etc.

[0131] forensics.file.FmFile(file_id: int)

[0132] Interface 6: Manage plugin functions, build tree structure, save database, etc.

[0133] forensics.plugin.FmPlugin(plugin_id)

[0134] Step S3, selecting an adaptive large model based on the structural features of the file to be collected, and taking the structural features of the file to be collected and the intelligent prompt word framework for evidence collection as inputs of the selected large model, and the selected large model outputs a forensic analysis plug-in code snippet according to the evidence collection requirements;

[0135] In this embodiment, Figure 2As shown in the figure, the algorithm framework selection of the large model is to dynamically select the most suitable large model based on the analysis results of the structural characteristics of the forensic file. This process not only relies on the calculation of the complexity, type diversity, naming rules and other characteristics of the forensic file, but also needs to select the most suitable large model through an intelligent feedback mechanism and a predefined decision tree model. After calculating the complexity, type diversity and other characteristics of the file, a hierarchical decision tree model can be applied to select the most suitable algorithm framework. The decision tree model is a hierarchical structure that determines which type of large model to select for parsing by judging different file features. Each node of the decision tree represents a file feature, and the decision basis of the node is the judgment of the feature value. The direction of each path determines the type of large model selected. The decision tree determines whether to select a certain type of large model for parsing based on a specific threshold. When designing a decision tree, each node is assigned a threshold according to the characteristics of the file, and then determines whether to continue to go down a branch of the tree according to the value of the feature until a suitable model is finally selected. The top node of the decision tree is judged based on the file size and data volume characteristics; if the file size and data volume characteristics are greater than a specific threshold, it enters the complex file processing branch; if it is less than or equal to the threshold, it enters the simple file processing branch; this is because the file size and data volume reflect the overall complexity of the file to a certain extent. The larger the data volume, the higher the processing difficulty is usually, and a more powerful large model is required to process it. The middle-level nodes are divided into middle-level nodes of the complex file processing branch and middle-level nodes of the simple file processing branch; in the complex file processing branch, the middle-level nodes are judged based on the structural complexity characteristics. The nested level depth is used as the structural complexity feature. If it is greater than the threshold, the type distribution characteristics of the field are further judged; if the field type distribution characteristics are less than the threshold, it means that the data type is relatively concentrated, and it is suitable to select a large model that is good at processing specific types of data; if the field type distribution characteristics are greater than or equal to the threshold, it means that the data type is complex and diverse, and a large model with a wide range of data type processing capabilities is selected. In the simple file processing branch, the middle-level nodes mainly judge the field naming regularity characteristics. If the feature value is greater than the threshold, it means that the field naming regularity is more obvious, and a large model that is sensitive to rules can be selected; if it is less than or equal to the threshold, a general large model is selected. The bottom-level nodes are used to refine the selection. On the basis of each middle-level node branch, the final decision is made through the feature matching function in combination with the time trend factor and the user feedback factor. For example, in the selection branch of a large model that is good at processing a specific type of data, if the time trend factor shows that the demand for processing this type of file is on the rise recently, and the user feedback factor shows that users are more satisfied with a specific large model, then the large model will be selected first.

[0136] The feature matching function is specifically:

[0137] ;

[0138] Where: is the feature matching result; is the weight of the pth node in the decision tree. The plugin can be used to verify the result. Make updates; is the value of the qth feature of the file to be forensically collected; is the time trend factor; is the time trend weight; is the user feedback factor, which can be the rating of the generated forensic plug-in by experts or users; is the user feedback weight; P is the total number of nodes in the decision tree;

[0139] The calculation formula of time trend factor is:

[0140] ;

[0141] Where: is the standardized time window; is the decay rate adjustment coefficient, which is used to control the sensitivity of the exponential function; is the exponential decay weight factor; is the square root growth weight factor;

[0142] The calculation formula of user feedback factor is:

[0143] ;

[0144] Where: Weight factor for user rating; is the mean user rating; Give the user the maximum score; The weight factor for the number of user ratings; is the number of valid ratings; is the smoothing constant;

[0145] The node weights in the decision tree are adjusted according to the plug-in verification results. If the plug-in generated by the large model is found to be missing or performing poorly in some key functions during the functional integrity verification, and these functions are closely related to the features represented by the node p in the decision tree, then it is necessary to reduce On the contrary, if the plug-in performs well in related functions, the weight can be appropriately increased. The specific weight update formula is as follows:

[0146] ;

[0147] The steps of verifying the forensic analysis plug-in using the plug-in platform include: functional integrity verification, code stability verification and data accuracy verification; wherein:

[0148] The specific formula for functional integrity verification is:

[0149] ;

[0150] Where: It is a function for functional integrity verification; F is a set of functions that the large model generation plug-in should implement; The verification function of the bth function that the large model generation plug-in should implement; l is the input test data set; B is the total number of functions that the large model generation plug-in should implement;

[0151] The input test data set is generated through equivalence class division and boundary value analysis. The specific formula is:

[0152] ;

[0153] Where: This is a normal test case. It is a case study for the boundary test set; This is an exception test set case.

[0154] Code stability verification specifically includes the following steps:

[0155] Modify the stability score using an unbiased estimate:

[0156] ;

[0157] Where: Score code stability; is the jth stability test result; is the mean of the stability test results; J is the total number of stability tests;

[0158] In this embodiment, in order to eliminate the impact of plug-in test crashes on the code stability score during plug-in testing, a random input generator is used to simulate extreme scenarios and quantify the crash rate to obtain an enhanced code stability score:

[0159] ;

[0160] Where: Score the stability of the enhanced code; The number of times the plugin crashed during the stability test; The number of successful automatic recovery after a crash, to avoid scoring distortion caused by single point failure;

[0161] Data accuracy verification specifically includes the following steps:

[0162] Introducing dynamic error thresholds for numerical data:

[0163] ;

[0164] Where: is the dynamic error threshold; It is the relative error threshold, which is used to judge the accuracy of numerical data and supports adaptive adjustment according to the data type;

[0165] For text or unstructured data, use the lightweight BERT model to calculate cosine similarity:

[0166] ;

[0167] Where: for Vectorized representation of ; for Vectorized representation of

[0168] The specific formula for data accuracy verification combining binary comparison and semantic similarity is:

[0169]

[0170] Where: A(O,C) is the accuracy verification result; O is the selected large model output plug-in data set; is the kth data value of the selected large model output plug-in data set; K is the total number of the selected large model output plug-in data set; C is the set of standard plug-in data corresponding to the selected large model output plug-in data set; For The corresponding standard plugin data value; Is a comparison function used to judge and Are they equal or within the preset error range? Are they equal or within the preset error range? , otherwise 0; for and The cosine similarity of It is a configurable weight, set to 0.5, and supports mixed data validation of numerical and text data.

[0171] After the verification process of the forensic analysis plug-in using the plug-in platform, for the forensic analysis plug-in that does not meet the verification requirements, the selection of the large model and the forensic intelligent prompt word framework are adjusted through the intelligent feedback mechanism and the predefined decision tree model, and a new forensic analysis plug-in is regenerated.

[0172] Step S4, integrating the generated code snippets into a complete forensic analysis plug-in code through a code merging tool, and verifying the forensic analysis plug-in using a plug-in platform, and deploying the verified forensic analysis plug-in for application.

[0173] Embodiment 2:

[0174] This embodiment provides a large model-based forensic analysis plug-in generation system, including:

[0175] The data processing and feature extraction module obtains the forensic files and performs file format recognition, preprocessing, and structural feature extraction. The structural features include: structural complexity, field type distribution, field naming rules, file size, and data volume;

[0176] The prompt word framework construction module generates task requirements and structural characteristics of the forensic file based on the forensic analysis plug-in, and constructs the forensic intelligent prompt word framework. The forensic intelligent prompt word framework includes: role setting, target description, skill assignment, restriction conditions and learning sample design;

[0177] The model selection and plug-in generation module selects an appropriate large model based on the structural features of the file to be forensic, and uses the structural features of the file to be forensic and the intelligent prompt word framework for forensic collection as input for the selected large model. The selected large model outputs the forensic analysis plug-in code snippet according to the forensic requirements;

[0178] The plug-in verification and deployment module integrates the generated code snippets into a complete forensic analysis plug-in code through the code merging tool, and uses the plug-in platform to verify the forensic analysis plug-in, and deploys the verified forensic analysis plug-in for application.

[0179] Embodiment three:

[0180] This embodiment provides an electronic device having a computer program stored thereon, wherein when the computer program is executed by a processor, a method for generating a forensic analysis plug-in based on a large model as described in any embodiment of the present invention is implemented.

[0181] Embodiment 4:

[0182] This embodiment provides a computer-readable medium for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement a large model-based forensic analysis plug-in generation method as described in any embodiment of the present invention.

[0183] In the embodiments of the present application, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent the existence of A alone, the existence of A and B at the same time, and the existence of B alone. Among them, A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can be represented by: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, c can be single or multiple.

[0184] Those of ordinary skill in the art will appreciate that the various units and algorithm steps described in the embodiments disclosed herein can be implemented in a combination of electronic hardware, computer software, and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0185] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0186] In several embodiments provided in the present application, if any function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory; hereinafter referred to as: ROM), random access memory (Random Access Memory; hereinafter referred to as: RAM), disk or optical disk, and other media that can store program codes.

[0187] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for generating a forensic analysis plug-in based on a large model, characterized in that: The following steps are involved: Step S1, obtaining the file to be forensically collected and performing file format recognition, preprocessing and structural feature extraction. The structural features include: structural complexity, field type distribution, field naming rules, file size and data volume; Step S2, based on the task requirements generated by the forensic analysis plug-in and the structural characteristics of the file to be forensically collected, a framework of intelligent prompt words for forensics is constructed, and the framework of intelligent prompt words for forensics includes: role setting, target description, skill assignment, restriction conditions and learning sample design; Step S3, selecting an adaptive large model based on the structural features of the file to be collected, and taking the structural features of the file to be collected and the intelligent prompt word framework for evidence collection as inputs of the selected large model, and the selected large model outputs a forensic analysis plug-in code snippet according to the evidence collection requirements; Step S4, integrating the generated code snippets into a complete forensic analysis plug-in code through a code merging tool, and verifying the forensic analysis plug-in using a plug-in platform, and deploying the verified forensic analysis plug-in for application; The steps of verifying the forensic analysis plug-in using the plug-in platform include: functional integrity verification, code stability verification and data accuracy verification; wherein: The specific formula for functional integrity verification is: ； Where: It is a function for functional integrity verification; F is a set of functions that the large model generation plug-in should implement; The verification function of the bth function that the large model generation plug-in should implement; l is the input test data set; B is the total number of functions that the large model generation plug-in should implement; The specific formula for code stability verification is: ； Where: Score code stability; is the jth stability test result; is the mean of the stability test results; J is the total number of stability tests; The specific formula for data accuracy verification is: Where: A(O,C) is the accuracy verification result; O is the selected large model output plug-in data set; is the kth data value of the selected large model output plug-in data set; K is the total number of the selected large model output plug-in data set; C is the set of standard plug-in data corresponding to the selected large model output plug-in data set; For The corresponding standard plugin data value; is the comparison function; for and The cosine similarity of The weight is configurable.

2. The method for generating a forensic analysis plug-in based on a large model according to claim 1, characterized in that: In the step of obtaining the file to be collected and performing file format identification and preprocessing, the step of performing file format identification includes: Identify common text, database files, binary data and unconventional data formats by analyzing the header bytes and content features of the files to be forensically collected; In the preprocessing step, for ordinary text and database files, the forensic related content is directly obtained through text editors and corresponding database management tools; For unconventional data formats, they are converted into JSON format based on regular expression field mapping rules. The conversion process follows the consistency principle of data structure and semantics. For binary data, key information is extracted based on the type and application scenario of the binary data and converted into a standard readable text format.

3. The method for generating a forensic analysis plug-in based on a large model according to claim 1, characterized in that: The step of extracting structural features comprises: Extract structural complexity features and use the nested level depth as the structural complexity indicator. The specific formula is: ； Where: The structural complexity characteristics of the document to be obtained; is the nesting depth of the i-th layer in the forensic file; n is the total number of nested layers in the forensic file; Extract the type distribution characteristics of the field. The specific formula is: ； Where: is the type distribution characteristic of the field; is the frequency of occurrence of the mth data type; N is the total number of fields; M is the total number of data types; Extract the regular features of field naming. The specific formula is: ； Where: Name the regular features of the fields; is the naming length of the xth field; is the degree of match between the xth field and the naming pattern; X is the total number of fields; Extract file size and data volume features. The specific formula is: ； Where: The size and data volume characteristics of the file to be collected; is the byte size of the file to be forensically collected; is the number of records in the file to be collected.

4. The method for generating a forensic analysis plug-in based on a large model according to claim 1, characterized in that: In the step of constructing the intelligent prompt word framework for forensic collection: Role setting is used to determine professional roles according to the type of files to be collected, and locate the processing perspective of the selected large model; The goal description is used to formulate the task objectives and guide the selected large model to generate effective code for extracting and processing data and following the example framework; Skills empowerment is used to empower general and professional skill sets, giving selected large models the ability to parse data and write qualified codes; Constraints are used to impose multiple restriction rules on the selected large model, and each restriction rule is used to regulate the code structure, security and compatibility; The learning sample design is used to guide the selected large model to learn the standardized code logic and framework.

5. The method for generating a forensic analysis plug-in based on a large model according to claim 1, characterized in that: In the step of selecting an adaptive large model based on the structural features of the file to be obtained, the adaptive large model is selected by a feature matching function; the feature matching function is specifically: ； Where: is the feature matching result; is the weight of the pth node in the decision tree; is the value of the qth feature in the document to be forensically collected; is the time trend factor; is the time trend weight; is the user feedback factor; is the user feedback weight; P is the total number of nodes in the decision tree.

6. The method for generating a forensic analysis plug-in based on a large model according to claim 1, characterized in that: After the verification step of the forensic analysis plug-in using the plug-in platform, for the forensic analysis plug-in that does not meet the verification requirements, the selection of the large model and the forensic intelligent prompt word framework are adjusted through an intelligent feedback mechanism and a predefined decision tree model, and a new forensic analysis plug-in is regenerated.

7. A forensic analysis plug-in generation system based on a large model, characterized in that: include: The data processing and feature extraction module obtains the forensic files and performs file format recognition, preprocessing, and structural feature extraction. The structural features include: structural complexity, field type distribution, field naming rules, file size, and data volume; The prompt word framework construction module generates task requirements and structural features of the forensic file based on the forensic analysis plug-in, and constructs the forensic intelligent prompt word framework. The forensic intelligent prompt word framework includes: role setting, target description, skill assignment, restriction conditions and learning sample design; The model selection and plug-in generation module selects an appropriate large model based on the structural features of the file to be forensic, and uses the structural features of the file to be forensic and the intelligent prompt word framework for forensic collection as input for the selected large model. The selected large model outputs the forensic analysis plug-in code snippet according to the forensic requirements; The plug-in verification and deployment module integrates the generated code snippets into a complete forensic analysis plug-in code through the code merging tool, verifies the forensic analysis plug-in using the plug-in platform, and deploys the verified forensic analysis plug-in for application; The steps of verifying the forensic analysis plug-in using the plug-in platform include: functional integrity verification, code stability verification and data accuracy verification; wherein: The specific formula for functional integrity verification is: ； Where: It is a function for functional integrity verification; F is a set of functions that the large model generation plug-in should implement; The verification function of the bth function that the large model generation plug-in should implement; l is the input test data set; B is the total number of functions that the large model generation plug-in should implement; The specific formula for code stability verification is: ； Where: Score code stability; is the jth stability test result; is the mean of the stability test results; J is the total number of stability tests; The specific formula for data accuracy verification is: Where: A(O,C) is the accuracy verification result; O is the selected large model output plug-in data set; is the kth data value of the selected large model output plug-in data set; K is the total number of the selected large model output plug-in data set; C is the set of standard plug-in data corresponding to the selected large model output plug-in data set; For The corresponding standard plugin data value; is the comparison function; for and The cosine similarity of The weight is configurable.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, it implements a large model-based forensic analysis plug-in generation method as described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements a method for generating a forensic analysis plug-in based on a large model as described in any one of claims 1 to 6.

Images