Multi-feature information hidden document integrity verification and tampering positioning method

Abstract

The invention provides a multi-feature information hidden document integrity verification and tampering positioning method, and relates to the field of network security and digital document protection. The multi-feature information hidden document integrity verification and tampering positioning method comprises the following steps: S1, document multi-dimensional feature extraction and encryption: based on an original Word document, adopting an SHA-3 algorithm to calculate a full-text hash value as a content feature, and extracting document object model features such as paragraph hierarchy, table structure and the like through a DOM tree analyzer; after the two types of features are combined into a feature matrix, a dynamic secret key is generated through Logistic chaotic mapping for XOR encryption, and an encrypted document feature matrix is generated. A dynamic key is generated by combining Logistic chaotic mapping encryption through a multi-dimensional extraction technology fusing document content hash values and structural features, so that the anti-cracking capability of a feature matrix is remarkably improved, the confidentiality of document features in open network transmission is ensured, the block information retention rate is simulated and predicted by adopting Monte Carlo, and the watermark embedding weight is dynamically allocated.

Description

Technical Field

[0001] The present invention relates to the technical field of network security and digital document protection, and specifically to a method for document integrity verification and tampering location with multi-feature information hiding. Background Art

[0002] The technical field of network security and digital document protection focuses on ensuring the security, integrity, and credibility of electronic documents throughout their entire life cycle of generation, transmission, and storage. Its core technologies include document encryption, digital signatures, information hiding, tampering detection, and traceability. This field needs to address format compatibility attacks in an open network environment (such as metadata loss when converting from Word to PDF), content tampering (such as paragraph deletion or table modification), and forgery risks, while also meeting legal compliance requirements (such as the Electronic Signature Law). Among them, the method for document integrity verification and tampering location with multi-feature information hiding refers to a technical solution that combines document content hash values, structural features, and covert watermark embedding technology to achieve document tampering detection and precise location in an open network environment. Its core purpose is to ensure that highly sensitive documents such as electronic contracts and judicial files have not been illegally tampered with during transmission and storage. When tampering occurs, it can quickly locate the modified position (such as a specific paragraph or table cell), and support automated repair based on blockchain evidence storage or version control, thereby enhancing the legal effect and business credibility of digital documents, and providing technical support for privacy protection and data security.

[0003] Existing technologies mostly adopt a fixed partitioning method in document chunking strategies, without considering the impact of format conversion on the integrity of chunked information, resulting in the loss of key metadata in the watermark embedding area after operations such as converting from Word to PDF. For example, when the traditional method embeds a watermark in the header and footer, the watermark may not be extractable after conversion due to format compatibility issues. Existing watermark schemes mostly rely on the embedding of a single type of feature, such as only using hash values or structural features, making it difficult to balance robustness and concealment. When an attacker targets a specific embedding method (such as only tampering with paragraph content while retaining style attributes), false negatives or false positives are likely to occur. Summary of the Invention

[0004] Aiming at the deficiencies of the existing technology, the present invention provides a method for document integrity verification and tampering location with multi-feature information hiding, which solves the problem that existing technologies mostly adopt a fixed partitioning method in document chunking strategies, without considering the impact of format conversion on the integrity of chunked information, resulting in the loss of key metadata in the watermark embedding area after operations such as converting from Word to PDF. For example, when the traditional method embeds a watermark in the header and footer, the watermark may not be extractable after conversion due to format compatibility issues.

[0005] To achieve the above objectives, the present invention is realized through the following technical solutions: A method for document integrity verification and tampering location with multi-feature information hiding, including the following steps:

[0006] S1: Document multi-dimensional feature extraction and encryption. Based on the original Word document, the SHA-3 algorithm is used to calculate the full-text hash value as the content feature. At the same time, a DOM tree parser is used to extract document object model features such as paragraph levels and table structures. After merging the two types of features into a feature matrix, a dynamic key is generated using the Logistic chaotic map for XOR encryption to generate an encrypted document feature matrix;

[0007] S2: Dynamic chunking and watermark strategy allocation resistant to format interference. Based on the encrypted document feature matrix, a logical chunking algorithm is used to divide the document into paragraph-level blocks and table-level blocks. For each block, the information retention rate during format conversion is predicted through Monte Carlo simulation, and the watermark embedding weight is dynamically allocated: blocks with a retention rate > 80% are embedded with strong verification watermarks, and the remaining blocks are embedded with lightweight watermarks, generating a dynamic chunking strategy and watermark weight mapping table;

[0008] S3: Robust embedding of dual watermarks. Based on the dynamic chunking strategy and watermark weight mapping table, two types of watermark embeddings are performed. Content watermark: In the OpenXML metadata of the block, the global hash value is written using the LSB replacement algorithm. Structural watermark: In the paragraph style attributes, the local feature code of the block is embedded by fine-tuning the last digit of the numerical value, and the RS error correction code is used to enhance the anti-deletion and modification ability, generating a document to be verified with content watermarks and structural watermarks;

[0009] S4: Adaptive watermark extraction and evidence chain construction. For the document to be verified, a cross-version parser is designed to be compatible with.doc and.docx formats. The RAFT consensus algorithm is used to coordinate the watermark extraction process of multiple terminals. During extraction, content watermark: The global hash value is restored from the metadata, and the attention mechanism is used to screen the embedding bits least affected by format conversion. Structural watermark: The abnormal fluctuations of the paragraph style numerical values are detected through differential analysis, and the local feature code is restored in combination with the BCH decoder to generate a tampering evidence chain;

[0010] S5: Multi-scale tampering localization and repair trigger. Based on the encrypted document feature matrix and the tampering evidence chain, coarse-grained localization is performed: The phase correlation algorithm is used to compare DOM structure features to identify paragraph additions, deletions, or table structure adjustments. Fine-grained localization: The improved Needleman-Wunsch sequence alignment algorithm is used to match local feature codes to locate character-level tampering. Automatic repair: When it is detected that > 5% of the blocks are tampered with, the incremental rollback mechanism based on the version control system is triggered, and the original feature matrix stored in the blockchain is called for repair, generating a tampering localization report.

[0011] Preferably, the generation of the encrypted document feature matrix in S1 includes the following steps;

[0012] S101: Based on the original Word document, traverse the document object model using a DOM tree parser, extract the paragraph hierarchical relationship, table row-column structure, and style inheritance chain, and generate DOM tree structure data;

[0013] S102: Based on the original document binary stream, calculate the 256-bit full-text digest value using the Secure Hash Algorithm 3, and at the same time generate the cyclic redundancy check code for each paragraph of text through the CRC-64 algorithm, generating a full-text hash value and a set of segmented check codes;

[0014] S103: Combine the DOM tree structure data with the set of segmented check codes into a feature matrix, perform dimensionality reduction processing using the principal component analysis method, eliminate redundant features, and generate a dimensionality-reduced document feature matrix;

[0015] S104: Generate a dynamic key sequence based on the Logistic chaotic map, perform exclusive OR encryption on the dimensionality-reduced document feature matrix, and the initial value of the key is derived from the hash of the document creation timestamp, generating an encrypted document feature matrix.

[0016] Preferably, the generation of the dynamic chunking strategy and the watermark weight mapping table in S2 includes the following steps;

[0017] S201: Based on the DOM tree structure data, establish a logical chunking rule: the paragraph block is <w:p>Label as the boundary, the table block is arranged according to <w:tbl>Division, Picture Block Recognition <w:drawing>Generate an initial block rule table for the tags;

[0018] S202: For each block in the initial block rule table, use the Monte Carlo method to simulate 1000 format conversions, count the retention probability of the metadata tags, and generate a block information retention rate prediction table;

[0019] S203: Based on the block information retention rate prediction table, dynamically allocate watermark embedding weights: allocate BCH(127,64) error correction codes to blocks with a retention rate ≥ 80%, and use CRC-32 lightweight verification for the remaining blocks to generate a watermark strategy weight allocation table;

[0020] S204: Optimize the matching between the block boundaries and the watermark strategy through the Hungarian algorithm, eliminate the strategy conflicts in the overlapping areas of the blocks, ensure that the watermarks of adjacent blocks do not interfere with each other, and generate a dynamic block strategy and watermark weight mapping table.

[0021] Preferably, the steps for generating the document to be verified with content watermark and structure watermark based on S3 are as follows;

[0022] S301: Based on the dynamic block strategy and watermark weight mapping table, in the OpenXML format <w:rsid>Implement the least significant bit substitution in the label, encode the global hash value as an 8-bit binary sequence and embed it to generate a document with the content watermark initially embedded;

[0023] S302: For each logical block of the document with the content watermark initially embedded, extract the paragraph style attributes, write the local feature code by fine-tuning the last digit of the value by ±1pt, and generate a document with the structural watermark marked;

[0024] S303: For the document with the structural watermark marked, perform redundant encoding on the watermark data using the Reed-Solomon error correction code, and insert 16-byte check information at the document footer to generate a watermark document with the error correction code;

[0025] S304: Simulate the format conversion attack through the generative adversarial network, detect the survival rate of the watermark, and perform secondary embedding compensation on the blocks with a failure rate > 5% to generate a document to be verified with the content watermark and the structural watermark.

[0026] Preferably, generating the tampering evidence chain based on S4 includes the following steps;

[0027] S401: For the document to be verified, design a cross-version parser to identify the OLE stream of.doc and the Zip compression structure of.docx, and uniformly convert them into a DOM tree representation to generate a standardized DOM tree structure;

[0028] S402: Based on the standardized DOM tree structure, use the RAFT consensus algorithm to coordinate the extraction results of multiple terminals, perform majority voting error correction on the content watermark, and generate a decentralized watermark extraction result;

[0029] S403: Separate the global hash and the local feature code from the decentralized watermark extraction result, and screen the high-confidence embedding bits through the attention mechanism to generate a purified watermark data set;

[0030] S404: Compare the purified watermark data set with the encrypted document feature matrix, calculate the hash deviation rate and the feature code mismatch degree, construct a timestamp signature evidence chain, and generate a tampering evidence chain.

[0031] Preferably, generating the tampering location report based on S5 includes the following steps;

[0032] S501: Based on the encrypted document feature matrix, use the phase correlation algorithm to compare the spatial distribution of DOM tree nodes, detect paragraph addition and deletion, table structure adjustment, and generate a coarse-grained tampering area identification map;

[0033] S502: Within the range of the coarse-grained tampering area identification map, apply the improved Needleman-Wunsch algorithm for character-level sequence alignment, locate the ±3 character offset, and generate a fine-grained tampering coordinate list;

[0034] S503: Calculate the tampering impact factor based on the block mismatch degree in the tampering evidence chain. If more than 5% of the blocks are damaged, trigger the Git-based incremental version rollback mechanism to generate a document repair decision instruction.

[0035] S504: Integrate the coarse-grained and fine-grained positioning results and repair instructions, generate a visualization report, and automatically call the original feature matrix of the blockchain deposit evidence for repair verification to generate a tampering positioning report.

[0036] A document integrity verification and tampering positioning system with multi-feature information hiding. The positioning system includes the following modules: a feature processing module, a watermark embedding module, and a verification and positioning module.

[0037] The feature processing module, based on the original Word document, uses a DOM tree parser to extract paragraph-level and table structure features, calculates the full-text hash value through the SHA-3 algorithm, encrypts the feature matrix using the Logistic chaotic map, and at the same time, based on Monte Carlo simulation, predicts the block retention rate, dynamically divides logical blocks, and generates an encrypted document feature matrix and a dynamic block division strategy table.

[0038] The feature processing module includes a document parsing sub-module, a feature encryption sub-module, and a dynamic block division sub-module.

[0039] The watermark embedding module, based on the encrypted document feature matrix and the dynamic block division strategy table, embeds the global hash value in the OpenXML metadata using the least significant bit replacement algorithm, writes the local feature code through paragraph style fine-tuning technology, combines the Reed-Solomon error correction code to enhance the anti-deletion and modification ability, and finally verifies the watermark robustness against the generative adversarial network to generate a document to be verified with double watermarks.

[0040] The watermark embedding module includes a metadata embedding sub-module, a style fine-tuning sub-module, and an error correction enhancement sub-module.

[0041] The verification and positioning module, based on the document to be verified with double watermarks, designs a cross-version parser to extract watermark data, screens high-confidence features through the attention mechanism, calculates the hash deviation by comparing with the encrypted document feature matrix, uses the phase correlation algorithm to coarsely locate the structural tampering, improves the sequence alignment algorithm to accurately locate the character offset, and triggers the blockchain deposit evidence repair mechanism to generate a multi-scale tampering positioning report.

[0042] The verification and positioning module includes a watermark extraction sub-module, a feature comparison sub-module, and a repair trigger sub-module.

[0043] Preferably, the document parsing sub-module, based on the original Word document, traverses the OpenXML structure using a DOM tree parser to extract the paragraph-level relationship ( <w:p>Label), table row and column attributes( <w:tbl>) and style inheritance chain( <w:styles>), generate DOM tree structure data and style attribute table;

[0044] Feature encryption sub-module, based on the DOM tree structure data and style attribute table, calculates the full-text hash value through the SHA-3 algorithm, constructs a feature matrix by combining paragraph-level CRC-64 check codes, and generates a dynamic key through Logistic chaotic mapping for XOR encryption to generate an encrypted document feature matrix;

[0045] Dynamic block division sub-module, based on the encrypted document feature matrix, simulates 1000 format conversions using the Monte Carlo method, statistically calculates the block metadata retention rate, optimizes the block boundary and watermark strategy matching through the Hungarian algorithm, and generates a dynamic block division strategy and watermark weight mapping table.

[0046] Preferably, the metadata embedding sub-module, based on the dynamic block division strategy and watermark weight mapping table, in OpenXML's <w:rsid>Implement the least significant bit replacement in the label, encode the global hash value as an 8-bit binary sequence and embed it to generate a content watermark marked document;

[0047] The style fine-tuning sub-module, based on the content watermark marked document, extracts the paragraph style attributes, writes the last digit of the fine-tuning value with ±1pt into the local feature code, generates a structure watermark mark, and generates a structure watermark marked document;

[0048] The error correction and enhancement sub-module performs redundant encoding of the watermark data on the structure watermark marked document using the Reed-Solomon error correction code, inserts 16-byte check information in the footer, and verifies the robustness through an adversarial generative network simulation attack to generate a document to be verified with double watermarks.

[0049] Preferably, the watermark extraction sub-module, based on the document to be verified with double watermarks, designs a cross-version parser to extract metadata and style attributes, coordinates multi-terminal data through the RAFT consensus algorithm, and uses the attention mechanism to screen high-confidence watermark bits to generate a purified watermark data set;

[0050] The feature comparison sub-module, based on the purified watermark data set and the encrypted document feature matrix, calculates the global hash deviation rate, detects the DOM structure offset through the phase correlation algorithm, locates paragraph and table-level tampering, and generates a heat map of the tampering area;

[0051] The repair trigger sub-module, based on the heat map of the tampering area, aligns the character sequences using the improved Needleman-Wunsch algorithm, locates ±3 character-level tampering, and triggers the blockchain evidence storage repair mechanism when the mismatch rate > 5%, generating a multi-scale tampering location report.

[0052] The present invention provides a method for document integrity verification and tampering location with multi-feature information hiding. It has the following beneficial effects:

[0053] The present invention significantly enhances the anti-cracking ability of the feature matrix and ensures the confidentiality of document features during open network transmission by integrating a multi-dimensional extraction technology that combines document content hash values and structural features, and generating dynamic keys through Logistic chaotic mapping encryption. Monte Carlo simulation is used to predict the block information retention rate, and the watermark embedding weight is dynamically allocated. Strong verification watermarks are embedded in high-retention-rate blocks, and lightweight watermarks are used in low-retention-rate blocks, effectively solving the problem of verification failure caused by metadata loss during format conversion in traditional static block segmentation. A dual watermark mechanism is introduced. The global hash value is written in the OpenXML metadata through the LSB replacement algorithm, and at the same time, the local feature code is embedded by fine-tuning the last digit of the value in the paragraph style attribute. The RS error correction code is used to enhance the anti-deletion and modification ability, achieving a balance between the robustness and concealment of the watermark. A cross-version parser is designed to be compatible with different format documents. The RAFT consensus algorithm is combined to coordinate watermark extraction on multiple terminals. The attention mechanism is used to screen high-confidence embedding positions, and the local feature code is restored by combining differential analysis and the BCH decoder, greatly improving the accuracy of tampering detection. Coarse-grained positioning is achieved by comparing DOM structural features through the phase correlation algorithm, and character-level precise positioning is completed by improving the Needleman-Wunsch sequence alignment algorithm to match the local feature code. When a tampered block exceeding the set threshold is detected, an incremental rollback mechanism based on version control is triggered, and the original feature matrix stored in the blockchain is called for repair, forming a closed-loop verification chain from detection, positioning to repair, and finally achieving a tampering detection rate of 99.2% and a positioning accuracy of ±3 characters. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 is a system block diagram of the present invention;

[0055] Figure 2 is a schematic diagram of the main steps of the present invention;

[0056] Figure 3 is a detailed schematic diagram of S1 of the present invention;

[0057] Figure 4 is a detailed schematic diagram of S2 of the present invention;

[0058] Figure 5 is a detailed schematic diagram of S3 of the present invention;

[0059] Figure 6 is a detailed schematic diagram of S4 of the present invention;

[0060] Figure 7 is a detailed schematic diagram of S5 of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0061] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0062] Embodiment:

[0063] As Figures 1-6 shown, the embodiment of the present invention provides a method for document integrity verification and tampering location with multi-feature information hiding, including the following steps:

[0064] S1: Document multi-dimensional feature extraction and encryption. Based on the original Word document, the SHA-3 algorithm is used to calculate the full-text hash value as the content feature. At the same time, the document object model features such as paragraph level and table structure are extracted through the DOM tree parser. After combining the two types of features into a feature matrix, a dynamic key is generated by the Logistic chaotic mapping for exclusive-or encryption to generate an encrypted document feature matrix;

[0065] S2: Dynamic block division and watermark strategy allocation against format interference. Based on the encrypted document feature matrix, the logical block algorithm is used to divide the document into paragraph-level blocks and table-level blocks. For each block, the information retention rate during format conversion is predicted through Monte Carlo simulation, and the watermark embedding weight is dynamically allocated: blocks with a retention rate > 80% are embedded with strong verification watermarks, and the remaining blocks are embedded with lightweight watermarks, generating a dynamic block division strategy and watermark weight mapping table;

[0066] S3: Robust embedding of dual watermarks. Based on the dynamic block division strategy and watermark weight mapping table, two types of watermark embeddings are performed. Content watermark: In the OpenXML metadata of the block, the global hash value is written using the LSB replacement algorithm. Structural watermark: In the paragraph style attributes, the local feature code of the block is embedded by fine-tuning the last digit of the numerical value, and the RS error correction code is used to enhance the anti-deletion and modification ability, generating a document to be verified with content watermark and structural watermark;

[0067] S4: Adaptive watermark extraction and evidence chain construction. For the document to be verified, a cross-version parser is designed to be compatible with.doc and.docx formats. The RAFT consensus algorithm is used to coordinate the watermark extraction process of multiple terminals. During extraction, content watermark: The global hash value is restored from the metadata, and the attention mechanism is used to screen the embedding bits least affected by format conversion. Structural watermark: The abnormal fluctuations of the paragraph style numerical values are detected through differential analysis, and the local feature code is restored in combination with the BCH decoder to generate a tampering evidence chain;

[0068] S5: Multi-scale Tampering Location and Repair Trigger. Based on the encrypted document feature matrix and the tampering evidence chain, perform coarse-grained location: Use the phase correlation algorithm to compare DOM structure features, identify paragraph addition / deletion or table structure adjustment. Fine-grained location: Match local feature codes through an improved Needleman-Wunsch sequence alignment algorithm to locate character-level tampering. Automatic repair: When it is detected that more than 5% of the blocks are tampered, trigger the incremental rollback mechanism based on the version control system, call the original feature matrix stored in the blockchain for repair, and generate a tampering location report.

[0069] The generation of the encrypted document feature matrix in S1 includes the following steps;

[0070] S101: Based on the original Word document, use a DOM tree parser to traverse the document object model, extract the paragraph hierarchical relationship, table row-column structure, and style inheritance chain, and generate DOM tree structure data;

[0071] Based on the original Word document, when using a DOM tree parser to traverse the document object model and extract the paragraph hierarchical relationship, identify all w:p tags in the document, record the hierarchical depth of the parent node and the number of child nodes of each paragraph. When traversing the table structure, parse the w:tr and w:tc tags under the w:tbl tag, count the number of rows m and columns n. The extraction of the style inheritance chain is achieved by recursively accessing the w:styles node, recording the inheritance path of font name, font size, and color attributes. Store the paragraph hierarchical relationship as a tree-structured JSON data, convert the table row-column structure into a two-dimensional array, and save the style inheritance chain in the form of a linked list to generate DOM tree structure data.

[0072] S102: Based on the original document binary stream, use the Secure Hash Algorithm 3 to calculate the 256-bit full-text digest value, and at the same time generate the cyclic redundancy check code for each paragraph of text through the CRC-64 algorithm to generate a full-text hash value and a set of segment check codes;

[0073] Based on the original document binary stream, use the Secure Hash Algorithm 3 to calculate the 256-bit full-text digest value. Divide the document binary data into 512-byte blocks, perform Keccak-256 hash operations on each block, and when processing the final block, pad the length to 512 bytes and output a 256-bit hexadecimal string. At the same time, generate the cyclic redundancy check code for each paragraph of text through the CRC-64 algorithm. Divide the document into text blocks by paragraph, convert each text block into a UTF-8 byte stream, use the polynomial 0x42F0E1EBA9EA3693 of the ECMA-182 standard as the generating polynomial to calculate the 64-bit redundancy check code, and store the full-text hash value and the CRC-64 codes of each paragraph in the hash table in paragraph order to generate a full-text hash value and a set of segment check codes.

[0074] S103: Merge the DOM tree structure data and the segmented check code set into a feature matrix, perform dimensionality reduction processing using the principal component analysis method to eliminate redundant features, and generate a dimensionality-reduced document feature matrix;

[0075] Merge the DOM tree structure data and the segmented check code set into a feature matrix, perform dimensionality reduction processing using the principal component analysis method, and calculate the covariance matrix according to the formula

[0076]

[0077] to eliminate redundant features.

[0078] In the formula, C represents the covariance matrix, X represents the standardized feature matrix, and n represents the number of samples.

[0079] In the calculation of the covariance matrix, X is an m×n-dimensional matrix, m is the number of features (the number of DOM tree nodes + the number of paragraphs), n is the number of samples (fixed at 1), the standardization process performs z-score normalization on each feature column, the mean μ is calculated from the feature column data, and the standard deviation σ is obtained from the formula

[0080]

[0081] In an actual example, the number of DOM tree nodes is 58, the number of paragraphs is 23, an 81-dimensional feature vector is constructed, the covariance matrix is calculated after normalization, the first k principal components are selected by eigenvalue decomposition (k is determined according to the cumulative variance contribution rate ≥ 95%), and when k = 12, the cumulative contribution rate reaches 96.3%. After dimensionality reduction, a 12-dimensional feature matrix is generated. This result shows that the dimensionality reduction processing compresses the original 81-dimensional features to 12 dimensions, retains more than 95% of the information, and eliminates noise and redundancy.

[0082] S104: Generate a dynamic key sequence based on the Logistic chaotic map, perform exclusive-OR encryption on the dimensionality-reduced document feature matrix, and the initial value of the key is derived from the hash of the document creation timestamp to generate an encrypted document feature matrix.

[0083] Generate a dynamic key sequence based on the Logistic chaotic map, set the chaos system parameter r = 3.999, the initial value x0 is taken as the modulus 1 of the decimal value converted from the first 8 bytes of the SHA-256 hash value of the document creation timestamp, and the iteration formula x□ +1 = r·x□(1 - x□) generates a chaotic sequence, intercept the first 2048 values, multiply each value by 10 8 and then take the integer part, convert it into a binary sequence, perform an exclusive-OR operation with the dimensionality-reduced document feature matrix bit by bit. Each element of the feature matrix is converted into 8-bit binary, padded with zeros for insufficient bits, and after exclusive-OR operation bit by bit, it is recombined into a decimal value to generate an encrypted document feature matrix.

[0084] The generation of the dynamic chunking strategy and the watermark weight mapping table in S2 includes the following steps;

[0085] S201: Based on the DOM tree structure data, establish a logical chunking rule: The paragraph block is <w:p>The label is the boundary, and the table block is arranged according to <w:tbl>Division, Picture Block Recognition <w:drawing>Labels are used to generate an initial chunking rule table;

[0086] When establishing logical chunking rules based on DOM tree structure data, all w:p labels in the document are parsed, and the start offset position and end offset position of each paragraph are recorded. The label nesting depth greater than or equal to 1 is used as the paragraph block boundary. When traversing the w:tbl label, the number of rows m and columns n of each table are counted, and the area containing consecutive w:tr labels is defined as the table block. The image embedding information under the w:drawing label is identified, the image size and DPI parameters are extracted, and the image area with a resolution greater than 300 DPI is marked as the picture block, generating an initial chunking rule table containing the coordinate information of paragraphs, tables, and picture blocks.

[0087] S202: For each block in the initial chunking rule table, the Monte Carlo method is used to simulate 1000 format conversions, the retention probability of metadata labels is statistically calculated, and a block information retention rate prediction table is generated;

[0088] For each block in the initial chunking rule table, the Monte Carlo method is used to simulate 1000 format conversions. The converter parameters are set to two environments: LibreOffice 7.2 and Adobe Acrobat DC 2021. Each simulation randomly selects a conversion tool, records the number of metadata labels retained in the block after conversion, and statistically calculates <w:rsid>The number of times the label exists after conversion. Calculate the retention probability P = number of retained times / total number of simulation times. When P ≥ 0.8, it is marked as a high retention rate block, and the rest are marked as low retention rate blocks. Generate a block information retention rate prediction table containing the ID of each block, the retention probability value, and the classification mark.

[0089] S203: Based on the block information retention rate prediction table, dynamically allocate watermark embedding weights: Blocks with a retention rate ≥ 80% are allocated BCH(127,64) error correction codes, and the remaining blocks use CRC-32 lightweight verification to generate a watermark strategy weight allocation table.

[0090] When dynamically allocating watermark embedding weights based on the block information retention rate prediction table, for the blocks marked as high retention rate, set the BCH(127,64) error correction code parameters. The selected generating polynomial is x 6 +x+1, which can correct t = 10-bit errors. For the low retention rate blocks, set the CRC-32 generating polynomial to 0x04C11DB7, and the initial register value to 0xFFFFFFFF. Write the error correction code type and parameters into the configuration table according to the block ID to generate a watermark strategy weight allocation table containing the block ID, watermark type, and error correction parameters.

[0091] S204: Optimize the matching of the block boundary and the watermark strategy through the Hungarian algorithm, eliminate the strategy conflicts in the overlapping area of the blocks, ensure that the watermarks of adjacent blocks do not interfere with each other, and generate a dynamic block strategy and watermark weight mapping table.

[0092] Optimize the matching of the block boundary and the watermark strategy through the Hungarian algorithm, according to the formula

[0093] min∑c ij x ij

[0094] Construct a minimum weight matching model to eliminate strategy conflicts.

[0095] In the formula, cij represents the conflict cost between block i and strategy j, and xij is a 0-1 decision variable.

[0096] The conflict cost cij is calculated through the block overlap degree and strategy compatibility. The overlap degree is defined as the ratio of the overlapping area between block i and adjacent block k. The calculation formula is

[0097]

[0098] Where Ai∩k is the overlapping area, Ai is the total area of block i, δ(sj, sk) is the compatibility index between strategy j and adjacent strategy k (compatible is 0, incompatible is 1), and λ = 0.6 is the weight coefficient. In the actual example, the overlapping area ratio between block i and k is 0.25, δ between strategy j and k is 1, and cij = 0.25 + 0.6×1 = 0.85 is calculated. Through the Hungarian algorithm, all cij are traversed to construct a 5×5 cost matrix, and a matching scheme with a minimum total cost of 3.2 is found to generate a conflict-free dynamic block strategy and watermark weight mapping table. The result shows that the conflict cost of the optimized strategy is reduced by 62%, meeting the requirement of non-interference for watermark embedding.

[0099] Generating the document to be verified with content watermark and structure watermark based on S3 includes the following steps;

[0100] S301: Based on the dynamic block strategy and watermark weight mapping table, in the OpenXML format <w:rsid>Implement the least significant bit substitution in the label, encode the global hash value as an 8-bit binary sequence and embed it to generate a preliminary embedding of the content watermark into the document;

[0101] Based on the dynamic block strategy and the watermark weight mapping table, divide the document into logical blocks according to the paragraph length and label density. The paragraph length threshold is set to 200 characters, and the label density is calculated by <w:rsid>The ratio of the number of tag occurrences to the total number of tags in a paragraph triggers chunk splitting when the paragraph length exceeds 200 characters or the tag density is lower than 0.3. After splitting, each logical chunk contains 5 to 8 paragraphs. The weight mapping table generates a weight coefficient based on the tag density and character count within the chunk. The weight coefficient w = 0.6 × tag density + 0.4 × (character count / 1000), for each <w:rsid>Replace the least significant bit of the label. After generating the global hash value through SHA-256, intercept the first 8 bits and convert them into a binary sequence. Sort according to the weight coefficient to select the embedding position, and initially embed the content watermark into the document.

[0102] S302: For each logical block of the document with the content watermark initially embedded, extract the paragraph style attributes, and write the local feature code by fine-tuning the last digit of the numerical value by ±1pt to generate a document marked with a structural watermark;

[0103] For each logical block of the document with the content watermark initially embedded, extract the paragraph style attributes, including font size, line spacing, and indentation value. Convert the attribute values into floating-point data, retain two decimal places, extract the last digit, and judge the parity. According to the binary bit sequence of the local feature code, adjust the parity of the last digit. The feature code consists of 4 bits of binary and is used cyclically in order. For example, when the feature code is "1011", the last digit of the first logical block is adjusted to an odd number, the second is adjusted to an even number, the third is adjusted to an odd number, and the fourth is adjusted to an odd number. After traversing all logical blocks and completing the fine-tuning of the last digit, rewrite the document style attributes to generate a document marked with a structural watermark.

[0104] S303: For the document marked with a structural watermark, perform redundant encoding on the watermark data using the Reed-Solomon error correction code, and insert 16-byte check information at the document footer to generate a watermark document with an error correction code;

[0105] Perform redundant encoding on the watermark data using the Reed-Solomon error correction code, according to the formula

[0106]

[0107] Calculate the generator polynomial, where t represents the error correction capacity, α is the primitive element of the Galois field, and b is the starting offset.

[0108] In the formula, t represents the number of correctable error symbols, α is the primitive element of the Galois field GF(2^8), and b is set to 1.

[0109] The generator polynomial of the Reed-Solomon code consists of elements of the Galois field, and the parameter t is determined by the length of the watermark data and the number of check bits. For 16-byte check information, t = 8, and the error correction ability is 8 symbol errors. The primitive element α of the Galois field GF(28) satisfies the irreducible polynomial x8 + x^4 + x^3 + x^2 + 1 = 0. The generator polynomial g(x) expands to:

[0110] g(x) = (x - α 1 )(x - α 2 )...(x - α 15 )

[0111] After expansion, the polynomial coefficients are calculated through multiplication and addition within the field. For example, when t = 8, the highest degree of the generating polynomial is 16, corresponding to 16 - byte check information. During specific calculation, the initial information polynomial m(x) is the watermark data. The encoding process is to multiply m(x) by x^{16} and then divide it by g(x) to obtain the remainder polynomial r(x) as the check code.

[0112] Example: The watermark data is 0x12, 0x34, 0x56 (3 bytes), which is converted into the polynomial m(x)=0x12x^2 + 0x34x + 0x56. Multiplying by x{16} gives x{18}+0x34x^{17}+0x56x{16}. Performing polynomial division within the GF(28) field by dividing by g(x)=x^{16}+0x1Dx^{15}+...+0xEC, the remainder r(x)=0xA7x^{15}+...+0x3B is obtained, corresponding to the 16 - byte check code 0xA7,...,0x3B. This result shows that the check code is obtained from the operation of the generating polynomial and the watermark data, providing error - correction ability after being embedded in the document footer.

[0113] S304: Simulate format - conversion attacks through the generative adversarial network to detect the survival rate of watermarks. Perform secondary embedding compensation on the blocks with a failure rate > 5%, and generate a document to be verified containing content watermarks and structural watermarks.

[0114] For the watermark document with error - correction codes, simulate format - conversion attacks through the generative adversarial network, load three converters for PDF, HTML, and plain text, respectively perform document format conversion, parse the document content after conversion, and extract <w:rsid>The label value and paragraph style attributes are used to detect the survival of the watermark information, and the watermark bit loss rate of each block is counted. Each block is divided into a detection unit every 100 labels, and the loss rate within the unit is calculated. If the loss rate exceeds 5%, the starting label index of the unit is recorded. For the unit with an excessive failure rate, the embedding process from S301 to S303 is re-executed, and a new hash sequence and feature code are used for secondary embedding. The compensated data blocks are merged to generate a document to be verified with content watermark and structure watermark.

[0115] Based on S4, generating the tampering evidence chain includes the following steps;

[0116] S401: For the document to be verified, design a cross-version parser to identify the OLE stream of.doc and the Zip compression structure of.docx, and uniformly convert them into DOM tree expressions to generate a standardized DOM tree structure;

[0117] For the document to be verified, parse the OLE stream structure of the.doc file, extract the WordDocument stream and 1Table stream under the root storage directory, identify the text content and format control characters, parse the Zip compression package of the.docx file, traverse word / document.xml after decompression to obtain the body elements, compare the paragraph tags and style attributes of the two formats, map the font name to UTF-8 encoding, convert the font size to a floating point type, quantify the line spacing by point value, normalize the indent value by character width, construct DOM nodes with a hierarchical relationship, and each node stores the label type, text content, and style set to generate a standardized DOM tree structure.

[0118] S402: Based on the standardized DOM tree structure, use the RAFT consensus algorithm to coordinate the extraction results of multiple terminals, perform majority voting error correction on the content watermark, and generate a decentralized watermark extraction result;

[0119] Based on the standardized DOM tree structure, deploy a RAFT consensus node cluster, set the number of nodes to 5, and the election timeout to 150ms - 300ms. Each node independently extracts the <w:rsid>The LSB sequence of the label, and the extraction result is encapsulated as a log entry. The master node collects the log entries of the majority (at least 3 nodes), compares the binary sequences extracted by each node, statistically counts the occurrence frequency bit by bit. When the occurrence times of a certain bit ≥ 3, it is determined as the valid value of this bit. The different bits trigger the error correction process, re-read the LSB value of the corresponding label in the DOM tree, and generate the decentralized watermark extraction result.

[0120] S403: Separate the global hash and local feature codes from the decentralized watermark extraction result, screen the high-confidence embedding bits through the attention mechanism, and generate a purified watermark dataset;

[0121] Separate the first 256 bits from the decentralized watermark extraction result as the global hash, and divide the remaining part into 64-bit groups of local feature codes according to logical blocks. The attention mechanism calculates the confidence score of each feature code bit, and the score formula is where c jk represents the confidence mark of the j-th bit by the k-th node (1 for certain, 0 for suspicious). Screen the bits with a score ≥ 0.8, eliminate the bits with a score < 0.6, and the intermediate values trigger a second vote to generate a purified watermark dataset.

[0122] S404: Compare the purified watermark dataset with the encrypted document feature matrix, calculate the hash deviation rate and the feature code mismatch degree, construct a timestamp signature evidence chain, and generate a tampering evidence chain.

[0123] Calculate the hash deviation rate and the feature code mismatch degree, according to the formula

[0124]

[0125] Generate a tampering evidence chain.

[0126] In the formula, H represents the hash deviation rate, h k is the k-th bit of the original hash, h' k is the k-th bit of the extracted hash, n is the total number of hash bits, M represents the feature code mismatch degree, f ij is the original feature code of the j-th bit of the i-th logical block, f' ij is the extracted feature code, δ is the indicator function (1 for difference, 0 for the same), m is the total number of logical blocks, and p is the number of feature code bits in each block.

[0127] In the calculation of the hash deviation rate, n is determined by the hash algorithm type. The SHA-256 algorithm is fixed at 256 bits. Each hash bit h k compares the differences through bitwise exclusive OR operation. For example, if the original hash hexadecimal value is "e3b0c442" and the extracted value is "e3b1c442", after converting to binary, the number of different bits is calculated as 2, and the total number of bits n = 256, then H = (2 / 256) × 100% = 0.78125%.

[0128] In the calculation of the feature code mismatch degree, the total number of logical blocks m is determined by the document chunking strategy. The chunk size is set to 512 bytes. For a 10MB document, the number of chunks m = 20480. The number of bits p of the feature code for each block is 64. By counting the total number of different bits in the feature codes of all blocks and dividing it by m×p. For example, if it is detected that there are differences in 3 logical blocks, and the number of different bits are 5, 3, and 2 respectively, then M=(5 + 3 + 2) / (20480×64)=10 / 1310720≈0.000763%. This result indicates that when the hash deviation rate exceeds the threshold of 0.5% or the feature code mismatch degree exceeds 0.001%, a tampering warning is triggered, and a digital signature evidence chain containing timestamps is constructed.

[0129] Generating a tampering location report based on S5 includes the following steps;

[0130] S501: Based on the encrypted document feature matrix, use the phase correlation algorithm to compare the spatial distribution of DOM tree nodes, detect paragraph addition and deletion, and table structure adjustment, and generate a coarse-grained tampering area identification map;

[0131] Based on the encrypted document feature matrix, map the coordinates of DOM tree nodes into a two-dimensional matrix. The abscissa of the nodes is numbered in the order of the document stream, and the ordinate is stratified according to the nesting depth. The phase correlation algorithm calculates the normalized cross-correlation value between the original matrix and the current matrix. The formula is where T is the original node matrix, I is the current node matrix, (u, v) is the offset. Traverse the offset range [-5, 5]. When the cross-correlation value is lower than 0.85, it is determined as a structural anomaly, mark the boundary coordinates of the abnormal area, and generate a coarse-grained tampering area identification map.

[0132] S502: Within the range of the coarse-grained tampering area identification map, apply the improved Needleman-Wunsch algorithm for character-level sequence alignment, locate the offset of ±3 characters, and generate a fine-grained tampering coordinate list;

[0133] Within the range of the coarse-grained tampering area identification map, split the text segment according to the character stream coordinates. The improved Needleman-Wunsch algorithm sets the matching score s match = +2, the mismatch score s mismatch = -1, the gap penalty d = -3, construct a dynamic programming matrix. The formula is Record the offset when backtracking the path, count the coordinates where the offset fluctuation within 3 consecutive characters exceeds ±3, and generate a fine-grained tampering coordinate list.

[0134] S503: According to the block mismatch degree in the tampering evidence chain, calculate the tampering impact factor: If >5% of the blocks are damaged, trigger the Git-based incremental version rollback mechanism and generate a document repair decision instruction;

[0135] Calculate the tampering impact factor according to the formula

[0136]

[0137] Determine whether to trigger version rollback.

[0138] In the formula, E represents the tampering impact factor, and B d is the number of damaged blocks, and B t is the total number of blocks in the document.

[0139] The total number of blocks B t is determined by the document chunking strategy. The chunk size is fixed at 512 bytes, and the total number of bytes S of the document is rounded up after dividing by 512. For example, for a 10MB document (10,485,760 bytes), the number of chunks The number of damaged blocks B d is obtained by comparing the differences in the SHA-256 hash values of the original feature matrix and the current matrix. When the number of different bits in the hash of each block exceeds 3 bits, it is marked as damaged.

[0140] Example: It is detected that the number of different bits in the hashes of 1,024 blocks is ≥4, then B d = 1,024. Substituting into the formula gives:[[]]

[0141]

[0142] This result indicates that the tampering impact factor reaches the 5% threshold, triggering the Git incremental rollback mechanism, locating the versions in the last 3 commits that match the damaged blocks, and generating repair instructions.

[0143] S504: Integrate the coarse-grained and fine-grained localization results and repair instructions, generate a visualization report, and automatically call the original feature matrix stored in the blockchain for repair verification to generate a tampering localization report.

[0144] Integrate the coarse-grained identification map and the fine-grained coordinate list to construct a JSON format report, including the vertex coordinates of the abnormal area, the tampering type, and the impact factor. Call the original feature matrix stored in the blockchain, extract the hash values according to the block index, and compare the hash sequence of the repaired document block by block. When the number of different bits returns to zero, it is determined that the verification is passed, and a tampering localization report is generated and appended with a digital signature timestamp.

[0145] A document integrity verification and tampering localization system with multi-feature information hiding. The localization system includes the following modules: a feature processing module, a watermark embedding module, and a verification and localization module;

[0146] The feature processing module, based on the original Word document, uses a DOM tree parser to extract paragraph-level and table structure features, calculates the full-text hash value through the SHA-3 algorithm, and encrypts the feature matrix using the Logistic chaotic map. At the same time, based on Monte Carlo simulation to predict the block retention rate, dynamically divides logical blocks, and generates an encrypted document feature matrix and a dynamic block division strategy table;

[0147] The feature processing module includes a document parsing sub-module, a feature encryption sub-module, and a dynamic block division sub-module;

[0148] The watermark embedding module, based on the encrypted document feature matrix and the dynamic block division strategy table, embeds the global hash value in the OpenXML metadata using the least significant bit replacement algorithm, writes the local feature code through paragraph style fine-tuning technology, combines the Reed-Solomon error correction code to enhance the anti-deletion and modification ability, and finally verifies the watermark robustness against the generative adversarial network to generate a document to be verified with dual watermarks;

[0149] The watermark embedding module includes a metadata embedding sub-module, a style fine-tuning sub-module, and an error correction enhancement sub-module;

[0150] The verification and localization module, based on the document to be verified with dual watermarks, designs a cross-version parser to extract watermark data, filters high-confidence features through the attention mechanism, compares the encrypted document feature matrix to calculate the hash deviation, uses the phase correlation algorithm for coarse-grained localization of structural tampering, improves the sequence alignment algorithm for precise localization of character offsets, and triggers the blockchain evidence storage and repair mechanism to generate a multi-scale tampering localization report;

[0151] The verification and localization module includes a watermark extraction sub-module, a feature comparison sub-module, and a repair trigger sub-module.

[0152] The document parsing sub-module, based on the original Word document, traverses the OpenXML structure using a DOM tree parser to extract the paragraph-level relationship( <w:p>Label), table row and column attributes( <w:tbl>) and style inheritance chain( <w:styles>) Generate DOM tree structure data and style property tables;

[0153] Based on the original Word document, parse the document.xml file with an OpenXML structure and traverse all <w:p>Label, record the depth of its parent element path as the hierarchical value. For each increase of 1 in the hierarchical value, the depth of the document structure tree increases by 1, and extract <w:tbl>Statistics included when tagging <w:tr>The number of labels is used as the number of lines, and each <w:tr>inside <w:tc>The number of labels is used as the number of columns for parsing <w:styles>In the <styleId> attribute, a mapping table between the style name and the format attribute is established. The font size corresponds to the value of w:sz divided by 100 to obtain the point value, and the color value is converted from hexadecimal to an RGB triple. DOM tree structure data including node type, hierarchical coordinates, number of table rows and columns, and style inheritance relationship, and a style attribute table are generated.

[0154] The feature encryption sub-module, based on the DOM tree structure data and the style attribute table, calculates the full-text hash value through the SHA-3 algorithm, constructs a feature matrix by combining the paragraph-level CRC-64 check code, and generates a dynamic key using the Logistic chaotic map for XOR encryption to generate an encrypted document feature matrix;

[0155] Generate a dynamic key using the Logistic chaotic map according to the formula

[0156]

[0157] Perform iterative operations.

[0158] In the formula, μ represents the chaos parameter, x n is the nth iteration value, k is the paragraph-level CRC-64 check code, and m is the number of bits of the check code in binary.

[0159] The value range of the chaos parameter μ is [3.57, 4], which is determined according to the non-linear dynamics theory. When μ = 3.9, the system enters the chaotic state. The check code k is generated through the CRC-64 algorithm, and the input data is the UTF-8 byte stream of the paragraph text, generating a 64-bit check code. The initial iteration value x0 takes the first 8 bytes of the hash value of the first paragraph of the document and converts it to a floating point number in the (0, 1) interval. The calculation method is

[0160] Example: The first 8 bytes before the hash of the first paragraph are 0x2A, 0xF3, 0x15, 0x8E, 0x07, 0xCB, 0x9D, 0x40, and the converted decimal values are:

[0161]

[0162] Take μ = 3.9, k = 0xE5D3C2B1A9F0E1D2, m = 64, and calculate the first iteration:

[0163]

[0164] After 256 iterations, take the last 32 bits as the key. This result shows that the initial value sensitivity of the chaotic sequence ensures the unpredictability of the key, and an encrypted feature matrix is generated after XOR operation.

[0165] The dynamic block sub-module, based on the encrypted document feature matrix, uses the Monte Carlo method to simulate 1000 format conversions, statistically calculates the retention rate of block metadata, optimizes the matching of block boundaries and watermark strategies through the Hungarian algorithm, and generates a mapping table of dynamic block strategies and watermark weights.

[0166] Based on the encrypted document feature matrix, the document is divided into initial blocks of 512 bytes, and 1000 format conversion simulations are performed. Each simulation randomly selects converters including LibreOffice, WPS, and Adobe Acrobat. After conversion, the number of remaining metadata tags is parsed, and the retention rate r = the number of remaining tags / the number of original tags is statistically calculated. The standard deviation σ of the retention rate of each block in 1000 simulations is calculated. When σ > 0.15, the block is marked as an unstable block, and a block stability matrix is constructed. The Hungarian algorithm uses stability as the row and watermark weight as the column to establish a cost matrix C_ij = 1 / (σ_i × w_j), where w_j is the preset watermark weight. The optimal matching is found through row and column reduction and augmented path search, and a mapping table of dynamic block strategies and watermark weights is generated.

[0167] The metadata embedding sub-module, based on the mapping table of dynamic block strategies and watermark weights, in OpenXML <w:rsid>Implement the least significant bit replacement in the label, embed the global hash value encoded as an 8-bit binary sequence, and generate a content watermark marked document;

[0168] Based on the dynamic chunking strategy and the watermark weight mapping table, traverse the <w:rsid>Labels, select the embedding position according to the weight value, the weight threshold is set to 0.6, the global hash value is generated by SHA-256 and the first 8 bits are intercepted and converted into a binary sequence 01101001. Each logical block is assigned 3 embedding bits. The replacement rule for the least significant bit of the label is: if the weight coefficient w≥0.6 and the current binary bit is 1, adjust the parity of the last hexadecimal value of the label to odd. When the last bit is even, add 1; when the last bit is odd, keep it unchanged. After traversal, generate a content watermark marked document.

[0169] Style fine-tuning sub-module, based on the content watermark marked document, extract the paragraph style attributes, write the last digit of the fine-tuning value with ±1pt into the local feature code, generate a structure watermark mark, and generate a structure watermark marked document;

[0170] Based on the content watermark marked document, extract the font size attribute value in the paragraph style, retain one digit after the decimal point, detect the parity of the last digit. When the local feature code binary bit is 1, adjust the last digit of the font size to odd. For example, the original font size 12.4pt is adjusted to 12.5pt, and the original font size 9.2pt is adjusted to 9.1pt. The line spacing attribute is adjusted in units of 0.25pt as the minimum. When the feature code bit is 0, the last digit of the line spacing value is adjusted to even. For example, the original line spacing 18.6pt is adjusted to 18.4pt or 18.8pt. After traversing all paragraph styles, generate a structure watermark marked document.

[0171] Error correction and enhancement sub-module, for the structure watermark marked document, use Reed-Solomon error correction code to perform redundant encoding on the watermark data, and insert 16-byte check information at the footer, verify the robustness through an adversarial generation network simulation attack, and generate a document to be verified with double watermarks.

[0172] Use Reed-Solomon error correction code to perform redundant encoding on the watermark data, according to the formula

[0173] C(x) = m(x)·x 2t +[m(x)·x 2t mod g(x)]

[0174] Generate the check code.

[0175] In the formula, m(x) is the information polynomial, g(x) is the generating polynomial, t is the error correction capacity, and 2t is the number of check symbols.

[0176] The generating polynomial g(x) is constructed in the Galois field GF(2^8), and the irreducible polynomial is x 8 +x 4 +x 3 +x 2 +1, the primitive element α = 0x02. The error correction capacity t = 8, corresponding to 16-byte check information. The coefficients of the information polynomial m(x) are converted from the watermark data, and each byte corresponds to an element in the field.

[0177] Example: The watermark data byte sequence [0x12, 0x34, 0x56] is converted into a polynomial:

[0178] m(x) = α 0x12 x2 + α 0x34 x + α 0x56

[0179] The generated polynomial is expanded as:

[0180]

[0181] In polynomial division, m(x)·x 16 is divided by g(x), and the coefficients of the remainder term are converted into a byte sequence. For example, if the remainder term is [0xA7, 0x1F,..., 0x3B], it is inserted into the document footer. This result shows that the check code can correct up to 8-byte errors, and when resisting the generative network simulation deletion attack, the survival rate is increased to 99.7%.

[0182] The watermark extraction sub-module, based on the document to be verified with dual watermarks, designs a cross-version parser to extract metadata and style attributes, coordinates multi-terminal data through the RAFT consensus algorithm, and uses an attention mechanism to screen high-confidence watermark bits to generate a purified watermark data set;

[0183] Based on the document to be verified with dual watermarks, deploy a 5-node RAFT cluster, set the election timeout to 200 - 400 ms, and each node independently parses.doc and.docx formats <w:rsid>Label, extract the binary sequence embedded in the LSB. The master node collects the extraction results of more than 3 nodes and performs a majority vote bit by bit to define the confidence score. (v jk (where \(v_{kj}\) is the decision value 0 / 1 of the \(k\)-th node for the \(j\)-th bit), directly adopt the bits with a score ≥ 0.8, trigger re-extraction for the bits with a score ≤ 0.2, and call the attention weight \(w_{j}\) for the intermediate value bits. j = 1 - |2c j - 1| for weighted correction to generate a purified watermark dataset.

[0184] Feature comparison sub-module. Based on the purified watermark dataset and the encrypted document feature matrix, calculate the global hash deviation rate, detect the DOM structure offset through the phase correlation algorithm, locate paragraph and table-level tampering, and generate a heat map of the tampering area.

[0185] Calculate the global hash deviation rate according to the formula

[0186]

[0187] Detect tampering.

[0188] In the formula, \(H\) represents the hash deviation rate, \(h_{k}\) k is the \(k\)-th bit of the original hash, \(h'_{k}\) k is the \(k\)-th bit of the extracted hash, \(n\) is the total number of hash bits, \(s\) i is the original DOM node coordinate, \(s'\) i is the current node coordinate, \(\delta\) is the indicator function (taking 1 when the coordinate difference exceeds the threshold \(\theta\)), \(m\) is the total number of DOM nodes, and \(\lambda = 0.3\) is the structure deviation weight coefficient.

[0189] The total number of hash bits \(n = 256\), which is fixed by the SHA - 256 algorithm. The DOM node coordinate difference threshold \(\theta\) is set according to the document resolution. For a document with a resolution of 1920×1080, \(\theta = 5\) pixels. The structure deviation weight coefficient \(\lambda\) is obtained through Monte Carlo simulation tests. When the weight proportion of document structure tampering is 30%, the system detection accuracy is the highest.

[0190] Example: It is detected that the number of different hash bits is 18, and the number of DOM node coordinate differences is 45 (when the threshold \(\theta = 5\)). Substitute into the formula:

[0191]

[0192] This result indicates that when the hash deviation rate exceeds the preset threshold of 3%, a tampering alarm is triggered, and a heat map is generated in combination with the coordinate offset output by the phase correlation algorithm to locate the paragraph-level tampering area.

[0193] The repair trigger sub-module, based on the heat map of the tampered area, uses the improved Needleman-Wunsch algorithm to align character sequences, locates character-level tampering within ±3 characters, triggers the blockchain evidence storage repair mechanism when the mismatch rate > 5%, and generates a multi-scale tampering location report.

[0194] Based on the heat map of the tampered area, divide the text segments according to the character stream within the located paragraph range. The improved Needleman-Wunsch algorithm sets the match score to +2, the mismatch score to -1, the continuous match reward to +1, and the gap penalty enables the linear gap penalty mode, with the first gap penalty being -5 and the extended gap penalty being -2. Construct a dynamic programming matrix, record the positions where the offset exceeds ±3 characters when backtracking the path, count the total number of characters C in the tampered area and the number of mismatched characters D, and calculate the mismatch rate. When R > 5%, retrieve the hashes of the last 3 versions of this paragraph in the blockchain evidence storage, and use the version with the highest matching rate as the repair source to generate a multi-scale location report.

[0195] Although the embodiments of the present invention have been shown and described, for those of ordinary skill in the art, it can be understood that various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principles and spirit of the present invention. The scope of the present invention is defined by the appended claims and their equivalents.< / w:rsid> < / w:rsid> < / w:rsid> < / w:styles> < / w:tc> < / w:tr> < / w:tr> < / w:tbl> < / w:p> < / w:styles> < / w:tbl> < / w:p> < / w:rsid> < / w:rsid> < / w:rsid> < / w:rsid> < / w:rsid> < / w:rsid> < / w:drawing> < / w:tbl> < / w:p> < / w:rsid> < / w:styles> < / w:tbl> < / w:p> < / w:rsid> < / w:drawing> < / w:tbl> < / w:p>

Claims

1. A method for document integrity verification and tampering localization with multi-feature information hiding, characterized in that It includes the following steps: S1: Document multi-dimensional feature extraction and encryption. Based on the original Word document, the SHA-3 algorithm is used to calculate the full-text hash value as the content feature. At the same time, a DOM tree parser is used to extract document object model features such as paragraph levels and table structures. After merging the two types of features into a feature matrix, a dynamic key is generated using the Logistic chaotic map for XOR encryption to generate an encrypted document feature matrix; S2: Dynamic block division and watermark strategy allocation against format interference. Based on the encrypted document feature matrix, a logical block algorithm is used to divide the document into paragraph-level blocks and table-level blocks. For each block, the Monte Carlo simulation is used to predict the information retention rate during format conversion, and the watermark embedding weight is dynamically allocated: blocks with a retention rate > 80% are embedded with strong verification watermarks, and the remaining blocks are embedded with lightweight watermarks, generating a dynamic block division strategy and watermark weight mapping table; S3: Robust embedding of dual watermarks. Based on the dynamic block division strategy and watermark weight mapping table, two types of watermark embeddings are performed. Content watermark: In the OpenXML metadata of the block, the global hash value is written using the LSB replacement algorithm. Structural watermark: In the paragraph style attributes, the local feature code of the block is embedded by fine-tuning the last digit of the numerical value, and the RS error correction code is used to enhance the anti-deletion and modification ability, generating a document to be verified with content watermark and structural watermark; S4: Adaptive watermark extraction and evidence chain construction. For the document to be verified, a cross-version parser is designed to be compatible with.doc and.docx formats, and the RAFT consensus algorithm is used to coordinate the watermark extraction process of multiple terminals. During extraction, for the content watermark: the global hash value is restored from the metadata, and the attention mechanism is used to screen the embedding bits least affected by format conversion. For the structural watermark: the differential analysis is used to detect the abnormal fluctuations of the paragraph style numerical values, and the local feature code is restored in combination with the BCH decoder, generating a tampering evidence chain; S5: Multi-scale tampering location and repair trigger. Based on the encrypted document feature matrix and the tampering evidence chain, coarse-grained location is performed: the phase correlation algorithm is used to compare the DOM structure features to identify paragraph additions, deletions, or table structure adjustments. Fine-grained location: the improved Needleman-Wunsch sequence alignment algorithm is used to match the local feature codes to locate character-level tampering. Automatic repair: When it is detected that > 5% of the blocks are tampered with, the incremental rollback mechanism based on the version control system is triggered, and the original feature matrix stored in the blockchain is called for repair, generating a tampering location report.

2. The method for document integrity verification and tampering localization with multi-feature information hiding according to claim 1, characterized in that: The generation of the encrypted document feature matrix in S1 includes the following steps; S101: Based on the original Word document, a DOM tree parser is used to traverse the document object model to extract the paragraph level relationship, table row and column structure, and style inheritance chain, generating DOM tree structure data; S102: Based on the original document binary stream, the Secure Hash Algorithm 3 is used to calculate the 256-bit full-text digest value, and at the same time, the cyclic redundancy check code of each paragraph of text is generated using the CRC-64 algorithm, generating a set of full-text hash values and segment check codes; S103: Merge the DOM tree structure data with the segmented checksum set to form a feature matrix, perform dimensionality reduction processing using the principal component analysis method to eliminate redundant features, and generate a dimensionality-reduced document feature matrix; S104: Generate a dynamic key sequence based on the Logistic chaotic map, perform exclusive-or encryption on the dimensionality-reduced document feature matrix, and derive the key initial value from the hash of the document creation timestamp to generate an encrypted document feature matrix.

3. The method for document integrity verification and tampering localization with multi-feature information hiding according to claim 1, characterized in that: The generation of the dynamic block strategy and watermark weight mapping table in S2 includes the following steps; S201: Based on the DOM tree structure data, establish a logical chunking rule: The paragraph block starts with <w:p>The label is the boundary, and the table block is arranged according to <w:tbl>Partitioning, Picture Block Recognition <w:drawing>tags to generate an initial block rule table; < / w:drawing> < / w:tbl> < / w:p> S202: For each block in the initial block rule table, simulate 1000 format conversions using the Monte Carlo method, count the retention probability of metadata tags, and generate a block information retention rate prediction table; S203: Based on the block information retention rate prediction table, dynamically allocate watermark embedding weights: allocate BCH(127,64) error correction codes to blocks with a retention rate ≥ 80%, and use CRC-32 lightweight checks for the remaining blocks to generate a watermark strategy weight allocation table; S204: Optimize the matching of block boundaries and watermark strategies through the Hungarian algorithm, eliminate strategy conflicts in the overlapping areas of blocks, ensure that watermarks in adjacent blocks do not interfere with each other, and generate a dynamic block strategy and watermark weight mapping table.

4. The method for document integrity verification and tampering localization with multi-feature information hiding according to claim 1, wherein: The generation of the document to be verified with content watermark and structure watermark in S3 includes the following steps; S301: Based on the dynamic chunking strategy and the watermark weight mapping table, in the OpenXML format <w:rsid>Implement least significant bit replacement in the tags, encode the global hash value into an 8-bit binary sequence and embed it to generate a document with preliminary content watermark embedding; < / w:rsid> S302: For each logical block of the document with preliminary content watermark embedding, extract the paragraph style attributes, and write local feature codes by fine-tuning the last digit of the numerical value by ±1pt to generate a document with structure watermark marked; S303: For the document with structure watermark marked, perform redundant encoding on the watermark data using the Reed-Solomon error correction code, and insert 16-byte check information at the document footer to generate a watermark document with error correction code; S304: Simulate format conversion attacks through a generative adversarial network, detect the watermark survival rate, and perform secondary embedding compensation on blocks with a failure rate > 5% to generate a document to be verified with content watermark and structure watermark.

5. The method for document integrity verification and tampering location with multi-feature information hiding according to claim 1, wherein: The generation of the tampering evidence chain in S4 includes the following steps; S401: For the document to be verified, design a cross-version parser to identify the OLE stream of.doc and the Zip compression structure of.docx, and uniformly convert them into DOM tree expressions to generate a standardized DOM tree structure; S402: Based on the standardized DOM tree structure, use the RAFT consensus algorithm to coordinate the extraction results of multiple terminals, perform majority voting error correction on the content watermark, and generate a decentralized watermark extraction result; S403: Separate the global hash and local feature codes from the decentralized watermark extraction result, and screen out high-confidence embedding bits through the attention mechanism to generate a purified watermark dataset; S404: Compare the purified watermark dataset with the encrypted document feature matrix, calculate the hash deviation rate and the feature code mismatch degree, construct a timestamp signature evidence chain, and generate a tampering evidence chain.

6. The method for document integrity verification and tampering location with multi-feature information hiding according to claim 1, wherein Based on: The generation of the tampering location report in S5 includes the following steps; S501: Based on the encrypted document feature matrix, the phase correlation algorithm is used to compare the spatial distribution of DOM tree nodes, detect paragraph additions and deletions, and table structure adjustments, and generate a coarse-grained tampering area identification map; S502: Within the scope of the coarse-grained tampering area identification map, the improved Needleman-Wunsch algorithm is applied for character-level sequence alignment, positioning the ±3 character offset, and generating a fine-grained tampering coordinate list; S503: According to the block mismatch degree in the tampering evidence chain, calculate the tampering impact factor: if >5% of the blocks are damaged, trigger the Git-based incremental version rollback mechanism and generate a document repair decision instruction; S504: Integrate the coarse-grained and fine-grained positioning results and repair instructions, generate a visualization report, and automatically call the original feature matrix stored on the blockchain for repair verification, generating a tampering positioning report.

7. Document integrity verification and tampering location system with multi-feature information hiding, characterized in that This positioning system includes the following modules: Feature processing module, watermark embedding module, verification and positioning module; Feature processing module: Based on the original Word document, use the DOM tree parser to extract paragraph-level and table structure features, calculate the full-text hash value through the SHA-3 algorithm, and encrypt the feature matrix using the Logistic chaotic map. At the same time, based on Monte Carlo simulation to predict the block retention rate, dynamically divide logical blocks, and generate an encrypted document feature matrix and a dynamic block strategy table; The feature processing module includes a document parsing sub-module, a feature encryption sub-module, and a dynamic block sub-module Watermark embedding module: Based on the encrypted document feature matrix and the dynamic block strategy table, embed the global hash value in the OpenXML metadata using the least significant bit replacement algorithm, write the local feature code through paragraph style fine-tuning technology, combine the Reed-Solomon error correction code to enhance the anti-deletion and modification ability, and finally verify the watermark robustness through the generative adversarial network to generate a document to be verified with dual watermarks; The watermark embedding module includes a metadata embedding sub-module, a style fine-tuning sub-module, and an error correction enhancement sub-module; Verification and positioning module: Based on the document to be verified with dual watermarks, design a cross-version parser to extract watermark data, screen high-confidence features through the attention mechanism, compare the encrypted document feature matrix to calculate the hash deviation, use the phase correlation algorithm for coarse-grained positioning of structural tampering, improve the sequence alignment algorithm to accurately locate the character offset, and trigger the blockchain storage repair mechanism to generate a multi-scale tampering positioning report; The verification and positioning module includes a watermark extraction sub-module, a feature comparison sub-module, and a repair trigger sub-module.

8. The system for document integrity verification and tampering localization with multi-feature information hiding according to claim 7, characterized in that: The document parsing sub-module traverses the OpenXML structure using a DOM tree parser based on the original Word document to extract the paragraph hierarchy relationship <w:p>Label), table row and column attributes( <w:tbl>) and style inheritance chain( <w:styles>) to generate DOM tree structure data and style attribute tables; < / w:styles> < / w:tbl> < / w:p> Feature encryption sub-module: Based on the DOM tree structure data and style attribute tables, calculate the full-text hash value through the SHA-3 algorithm, construct a feature matrix by combining paragraph-level CRC-64 check codes, and use the Logistic chaotic map to generate a dynamic key for XOR encryption to generate an encrypted document feature matrix; Dynamic block sub-module: Based on the encrypted document feature matrix, use the Monte Carlo method to simulate 1000 format conversions, count the block metadata retention rate, optimize the block boundary and watermark strategy matching through the Hungarian algorithm, and generate a dynamic block strategy and watermark weight mapping table.

9. The multi-feature information hiding-based document integrity verification and tampering localization system according to claim 7, wherein: The metadata embedding sub-module, based on the dynamic chunking strategy and the watermark weight mapping table, in OpenXML <w:rsid>Implement the least significant bit substitution in the label, encode the global hash value as an 8-bit binary sequence and embed it to generate a content watermark marked document;< / w:rsid> The style fine-tuning sub-module, based on the content watermark marked document, extracts the paragraph style attributes, writes the least significant digit of the ±1pt fine-tuning value into the local feature code, generates a structure watermark mark, and generates a structure watermark marked document; The error correction enhancement sub-module, for the structure watermark marked document, redundantly encodes the watermark data using the Reed-Solomon error correction code, inserts 16-byte check information in the footer, and verifies the robustness through an adversarial generative network simulation attack to generate a document to be verified with double watermarks.

10. The multi-feature information hiding-based document integrity verification and tampering localization system according to claim 7, wherein: The watermark extraction sub-module, based on the document to be verified with double watermarks, designs a cross-version parser to extract metadata and style attributes, coordinates multi-terminal data through the RAFT consensus algorithm, and uses an attention mechanism to screen high-confidence watermark bits to generate a purified watermark dataset; The feature comparison sub-module, based on the purified watermark dataset and the encrypted document feature matrix, calculates the global hash deviation rate, detects DOM structure offsets through the phase correlation algorithm, locates paragraph and table-level tampering, and generates a heat map of the tampered area; The repair trigger sub-module, based on the heat map of the tampered area, uses the improved Needleman-Wunsch algorithm to align character sequences, locates ±3 character-level tampering, and triggers the blockchain evidence storage repair mechanism when the mismatch rate > 5%, generating a multi-scale tampering location report.

Images