Cold storage trusted behavior data extraction method based on Drain3 in judicial evidence storage

Abstract

The invention discloses a Drain3-based cold storage credible behavior data extraction method in judicial evidence storage, which comprises the following steps of: 1, respectively carrying out credible attribute analysis according to constituent elements in a judicial evidence storage scene to obtain classified credible attribute models; and 2, according to the untrusted problem and the trusted attribute, extracting a trusted demand from the demand analysis. 3, formalized description is constructed according to credible requirements, and a part of'speech 'in'speech consistency' is obtained. And 4, performing log point burying according to the credible demand concern, and ensuring the coverage rate of behavior logic in the code by adopting a logic branch point burying mode. And 5, cleaning and screening the parameter part, and taking the cleaned and screened parameter part as credible related data of the cold storage behavior to obtain a line part in consistent speech. According to the method, the credible attributes in the judicial evidence storage scene are divided into three dimensions of service, equipment and evidence, the pertinence is higher, and an uncredible source can be quickly positioned when an uncredible behavior occurs.

Description

Technical Field

[0001] The present invention relates to judicial evidence storage scenarios and software trust fields, and specifically proposes a cold storage trusted behavior data extraction method based on Drain3 in judicial evidence storage scenarios. Background Art

[0002] Judicial evidence storage refers to the process of storing electronic evidence generated during the trial of a case in the judicial system. These electronic evidence may include videos, documents, transaction records, etc. Public security, procuratorial and judicial organs will generate a large amount of electronic evidence, such as surveillance videos, during the process of evidence collection and case trial. The electronic evidence needs to be retained for at least ten years after the case trial. Ordinary storage methods such as disks are easy to wear and change, and are not suitable for long-term and reliable storage. Since most of the electronic evidence in the judicial evidence storage scenario is cold data, it is necessary to adopt corresponding storage methods and storage strategies for cold data, that is, cold storage methods. Cold storage is a data storage method that is mainly used to store data that is not frequently accessed or does not need to be accessed immediately for a long time.

[0003] Since cold storage devices are the storage center of judicial evidence storage scenarios, the credibility of cold storage behavior greatly affects the credibility of the entire judicial evidence storage system. Current credibility issues that cold storage devices may have include: incorrect archiving parameters, duplicate archiving content, timed execution errors, and results not returned in time. In order to ensure the credibility of judicial evidence storage scenarios, an effective detection mechanism must be set up for such credibility issues to help administrators locate problems in a timely manner and provide data support for the subsequent cold storage behavior credibility calculation.

[0004] In previous studies, trust researchers have evaluated and studied the trustworthiness of software from multiple dimensions, using different forms and methods. However, in the current software trust-related research, there are few trust-related studies on a certain scenario. Traditional trust attributes are divided into several types, such as correctness and stability. It is impossible to accurately trace the untrustworthy behavior, which in turn affects the analysis of the reasons for the untrustworthiness of the software. In terms of log parsing, researchers have proposed many log parsing algorithms such as Drain3, IPLoM, Spell, Logram, ULP algorithm, etc. The present invention uses the Drain3 parsing algorithm based on a fixed depth parsing tree. The present invention will analyze the cold storage behavior in the judicial evidence simulation scenario, propose a classification method based on the trust attributes of the behavior constituent elements, and use the Drain3 algorithm based on the system log to extract the trust-related parts of the cold storage behavior, paving the way for the later comparison of behavior statements to obtain the credibility of the cold storage behavior. Summary of the invention

[0005] In order to detect the untrustworthy problems that may arise in cold storage behaviors in the current judicial evidence storage scenario, the present invention provides a cold storage trusted behavior data extraction method based on Drain3. According to trusted attribute modeling and trusted demand analysis, a trusted behavior statement ("words") is obtained, and then the log of the evidence storage platform is buried according to the trusted attributes. The trusted related data ("actions") of the cold storage behavior are extracted from the logs of the judicial evidence storage platform according to the Drain3 algorithm. Later, the credibility of the cold storage behavior can be obtained by comparing the "consistency between words and actions" of the trusted rule, thereby tracing the untrustworthy problem.

[0006] To achieve the above object, the present invention comprises the following steps:

[0007] Step 1: Conduct trust attribute analysis based on the constituent elements in the judicial evidence storage scenario to obtain a classified trust attribute model.

[0008] Step 2: Conduct a demand analysis on the functions related to cold storage behavior in the judicial evidence storage scenario, and analyze the untrustworthy issues in the scenario. Based on the untrustworthy issues and trusted attributes, extract the trusted requirements from the demand analysis.

[0009] Step 3: Construct a formal description based on the trusted requirements, that is, construct a general template for behavior declarations, and then complete the construction of the behavior declaration templates corresponding to each requirement based on the characteristics of each trusted requirement to obtain the "words" part of "consistency between words and deeds".

[0010] Step 4: Logging is performed based on the trusted requirements and the logical branch logging method is used to ensure the coverage of the behavioral logic in the code and record various trusted indicators during program execution in real time.

[0011] Step 5: Parse the log based on the Drain3 algorithm, extract the log template and parameter parts, clean and filter the parameter parts as the trusted relevant data of cold storage behavior, and obtain the "action" part of "consistent words and deeds".

[0012] Further, the process of step 1 is as follows:

[0013] Step 1.1: Cold storage trust attributes should be analyzed based on application characteristics to obtain cold storage trust attributes. Since the main process of cold storage behavior is to store electronic evidence in cold storage devices according to the tasks issued by users, trust attribute analysis can be performed on the observer, operation entity, and operation object of the behavior.

[0014] Step 1.2: Based on the above theory, analyze the trust attributes of each target object. For business trust attributes, it can include the correctness, timeliness and fault tolerance of business execution; for equipment trust attributes, the uniqueness of archived results and the stability of service processes should be guaranteed; for evidence trust attributes, the confidentiality and integrity of electronic evidence should be guaranteed.

[0015] Further, the process of step 2 is as follows:

[0016] Step 2.1: Trusted attributes are a series of properties related to software trustworthiness, but trusted attributes still need to be combined with requirements to get an accurate description of whether the expected behavior is trustworthy. Software requirements refer to the description of the expected results of the software in the early stage of software development, while trusted requirements are the requirements related to trustworthiness extracted from software requirements, laying the foundation for generating trusted behavior statements.

[0017] First, it is necessary to analyze the business requirements related to cold storage in the judicial evidence storage scenario. Cold storage is mainly responsible for archiving and burning functions. The business requirements in this function are: the platform sends the parameters of the archiving task to the cold storage device, and the cold storage device receives it correctly; the cold storage device establishes the archiving task according to the received parameters, and performs archiving and burning operations according to the task; the sending of archiving tasks should be executed regularly, and manual initiation is supported to avoid the impact of failure; after the cold storage device completes the burning, it should return the execution result to the platform.

[0018] Step 2.2: Based on the actual judicial evidence storage scenario, the risks that are likely to occur during the cold storage archiving and burning process include: the risk of parameter transmission errors, the risk of archiving duplication, the risk of unscheduled execution, and the risk of archiving results not being returned in time.

[0019] Step 2.3: Based on the above trusted attribute classification and risk analysis, combined with the business requirements related to cold storage in judicial evidence storage scenarios, the trusted requirements for cold storage behavior can be obtained, including four main trusted requirements: receiving, archiving and burning, scheduled execution, and sending. The content corresponding to the requirements needs to be summarized in combination with the risks. Each requirement corresponds to one or more trusted attribute classifications, because the execution of cold storage behavior may involve operations on multiple target objects, such as operations on electronic evidence during burning, and there are certain requirements for the device. Therefore, the trusted requirements for archiving and burning can correspond to the trusted attributes of the device and the trusted attributes of the evidence.

[0020] Further, the step 3 specifically includes:

[0021] Step 3.1: Behavior declaration refers to a set of descriptions of the application software's own behavior, which is composed of a series of software behaviors. The present invention uses XML format to describe software behaviors, which is highly readable. In the present invention, the behavior declaration is divided into two parts, a general part and a special part. The general part is the content that must be described in each behavior declaration, that is, the general rule entry, and the special part differs due to different target objects of the function. The general part of the behavior declaration includes the behavior number, behavior name, behavior execution time, behavior triggering conditions, parameters, target object, expected results, etc.

[0022] Step 3.2: The dedicated part of the behavior statement is different according to the different behavior target objects. In the above analysis of trusted attributes, the present invention classified the trusted attributes according to the behavior target objects, and constructed the behavior statement corresponding to the trusted attributes in the dedicated part of the behavior statement according to the above classification. For example, in the judicial evidence storage scenario, when it comes to business, it is necessary to ensure the correctness of the archive execution results, which can be described by the return value of the archive method; when it comes to devices, it is necessary to ensure uniqueness, such as electronic evidence can only be stored once, and no repeated write operations will be generated, which can be described based on whether the file name of the operation of the record archiving process is repeated, etc.

[0023] Further, the specific process of step 4 is as follows:

[0024] Step 4.1: Tracking is to inject code into an application-specific process in order to collect relevant information about the process, which is generally used to track the execution status of the program. The present invention selects the log tracking method to record the cold storage behavior trajectory, and specifically adopts the logic branch tracking technology to record the trusted demand-related log information in the key logic branch, so as to obtain the cold storage behavior credibility by comparing the behavior statement. The use of logic branch tracking can ensure the coverage of the behavior trajectory record. Since logic branches are often important path nodes in the program execution process, it can ensure comprehensive coverage of the behavior trajectory and can record various trusted indicators during program execution in real time.

[0025] Step 4.2: The present invention adopts the method of logical branching to record logs at the conditional judgment of the program and the beginning of the for loop, which can record the program execution path more clearly. Since the program running speed and the call time of the log recording method are prone to fluctuations, there may be slight errors between the order of the exported logs and the program execution order within the same millisecond time. Although it has little effect on the extraction of behavioral data, it is easy to cause the program running track to be unclear. Therefore, the present invention adopts a coding method to record a group of logs with the same sub-functions. The log format is as follows:

[0026] [<SubFunctionName>-0-1]<Date><Time><Content>

[0027] Among them, <SubFunctionName> represents the sub-function category, -0-1 code (variable length) represents the execution path of the program, <Date> represents the date of logging, <Time> represents the time of logging, and <Content> represents the log content. In this sub-function, the first step of the encoding executes the path represented by 0, and the second step executes the path represented by 1. For example, in the process of checking the folder for archiving, the log header is [Archive Task-Folder Check-0-1], which means that in the folder judgment logic, the existence of the folder corresponds to code 0, and in the logic of whether the file is 0, the file size is 0 and corresponds to code 1. "-0-1" records the direction of the sub-function code in the logical branch. According to this encoding method, the running track of the program can be obtained through the log of the archiving process.

[0028] Finally, step 5 is divided into the following steps:

[0029] Step 5.1: Drain3 is an online log parsing method with a fixed-depth tree. It only needs the log message itself to extract different log templates and their parameters. First, the log to be parsed is covered with parameter regular expressions and segmented to obtain a segmentation list, which is then used to perform template matching in the parsing tree. In its parsing tree, special rules are designed for the root node and internal nodes to guide the search process. The first layer under the root node is the length node, and the next tree layer of the length node is the token. The tree is searched by matching the segmentation results, and each path is calculated to end with a leaf node that records the log cluster. The similarity calculation formula is: Where seq1 and seq2 represent log messages and log templates respectively, seq(i) is the i-th token in the sequence, n is the length of the log message in the sequence, and equation is: Among them, t1 and t2 are two tokens. If the calculated simSeq value is greater than the threshold, the log template is returned as the matching template.

[0030] Since the logs of the judicial evidence storage platform of the present invention are in Chinese, the logs are segmented using Jieba's precise mode for log matching and parameter extraction. However, since Jieba's processing of punctuation marks and letters can easily cause incorrect segmentation of some trusted attributes (such as file names, etc.), before Jieba segments the log data, it is necessary to set some regular expressions in common data formats to match these characters that are easily segmented incorrectly, and use placeholders to cover this part, and record the string as part of the cold storage behavior data.

[0031] The beneficial effects of adopting the above technical solution are:

[0032] The present invention proposes a new trusted attribute classification method, which divides the trusted attributes in the judicial evidence storage scenario into three dimensions: business, equipment, and evidence. It is more targeted and can quickly locate the untrusted source when untrusted behavior occurs. On this basis, the present invention conducts a trusted demand analysis based on the trusted attribute classification, and collects and analyzes real log data through log embedding and Drain3 algorithm. The program branch embedding method can ensure the path coverage of program execution, and can collect as comprehensive log data as possible in the process of statistical cold storage behavior data. The Drain3 algorithm is superior to other algorithms in terms of timeliness and parameter accuracy, and performs well in extracting behavior trust-related data. Through these research works, the present invention realizes the preliminary construction and formalization of "words" (behavior declarations) and "actions" (real behavior), paving the way for subsequent cold storage behavior credibility calculations. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The present invention will be better understood in conjunction with the accompanying drawings, in which Figure 1 This is the architecture diagram of the judicial evidence storage scenario of the present invention. The present invention mainly focuses on the archiving part from the judicial evidence storage platform to the cold storage device; Figure 2 It is the main flow chart in the archive module; Figure 3 This is a log parsing diagram. DETAILED DESCRIPTION

[0034] The following is combined with Figure 1 The following examples are used to illustrate the present invention, but the embodiments of the present invention are not limited thereto.

[0035] The main steps of the method provided by the present invention are as follows:

[0036] Step 1: Analyze the trusted attributes of cold storage behavior and build a trusted attribute classification model.

[0037] Step 2: Conduct a demand analysis on cold storage related functions, combine risk and trust attributes, and extract trusted requirements from the demand analysis.

[0038] Step 3: Construct a formal description based on the trusted requirements and build a behavior declaration template.

[0039] Step 4: Based on the trusted demand focus, use the logical branch tracking method to track logs.

[0040] Step 5: Parse the logs based on the Drain3 algorithm and compare them with other log parsing algorithms to obtain reliable data related to cold storage behavior.

[0041] As a preferred embodiment of the present invention, in step 1, the trusted attribute classification process is as follows:

[0042] According to the above-mentioned trusted attribute analysis method for the observer, operation entity and operation object of the behavior, the behavior trusted attributes can be divided into business trusted attributes, device trusted attributes and evidence trusted attributes. Among them, the business trusted attributes are oriented to the user, that is, the behavior observer, who is the initiator of the task to which the behavior belongs and the receiver of the result; the device trusted attributes are oriented to the device, that is, the operation entity, which is the real executor of the behavior; the evidence trusted attributes are oriented to the electronic evidence, that is, the operation object, which is the beneficiary of the behavior. Based on this theory and embodiment, the present invention constructs a trusted attribute classification as shown in Table 1.

[0043] Table 1 Classification of trusted attributes

[0044]

[0045] As a preferred embodiment of the present invention, in step 2, the trusted requirements extraction process is as follows:

[0046] Step 2.1: Since the present invention focuses on cold storage behavior, only the business requirements related to archiving and evidence storage in the scenario are extracted. The specific contents are as follows:

[0047] The platform sends the parameters of the archiving task to the cold storage device, and the cold storage device receives them correctly;

[0048] The cold storage device establishes an archiving task according to the received parameters, and performs archiving and burning operations according to the task;

[0049] The archive sending task should be executed regularly. To avoid the impact of failure, it can be initiated manually.

[0050] After the cold storage device completes the burning, it shall return the execution result to the platform.

[0051] Step 2.2: In combination with the embodiment, the risks that may occur during cold storage archiving are:

[0052] Due to network and other issues, the parameters are not transmitted in time or are transmitted incorrectly, resulting in the cold storage device being unable to receive the correct parameters on time, which in turn affects subsequent archiving;

[0053] Archiving is interrupted due to power outages and other issues, and the archived content is repeated when archiving is manually performed after restart;

[0054] In addition to manual initiation, the archiving process was not carried out according to the agreed time;

[0055] The archiving results and archived contents were not returned to the user in a timely manner.

[0056] Step 2.3: Based on the above trusted attribute classification and risk analysis, combined with the business requirements related to cold storage in the judicial evidence storage scenario, the trusted requirements for cold storage behavior can be obtained as shown in Table 2.

[0057] Table 2 Trusted demand analysis table

[0058]

[0059] As a preferred embodiment of the present invention, in step 3, the behavior declaration template construction process is as follows:

[0060] Step 3.1: The behavior declaration in the present invention is divided into two parts, the general part and the special part. The general part is the content that must be described in each behavior declaration, that is, the general rule entries, and the special part is different due to different target objects of the function. The general template of the behavior declaration is as follows.

[0061]

[0062] Step 3.2: For the embodiment, in the dedicated part of the receiving behavior, the parameter correctness is determined by checking the parameter type and size, thereby ensuring the correctness of parameter transfer and rejecting illegal data. The construction method of behavior declaration corresponding to other trusted requirements is similar.

[0063]

[0064] As a preferred embodiment of the present invention, in step 4, the process of log embedding is as follows:

[0065] Step 4.1: Combine with Figure 1 After the electronic evidence is downloaded, the scheduled archiving program will be executed. The archiving and evidence storage module needs to perform sub-functions such as physical path checking, file checking, creating archiving tasks, executing archiving tasks, and querying execution results. The present invention adopts a logical branching method to record logs and some current information related to untrustworthy attributes at the beginning of the program's conditional judgment and for loop, which can record the program execution path more clearly. In addition, when some key codes are about to be executed, such as checking the file size, archiving interface calls, and retrying to create archiving tasks, they will also record some trusted attribute related information currently being executed.

[0066] Step 4.2: The experiment recorded the archive logs of the judicial evidence storage platform for 30 days, and archived 12,600 pieces of electronic evidence from 42 cameras, collecting a total of 44,286 log data. The scheduled archiving program starts at 1 a.m. to avoid occupying too many network resources during office hours. The execution time is about 1 hour per day. In case of abnormal situations such as missing electronic evidence and power failure of cold storage equipment, the unfinished archiving tasks of the day can be manually started at other times.

[0067] As a preferred embodiment of the present invention, in step 5, the log parsing process is as follows:

[0068] Step 5.1: Log template extraction is the main function of the Drain3 algorithm. According to the traversal of the parse tree, a log can be matched to the corresponding log template in the leaf node. According to the update of the parse tree, a new traversal path can be created, that is, a new log template is created. The present invention extracts the corresponding template of each log through the algorithm, matches the cold storage behavior trust requirements corresponding to the log, and then obtains the log entries related to the cold storage behavior in the archiving process, and extracts parameters as the corresponding trust behavior related information, as shown in the attached figure. Figure 3 shown.

[0069] Step 5.2: This paper compares Drain3 and the common IPLoM, Spell, Logram, and ULP log parsing algorithms, and parses the cold storage logs for each of the five log parsing algorithms. The average time (in seconds) obtained by executing each algorithm n times is:

[0070]

[0071] Table 3 Average time (seconds) consumed by log parsing algorithms to parse cold storage logs

[0072] IPLoM Spell Drain3 Logram ULP 17.0001818 18.3967428 19.6450732 82.1755172 15.46787124

[0073] Step 5.3: Since the present invention focuses on extracting parameter information from logs as cold storage real behavior data, it is necessary to focus on comparing the accuracy of each algorithm in extracting parameters. This experiment lists the extraction results of each algorithm for trustworthy related parameters in logs, and the results are shown in Table 4.

[0074] Table 4 Effect of log parsing algorithm on parsing log parameters

[0075] algorithm category time Login Name path Task id Task Name Device Name file name File size result Drain3 √ √ √ √ √ √ √ √ √ √ IPLoM √ √ √ × √ √ √ √ √ √ Spell √ √ √ × √ √ √ √ √ √ Logram √ √ √ × × √ × √ × ULP √ √ √ × √ √ √ √ √ ×

[0076] Among them, since Logram is a log parsing algorithm based on frequent words, it will determine whether the word segment is a parameter based on the word frequency of n-gram, so the threshold for judging frequent words is difficult to determine. In addition, in the judicial evidence storage scenario, the correctness and completeness of parameter extraction are the basis for judging the credibility of behavior. Regardless of the frequency of occurrence, it is possible to contain credible related parameters. Therefore, it is unreasonable to judge whether the word segment is extracted as a parameter based on word frequency; the other IPLoM, Spell, and ULP algorithms extract the path and archiving results inaccurately, so the present invention uses the experimental results of Drain3 as the credible related data of cold storage behavior, that is, "row".

[0077] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be within the protection scope of the present invention.

Claims

1. A cold storage trusted behavior data extraction method based on Drain3 in judicial evidence storage, characterized in that: The following steps are involved: Step 1: Conduct trust attribute analysis based on the constituent elements in the judicial evidence storage scenario to obtain a classified trust attribute model; Step 2: Conduct a demand analysis on the cold storage behavior-related functions in the judicial evidence storage scenario, and analyze the untrustworthy issues in the scenario. Based on the untrustworthy issues and trustworthy attributes, extract the trusted requirements from the demand analysis; Step 3: Construct a formal description based on the trusted requirements, that is, construct a general template for behavior declarations, and then complete the construction of the behavior declaration templates corresponding to each requirement according to the characteristics of each trusted requirement, and obtain the "words" part of "words and deeds are consistent"; Step 4: Logging is performed based on the trusted requirements and log points are collected using logical branch logging to ensure the coverage of the behavioral logic in the code and to record various trusted indicators during program execution in real time. Step 5: Parse the log based on the Drain3 algorithm, extract the log template and parameter parts, clean and filter the parameter parts as the trusted relevant data of cold storage behavior, and obtain the "action" part of "words and deeds are consistent".

2. According to the method for extracting cold storage trusted behavior data based on Drain3 in judicial evidence storage in claim 1, it is characterized in that: The process of step 1 is as follows: Step 1.1: The cold storage trust attributes should be analyzed based on the application characteristics to obtain the cold storage trust attributes; since the cold storage behavior process is to store electronic evidence in the cold storage device according to the task issued by the user, the trust attribute analysis is performed on the observer, operation entity and operation object of the behavior; Step 1.2: Analyze the trust attributes of each target object; analyze the business trust attributes, including the correctness, timeliness and fault tolerance of business execution; and ensure the uniqueness of the archived results and the stability of the service process for the equipment trust attributes; The credibility of evidence requires ensuring the confidentiality and integrity of electronic evidence.

3. According to the method for extracting cold storage trusted behavior data based on Drain3 in judicial evidence storage in claim 1, it is characterized in that: The process of step 2 is as follows: Step 2.1: Trust attributes are a series of properties related to software trustworthiness. However, trust attributes still need to be combined with requirements to get an accurate description of whether the expected behavior is trustworthy. Software requirements refer to the description of the expected results of the software in the early stage of software development, while trust requirements are the trustworthiness-related requirements extracted from software requirements, laying the foundation for generating trustworthy behavior statements. First, we need to analyze the business requirements related to cold storage in the judicial evidence storage scenario. Cold storage is responsible for the archiving and burning functions. The business requirements in this function are: the platform sends the parameters of the archiving task to the cold storage device, and the cold storage device receives it correctly; the cold storage device establishes the archiving task according to the received parameters, and performs the archiving and burning operations according to the task; the archiving task should be executed regularly, and manual initiation is supported to avoid failure; After the cold storage device completes the burning, it shall return the execution result to the platform; Step 2.2: Based on the real judicial evidence storage scenario, the risks that may occur during cold storage archiving and burning include: the risk of parameter transmission errors, the risk of archiving duplication, the risk of unscheduled execution, and the risk of archiving results not being returned in time; Step 2.3: Based on the above trusted attribute classification and risk analysis, combined with the business requirements related to cold storage in the judicial evidence storage scenario, the trusted requirements for cold storage behavior are obtained, including four trusted requirements: receiving, archiving and burning, scheduled execution, and sending. The content corresponding to the requirements needs to be summarized in combination with the risks; Each requirement corresponds to one or more trusted attribute categories, and the archive and burn trusted requirements correspond to device trusted attributes and evidence trusted attributes.

4. According to the method for extracting cold storage trusted behavior data based on Drain3 in judicial evidence storage in claim 1, it is characterized in that: The step 3 specifically includes: Step 3.1: Behavior declaration refers to a set of descriptions of the application software's own behavior, which consists of a series of software behaviors and is described in XML format, which is highly readable. The behavior declaration is divided into two parts, the general part and the special part. The general part is the content that must be described in each behavior declaration, that is, the general rule entry, and the special part is different due to different target objects of the function. The general part of the behavior declaration includes the behavior number, behavior name, behavior execution time, behavior triggering condition, parameters, target object, and expected result. Step 3.2: The dedicated part of the behavior statement varies according to the behavior target object; in the above analysis of the trusted attributes, the trusted attributes are classified according to the behavior target object, and the behavior statement corresponding to the trusted attributes is also constructed in the dedicated part of the behavior statement according to the above classification.

5. According to the method for extracting cold storage trusted behavior data based on Drain3 in judicial evidence storage in claim 1, it is characterized in that: The specific process of step 4 is as follows: Step 4.1: Tracking is to inject code into the application process to collect relevant information of the process for tracking the execution status of the program; select log tracking to record the cold storage behavior trajectory, specifically using the logic branch tracking technology to record the log information related to the trusted requirements in the key logic branches, so as to obtain the cold storage behavior credibility by comparing the behavior declaration; use the logic branch tracking to ensure the coverage of the behavior trajectory record, and record various trusted indicators when the program is running in real time; Step 4.2: Use the method of logical branch tracking to record logs at the beginning of the program conditional judgment and for loop, and record the program execution path; use coding to record a group of logs of the same sub-function; the log format is as follows: [<SubFunctionName>-0-1]<Date><Time><Content> Among them, <SubFunctionName> represents the sub-function category, -0-1 code represents the execution path of the program, <Date> represents the date of logging, <Time> represents the time of logging, and <Content> represents the log content. In this sub-function, the first step of the encoding executes the path represented by 0, and the second step executes the path represented by 1. For example, in the process of checking the folder for archiving, the log header is [Archive Task-Folder Check-0-1], which means that in the folder judgment logic, the existence of the folder corresponds to code 0, and in the logic of judging whether the file is 0, the file size is 0 and corresponds to code 1. "-0-1" records the direction of the sub-function code in the logical branch. The running track of the program is obtained through the log of the archiving process.

6. According to the method for extracting cold storage trusted behavior data based on Drain3 in judicial evidence storage in claim 1, it is characterized in that: Step 5 is divided into the following steps: Step 5.1: First, the log to be parsed is covered with parameter regular expressions and word segmentation is performed to obtain a word segmentation list, and the word segmentation list is used to perform template matching in the parsing tree; in its parsing tree, special rules are designed for the root node and internal nodes to guide the search process. The first layer under the root node is the length node, and the next tree layer of the length node is the token. The tree is searched by matching the word segmentation results, and each path is calculated to end with the leaf node that records the log cluster; the similarity calculation formula is Where seq1 and seq2 represent log messages and log templates respectively, seq(i) is the i-th token in the sequence, n is the length of the log message in the sequence, and equation is: Among them, t1 and t2 are two tokens. If the calculated simSeq value is greater than the threshold, the log template is returned as the matching template.

7. According to claim 6, a cold storage trusted behavior data extraction method based on Drain3 in judicial evidence storage is characterized in that: The logs of the judicial evidence storage platform are in Chinese. Jieba's precise mode is used to segment the logs, perform log matching and parameter extraction. Before Jieba segments the log data, a regular expression for the data format is set to match characters that are easily segmented incorrectly, and placeholders are used to cover this part, and the string is recorded as part of the cold storage behavior data.

Images