A drain3-based cold storage trusted behavior data extraction method in judicial evidence preservation

Abstract

The application discloses a kind of cold storage trusted behavior data extraction methods based on Drain3 in judicial evidence, comprising the following steps: step 1: according to the constitutive elements in judicial evidence scene, respectively carry out trusted attribute analysis, obtain classified trusted attribute model.Step 2: according to untrusted problem and trusted attribute, extract trusted demand from demand analysis.Step 3: according to trusted demand construction formal description, obtain the part of "speech" in "speech and action consistent".Step 4: according to trusted demand focus, carry out log burying, using the way of logic branch burying, guarantee the coverage of behavior logic in code.Step 5: after parameter part is cleaned and selected, as cold storage behavior trusted related data, obtain the part of "action" in "speech and action consistent".The application divides trusted attribute under the scene of judicial evidence into business, equipment, evidence three dimensions, and is more targeted, when untrusted behavior appears, can quickly locate untrusted source.

Description

TECHNICAL FIELD

[0001] The application relates to the field of judicial evidence storage scenes and software credibility, and particularly relates to a cold storage credible behavior data extraction method based on Drain3 in a judicial evidence storage scene. BACKGROUND

[0002] Judicial evidence storage refers to the process of storing electronic evidence generated in the process of case trial in the judicial system. The electronic evidence may include video, document, transaction record and the like. A large amount of electronic evidence such as monitoring video is generated in the process of evidence collection and case trial of public security organs, and the electronic evidence needs to be retained for at least ten years after the case trial. Ordinary storage methods such as a disk have the characteristics of easy wear and easy change, and are not suitable for providing long-term and credible storage. Since the electronic evidence in the judicial evidence storage scene is mostly cold data, a corresponding storage method and storage strategy need to be taken for the cold data, that is, a cold storage method. Cold storage is a data storage method, which is mainly used for storing data that is not frequently accessed or does not need to be immediately accessed for a long time.

[0003] Since the cold storage device is the storage center of the judicial evidence storage scene, the credibility of the cold storage behavior greatly affects the credibility of the entire judicial evidence storage system. The current credibility problems that may exist in the cold storage device include archiving parameter error, archiving content repetition, timing execution error, result not returned in time and the like. In order to ensure the credibility of the judicial evidence storage scene, an effective detection mechanism needs to be set for the credibility problems, so as to help the administrator to timely locate the problems, and to provide data support for the calculation of the credibility of the cold storage behavior in the later period.

[0004] In the past research, credible researchers evaluate and research the credibility of software from multiple dimensions, by using different forms and methods, but in the current software credibility related research, there are few credibility researches related to a certain scene. The traditional credibility attributes include correctness, stability and the like, which cannot accurately trace the untrusted behavior, and further affect the analysis of the untrusted reason of the software. In the aspect of log analysis, researchers have proposed many log analysis algorithms such as Drain3, IPLoM, Spell, Logram, ULP algorithm and the like. The Drain3 analysis algorithm based on fixed depth analysis tree is selected in the application. The application will analyze the cold storage behavior in the judicial evidence storage simulation scene, propose a credibility attribute classification method according to the behavior constituent elements, and use the Drain3 algorithm to extract the credible part in the cold storage behavior according to the system log, so as to lay the foundation for the comparison of the behavior declaration and the credibility of the cold storage behavior in the later period. SUMMARY

[0005] In order to detect the possible untrusted problems of cold storage behavior in the current judicial evidence storage scene, the application provides a cold storage trusted behavior data extraction method based on Drain3, obtains trusted behavior statements ("speech") according to trusted attribute modeling and trusted demand analysis, and then carries out log burying points on the evidence storage platform according to trusted attributes, extracts trusted related data ("line") of cold storage behavior from the log of the judicial evidence storage platform according to the Drain3 algorithm, and finally obtains the cold storage behavior credibility through the comparison of the trusted rule "speech and action are consistent", and realizes the tracing of untrusted problems.

[0006] In order to achieve the above purpose, the application comprises the following steps:

[0007] Step 1: According to the constitutive elements in the judicial evidence storage scene, the trusted attribute analysis is carried out respectively, and the classified trusted attribute model is obtained.

[0008] Step 2: The demand analysis of the cold storage behavior related function in the judicial evidence storage scene is carried out, and the untrusted problems existing in the scene are analyzed, and the trusted demand is extracted from the demand analysis according to the untrusted problems and the trusted attributes.

[0009] Step 3: According to the trusted demand, the formal description is constructed, that is, the behavior statement general template is constructed, and then the construction of the behavior statement template corresponding to each demand is completed according to the characteristics of each trusted demand, and the part of "speech" in "speech and action are consistent" is obtained.

[0010] Step 4: According to the trusted demand focus, the log burying point is carried out, the logical branch burying point is adopted, the coverage rate of the behavior logic in the code is ensured, and each trusted index during the program running is recorded in real time.

[0011] Step 5: Based on the Drain3 algorithm, the log is analyzed, the log template and the parameter part are extracted, the parameter part is cleaned and selected as the trusted related data of the cold storage behavior, and the part of "line" in "speech and action are consistent" is obtained.

[0012] Further, the process of step 1 is as follows:

[0013] Step 1.1: The cold storage trusted attribute should be analyzed according to the application characteristics, and the cold storage trusted attribute is obtained. Since the main process of the cold storage behavior is to store the electronic evidence into the cold storage device according to the task issued by the user, the trusted attribute analysis can be carried out on the observer, the operation ontology and the operation object of the behavior.

[0014] Step 1.2: Based on the above theory, analyze the trusted attributes of each target object. For business trusted attributes, it can include the correctness, timeliness and fault tolerance of business execution; for device trusted attributes, it should ensure the uniqueness of the archived results and the stability of the service process; the evidence trusted attribute needs to ensure the confidentiality and integrity of the electronic evidence.

[0015] Further, the step 2 process is as follows:

[0016] Step 2.1: Trusted attributes are a series of properties related to software trustworthiness, but trusted attributes still need to be combined with requirements to get an accurate description of whether the expected behavior is trustworthy. Software requirements refer to the description of the expected results of software at the beginning of software development, and trusted requirements are extracted from software requirements related to trust, laying the foundation for generating trusted behavior statements.

[0017] First, the business requirements related to cold storage in the judicial evidence storage scene need to be analyzed. Cold storage is mainly responsible for archiving and burning functions. The business requirements in this function are: the platform sends the parameters of the archiving task to the cold storage device, and the cold storage device correctly receives it; the cold storage device establishes an archiving task according to the received parameters and performs archiving and burning operations according to the task; sending archiving tasks should be executed regularly to avoid the impact of failure, and manual initiation is supported; the cold storage device should return the execution result to the platform after completing the burning.

[0018] Step 2.2: Starting from the real judicial evidence storage scene, the risks that may occur in the cold storage archiving and burning process are: the risk of parameter transmission error, the risk of archiving duplication, the risk of not executing regularly, and the risk of not returning the archiving results in time.

[0019] Step 2.3: According to the above classification of trusted attributes and risk analysis, combined with the business requirements related to cold storage in the judicial evidence storage scene, the trusted requirements of cold storage behavior can be obtained, including four main trusted requirements of receiving, archiving and burning, regular execution, and sending. The content corresponding to the requirements needs to be summarized in combination with the risks. Each requirement corresponds to one or more trusted attribute categories, because the cold storage behavior execution process may involve operations on multiple target objects, such as operations on electronic evidence during burning, and also has certain requirements on the device, so the archiving and burning trusted requirements can correspond to device trusted attributes and evidence trusted attributes.

[0020] Further, the step 3 specifically includes:

[0021] Step 3.1: The behavior declaration refers to a set of descriptions of the application software for its own behavior, which is composed of a series of software behaviors. The application uses XML format to describe the software behaviors, which has strong readability. In the application, the behavior declaration is divided into two parts: the general part and the special part. The general part is the content that must be described in each behavior declaration, i.e., the general rule item, and the special part is different due to the different target objects of the function. The general part of the behavior declaration includes behavior number, behavior name, behavior execution time, behavior trigger condition, parameter, target object, expected result, etc.

[0022] Step 3.2: The special part of the behavior declaration is different according to the different target objects of the behavior. In the above analysis of the trusted attribute, the application classifies the trusted attribute according to the target object of the behavior, and constructs the behavior declaration corresponding to the trusted attribute in the special part of the behavior declaration according to the above classification. For example, in the judicial evidence preservation scenario, for the business, it is necessary to ensure the correctness of the archive execution result, which can be described by the return value of the archive method; for the device, it is necessary to ensure uniqueness, such as electronic evidence can only be stored once without repeated write operation, which can be described according to whether the file name recorded in the archiving process operation is repeated or not.

[0023] Further, the specific process of step 4 is as follows:

[0024] Step 4.1: The point is to inject code into a specific process of the application to collect relevant information of the process, which is generally used to track the execution status of the program. The application chooses the log point method to record the cold storage behavior track, and specifically adopts the logical branch point technology to record the log information related to the trusted demand at the key logical branch, so as to obtain the cold storage behavior trustworthiness of the behavior declaration. The logical branch point can ensure the coverage rate of the behavior track record. Since the logical branch is often an important path node in the program execution process, it can ensure the comprehensive coverage of the behavior track, and can record the real-time program running trust indicators.

[0025] Step 4.2: The application adopts the logical branch point method to record the log at the beginning of the conditional judgment and for loop of the program, which can record the program execution path more clearly. Due to the fluctuation of program running speed and log recording method calling time, the order of exporting logs in the same millisecond time before and after may have a small error with the program execution order, although it has little effect on the extraction of behavior data, but it is easy to cause the program running track not clear, therefore the application adopts the coding method to record a group of logs of the same sub-function. The log format is as follows:

[0026] [<SubFunctionName>-0-1]<Date><Time><Content>

[0027] Wherein, <SubFunctionName> represents a sub-function category, -0-1 code (variable length) represents the execution path of the program, <Date> represents the date of recording the log, <Time> represents the time of recording the log, and <Content> represents the log content. In the sub-function, the first step of the code executes the path represented by 0, and the second step executes the path represented by 1. For example, in the folder checking process of archiving, the log header is [archiving task - folder checking - 0-1], which indicates that in the folder judgment logic, the folder exists corresponding to the code 0, and in the file size 0 judgment logic, the file size is 0 corresponding to the code 1. The "-0-1" records the direction of the sub-function code in the logic branch. According to this coding mode, the running track of the program can be obtained through the log of the archiving process.

[0028] Finally, step 5 is divided into the following steps:

[0029] Step 5.1: Drain3 is an online log parsing method with a fixed depth tree, which only needs the log message itself to extract different log templates and their parameters. First, the log to be parsed is covered with a parameter regular expression, and the word segmentation list is obtained by word segmentation. The word segmentation list is used to match the template in the parsing tree. In its parsing tree, the root node and the internal node are designed with special rules to guide the search process. The first layer under the root node is the length node, and the next tree layer of the length node is the token. The tree is searched by matching the token results, and each path is calculated to end with a leaf node that records the log cluster. The similarity calculation formula is Wherein, seq1 and seq2 represent the log message and the log template respectively, seq(i) is the i-th token in the sequence, n is the length of the log message sequence, and equ is: Wherein, t1 and t2 are two tokens, and the simSeq value is calculated. If the value is greater than the threshold, the log template is returned as the matching template.

[0030] Since the judicial evidence platform log of the present application is in Chinese, the accurate mode of jieba is used for log segmentation in order to perform log matching and parameter extraction. However, since the processing of punctuation marks and letters by jieba can easily cause incorrect segmentation of some trusted attributes (such as file names), before jieba segments the log data, some regular expressions of general data formats need to be set to match these characters that are easily incorrectly segmented, and the placeholders are used to cover this part, and the string is recorded as part of the cold storage behavior data.

[0031] The beneficial effects produced by the above technical solutions are:

[0032] The application proposes a new trusted attribute classification method, which classifies the trusted attributes in the judicial evidence scene into three dimensions of business, equipment and evidence, is more targeted, and can quickly locate the untrusted source when untrusted behavior occurs. On this basis, the application analyzes the trusted demand according to the trusted attribute classification, and collects and analyzes the real log data through log burying, Drain3 algorithm. The program branch burying method can guarantee the path coverage of program execution, and can collect comprehensive log data as much as possible in the process of statistical cold storage behavior data. The Drain3 algorithm is superior to other algorithms in timeliness and parameter accuracy, and performs well in extracting behavior trusted related data. Through these research works, the application realizes the preliminary construction and formalization of "speech" (behavior declaration) and "action" (real behavior), and lays the foundation for subsequent cold storage behavior trustworthiness calculation. BRIEF DESCRIPTION OF DRAWINGS

[0033] The application will be better understood in connection with the accompanying drawings, in which Figure 1 It is a judicial evidence scene architecture diagram of the application, and the application mainly focuses on the archiving part from the judicial evidence platform to the cold storage device; Figure 2 It is a main flow chart in the archiving module; Figure 3 It is a log analysis schematic diagram. DETAILED DESCRIPTION

[0034] The specific embodiments of the application will be further described in detail below in combination with the accompanying drawings Figure 1 and examples. The following examples are used to illustrate the application, but the embodiments of the application are not limited thereto.

[0035] The main steps of the method provided by the application are as follows:

[0036] Step 1: analyze the trusted attributes of cold storage behavior, and construct a trusted attribute classification model.

[0037] Step 2: analyze the demand of cold storage related functions, extract trusted demand from demand analysis combined with risk and trusted attributes.

[0038] Step 3: construct a behavior declaration template according to the formal description of the trusted demand.

[0039] Step 4: according to the trusted demand focus, adopt the logical branch burying method for log burying.

[0040] Step 5: based on the Drain3 algorithm, analyze the log, compare with other log analysis algorithms, and obtain the cold storage behavior trusted related data.

[0041] As a preferred embodiment of the application, in step 1, the trusted attribute classification process is as follows:

[0042] Based on the aforementioned method for analyzing the trust attributes of behaviors from the perspectives of observers, operational entities, and operational objects, behavioral trust attributes can be categorized into business trust attributes, device trust attributes, and evidence trust attributes. Specifically, business trust attributes are user-oriented, i.e., the behavior observer, who is both the initiator of the task to which the behavior belongs and the receiver of the result; device trust attributes are device-oriented, i.e., the operational entity, who is the actual executor of the behavior; and evidence trust attributes are electronic evidence-oriented, i.e., the operational object, who is the user of the behavior. Based on this theory and implementation examples, this invention constructs the trust attribute classification shown in Table 1.

[0043] Table 1. Classification of Trustworthy Attributes

[0044]

[0045] In a preferred embodiment of the present invention, the extraction process of credible requirements in step 2 is as follows:

[0046] Step 2.1: Since this invention focuses on cold storage behavior, only the business requirements related to archiving and evidence preservation in the scenario are extracted, as detailed below:

[0047] The platform sends the archiving task parameters to the cold storage device, and the cold storage device receives them correctly.

[0048] The cold storage device creates an archiving task based on the received parameters and performs archiving and burning operations according to the task;

[0049] The archiving task should be executed on a scheduled basis. To avoid the impact of failure, manual initiation is also supported.

[0050] After the cold storage device completes the burning process, it should return the execution result to the platform.

[0051] Step 2.2: Based on the embodiments, the risks that may occur during the cold storage archiving process include:

[0052] Due to network issues or other problems, parameters are not transmitted in a timely manner or are transmitted incorrectly, causing the cold storage device to be unable to receive the correct parameters on time, which in turn affects subsequent archiving.

[0053] If archiving is interrupted due to power outages or other issues, the archived content will be duplicated when manually re-executed after a restart.

[0054] Except when initiated manually, the archiving process did not execute at the agreed time;

[0055] The archiving results and archived content were not returned to the user in a timely manner.

[0056] Step 2.3: Based on the above classification of trust attributes and risk analysis, and combined with the business requirements related to cold storage in judicial evidence preservation scenarios, the trust requirements for cold storage behavior can be obtained as shown in Table 2.

[0057] Table 2 table of trusted demand analysis

[0058]

[0059] As a preferred embodiment of the present application, in step 3, the behavior declaration template construction process is as follows:

[0060] Step 3.1: In the present application, the behavior declaration is divided into two parts, the general part and the special part, wherein the general part is the content that must be described for each behavior declaration, that is, the general rule item, and the special part is different due to the different target objects of the function. The behavior declaration general template is as follows.

[0061]

[0062] Step 3.2: For the embodiment, in the special part of the received behavior, the correctness of the parameter parameterCorrectness is determined by checking the parameter type and size, thereby ensuring the correctness of the parameter transmission and rejecting illegal data. The construction method of the behavior declaration corresponding to other trusted demands is similar to this.

[0063]

[0064] As a preferred embodiment of the present application, in step 4, the log burying process is as follows:

[0065] Step 4.1: combined with the attached Figure 1 After the electronic evidence download is completed, the timing archiving program will be executed, and the evidence archiving module needs to perform the sub-functions of physical path inspection, file inspection, creation of archiving tasks, archiving task execution, query of execution results, etc. The present application adopts the method of logical branch burying, records the log and some information related to the current trusted attributes at the beginning of the condition judgment and for loop of the program, which can more clearly record the program execution path, in addition, some key codes such as checking file size, archiving interface calling, retry creating archiving task, etc. will also bury the record of some trusted attribute related information of the current execution.

[0066] Step 4.2: The archiving log of the judicial evidence storage platform running for 30 days is recorded, and the archiving operation of 42 cameras and 12600 electronic evidences is performed, and 44286 log data are collected. The timing archiving program starts at 1 o'clock in the morning, which can avoid occupying too much network resource during office hours, and the daily execution time is about 1 hour, if abnormal conditions such as missing electronic evidence, cold storage device power failure, etc. occur, the archiving task of the day which is not completed can be manually started at other time.

[0067] As a preferred embodiment of the present application, in step 5, the log analysis process is as follows:

[0068] Step 5.1: The main function of the Drain3 algorithm is to extract the log template, which can match a log to the corresponding log template in the leaf node according to the traversal of the parse tree, and create a new traversal path according to the update of the parse tree, that is, create a new log template. The present application extracts the corresponding template of each log through the algorithm, matches the corresponding cold storage behavior of the log, and then obtains the log entries related to the cold storage behavior in the archiving process, extracts the parameters as the corresponding trusted behavior related information, such as the log template shown in FIG. 8. Figure 3

[0069] Step 5.2: The present application compares the Drain3 and the common IPLoM, Spell, Logram, ULP log parsing algorithms, and parses the cold storage log for each of the five log parsing algorithms. The average time (seconds) obtained by executing n times for each algorithm

[0070]

[0071] Table 3 Average time (seconds) of log parsing algorithm in parsing cold storage log

[0072] IPLoM Spell Drain3 Logram ULP 17.0001818 18.3967428 19.6450732 82.1755172 15.46787124

[0073] Step 5.3: Since the present application focuses on extracting parameter information in the log as cold storage real behavior data, it is necessary to compare the accuracy of each algorithm in extracting parameters. The present application lists the extraction results of each algorithm for the trusted related parameters in the log, and the effect is shown in Table 4.

[0074] Table 4 Effect of log parsing algorithm in parsing log parameters

[0075] algorithm category time login name path task id task name device name file name file size result Drain3 √ √ √ √ √ √ √ √ √ √ IPLoM √ √ √ × √ √ √ √ √ √ Spell √ √ √ × √ √ √ √ √ √ Logram √ √ √ × × √ × √ × ULP √ √ √ × √ √ √ √ √ ×

[0076] Among them, since Logram is a frequent word-based log parsing algorithm, it will determine whether the word segmentation is a parameter according to the word frequency of n-gram, so it is not easy to determine the threshold of judging frequent words. In addition, since the correctness and integrity of parameter extraction are the basis for judging the behavior trust in the judicial evidence scene, the frequency of occurrence is likely to contain trusted related parameters regardless of the level, so it is unreasonable to judge whether the word segmentation is extracted as a parameter according to the word frequency; the rest of the IPLoM, Spell, ULP algorithm is not accurate in extracting the path and archiving result, so the present application uses the experimental results of Drain3 as the cold storage behavior trusted related data, that is, "row".

[0077] ​The above merely describes preferred specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any skilled person in the art, according to the technical solution and inventive concept of the present application, makes equivalent replacement or change within the technical range disclosed by the present application, which should be within the protection scope of the present application.

Claims

1. A method for extracting trusted behavioral data from cold storage based on Drain3 in judicial evidence preservation, characterized in that, Includes the following steps: Step 1: Analyze the credibility attributes of each element in the judicial evidence preservation scenario to obtain a classified credibility attribute model; Step 2: Conduct a requirements analysis on the functions related to cold storage in judicial evidence preservation scenarios, analyze the untrustworthy issues in the scenarios, and extract trustworthy requirements from the requirements analysis based on the untrustworthy issues and trustworthy attributes. Step 3: Construct a formal description based on the trust requirements, that is, construct a general template for behavior declaration, and then construct the behavior declaration template corresponding to each requirement according to the characteristics of each trust requirement, so as to obtain the "speech" part of "consistency between words and deeds". Step 4: Implement log tracking based on trust requirements and concerns, using logical branch tracking to ensure coverage of behavioral logic in the code and record various trust metrics during program runtime in real time. Step 5: Parse the logs based on the Drain3 algorithm, extract the log template and parameter parts, clean and filter the parameter parts and use them as trusted data related to cold storage behavior to obtain the "action" part of "consistency between words and deeds"; The process of step 2 is as follows: Step 2.1: Trustworthy attributes are a series of properties related to software trustworthiness, but trustworthy attributes still need to be combined with requirements to obtain an accurate description of whether the expected behavior is trustworthy; software requirements refer to the description of the expected results of the software in the early stage of software development, while trustworthy requirements are trustworthy-related requirements extracted from software requirements, laying the foundation for generating trustworthy behavior declarations. First, it is necessary to analyze the business requirements related to cold storage in the judicial evidence preservation scenario. Cold storage is responsible for the archiving and burning function. The business requirements in this function are: the platform sends the parameters of the archiving task to the cold storage device, and the cold storage device receives them correctly; the cold storage device creates the archiving task according to the received parameters and performs the archiving and burning operation according to the task; the archiving task should be executed on a regular schedule, and manual initiation is supported to avoid failure. After the cold storage device completes the burning process, it should return the execution result to the platform. Step 2.2: Based on real judicial evidence preservation scenarios, the risks that may occur during the cold storage archiving and burning process include: the risk of parameter transmission errors, the risk of duplicate archiving, the risk of not executing on time, and the risk of not returning archiving results in a timely manner; Step 2.3: Based on the above trust attribute classification and risk analysis, and combined with the business requirements related to cold storage in judicial evidence preservation scenarios, we obtain the trust requirements for cold storage behavior, including four trust requirements: receiving, archiving and burning, scheduled execution, and sending. The content corresponding to each requirement needs to be summarized in conjunction with the risks. Each requirement corresponds to one or more trust attribute classifications. The trust requirement for archiving and burning corresponds to the trust attributes of the device and the trust attributes of the evidence. The specific process of step 4 is as follows: Step 4.1: Data tracking involves injecting code into the application process to collect relevant information about the process and track the execution status of the program. Log tracking is selected to record the cold storage behavior trajectory. Specifically, logical branch tracking technology is used to record log information related to trust requirements in key logical branches so as to compare the trustworthiness of cold storage behavior with the behavior declaration. Logical branch tracking ensures the coverage of behavior trajectory recording and records various trust indicators during program execution in real time. Step 4.2: Use logical branching to record logs at the start of conditional statements and for loops to track the program execution path; use coding to record logs for a group of identical sub-functions; the log format is as follows: [<SubFunctionName>-0-1]<Date><Time><Content> In this code, `<SubFunctionName>` represents the sub-function category, `-0-1` represents the execution path of the program, `<Date>` represents the date the log was recorded, `<Time>` represents the time the log was recorded, and `<Content>` represents the log content. Within this sub-function, the first step executes the path represented by 0, and the second step executes the path represented by 1. For example, in the process of checking archived folders, a log header of `[Archive Task - Folder Check -0-1]` indicates that in the folder judgment logic, the existence of the folder corresponds to code 0, and in the file size judgment logic, a file size of 0 corresponds to code 1. `-0-1` records the logical branching of this sub-function code. The program's execution trajectory is obtained through the logs of the archiving process.

2. The method for extracting trusted behavioral data from cold storage based on Drain3 in judicial evidence preservation according to claim 1, characterized in that, The process of step 1 is as follows: Step 1.1: The trusted attributes of cold storage should be analyzed based on the characteristics of the application to obtain the trusted attributes of cold storage; since the process of cold storage behavior is to store electronic evidence in cold storage device according to the task issued by the user, the trusted attributes of the observer, the operation subject and the operation object should be analyzed. Step 1.2: For each target object, analyze its trust attributes; for business trust attributes, include the correctness, timeliness, and fault tolerance of business execution; for device trust attributes, ensure the uniqueness of archived results and the stability of the service process. The credibility of evidence requires ensuring the confidentiality and integrity of electronic evidence.

3. The method for extracting trusted behavioral data from cold storage based on Drain3 in judicial evidence preservation according to claim 1, characterized in that, Step 3 specifically includes: Step 3.1: Behavior declarations are collections of descriptions of an application's own behavior. They consist of a series of software behaviors and are described using XML format, which is highly readable. Behavior declarations are divided into two main parts: a general part and a specific part. The general part contains the content that every behavior declaration must describe, i.e., the common rule entries. The specific part varies depending on the target object of the function. The general part of the behavior declaration includes behavior number, behavior name, behavior execution time, behavior triggering conditions, parameters, target object, and expected result. Step 3.2: The dedicated part of the behavior declaration varies depending on the target object of the behavior; in the above analysis of trusted attributes, trusted attributes were classified according to the target object of the behavior, and the behavior declaration corresponding to the trusted attributes is also constructed in the dedicated part of the behavior declaration according to the above classification.

4. The method for extracting trusted behavioral data from cold storage based on Drain3 in judicial evidence preservation according to claim 1, characterized in that, Step 5 consists of the following steps: Step 5.1: First, the logs to be parsed are covered with parameterized regular expressions and segmented into words to obtain a word list. This word list is then used for template matching in the parse tree. In the parse tree, specific rules are designed for the root node and internal nodes to guide the search process. The first level under the root node is the length node, and the next level under the length node is the token. The tree search is performed by matching the word segmentation results, and each path ends at the leaf node of the log cluster. The similarity calculation formula is... Where seq1 and seq2 represent the log message and log template respectively, seq(i) is the i-th token in the sequence, n is the length of the log message in the sequence, and equ is: t1 and t2 are two tokens. If the calculated simSeq value is greater than the threshold, the log template is returned as the matching template.

5. The method for extracting trusted behavioral data from cold storage based on Drain3 in judicial evidence preservation according to claim 4, characterized in that, The logs of the judicial evidence preservation platform are in Chinese. Jieba's precise mode is used to segment the logs, perform log matching and parameter extraction. Before jieba segments the log data, a regular expression for the data format is set to match characters that are easily segmented incorrectly. Placeholders are used to cover these parts, and the strings are recorded as part of the cold storage behavior data.

Images