Distributed batch Internet content clue automatic evidence obtaining method and system

Abstract

The invention discloses a distributed batch internet content clue automatic evidence obtaining method and system, and belongs to the field of internet content governance. The method comprises the following steps: acquiring a webpage address of a target webpage in an evidence obtaining job, and performing webpage rendering after obtaining webpage data of the target webpage according to the webpage address; extracting first evidence obtaining content in the generated webpage; performing enhanced generation on the first evidence obtaining content to obtain a webpage similar to the evidence obtaining content, and extracting second evidence obtaining content from the webpage similar to the evidence obtaining content; and packaging the first evidence obtaining content, the second evidence obtaining content and the evidence obtaining process to obtain a first evidence file, and carrying out digital signature on the first evidence file. According to the invention, the business process of the evidence obtaining work can be simplified as much as possible, the machine automation of the evidence obtaining work is realized, the requirements of relevant workers on convenient and timely evidence obtaining, analysis, business handling and work development are met, the specific technical problems in the network content treatment process are solved, and the internet space treatment level is practically improved.

Description

Technical Field

[0001] The present invention relates to the field of Internet content governance, and in particular to a distributed batch Internet content clue automatic evidence collection method and system. Background Art

[0002] In the new era, my country faces both new opportunities for digital development and new challenges brought about by digital innovation. Throughout human history, only a clean, vibrant, and ecologically sound internet space can truly meet the people's real pursuit and inherent needs for a better digital life.

[0003] In today's society, the internet has increasingly become the primary channel for producing, disseminating, and accessing information. Its mobilization power among members of society is growing stronger, and its role in transmitting and amplifying social issues is becoming increasingly pronounced. To a certain extent, the internet is profoundly influencing and changing the history of human social development. A new round of scientific and industrial revolution, embodied by information technology, is emerging, injecting strong impetus into economic and social development. At the same time, the development of new technologies and applications on the internet has also brought many new challenges to the sovereignty, security, and development interests of countries around the world, often seriously endangering national security, economic development, and the lives of the people. These problems, characterized by the profound, diverse, frequent, widespread, massively heterogeneous, and even adversarial nature of network data, have a widespread negative impact on the normal order of cyberspace, posing significant challenges to the evidence collection work of professional institutions and regulatory authorities, and have become a serious obstacle to cyberspace governance and internet law enforcement.

[0004] Currently, in the fields of internet governance and law enforcement, particularly within the professional management agencies, there is a lack of targeted, fully automated evidence collection technologies and systems for internet content management. The few existing methods not only require professional management agencies to invest significant manpower, time, and costs in the evidence collection process, but also suffer from the common problems of difficulty in solidifying evidence and insufficient objectivity. Faced with a massive amount of heterogeneous online content data, there is an urgent need to develop effective methods to comprehensively and automatically collect evidence for different types of illegal and irregular internet content, thereby improving the level of internet governance. Summary of the Invention

[0005] The purpose of the present invention is to provide a distributed batch Internet content clue automatic evidence collection method and system for professional management agencies in the field of Internet content governance and law enforcement, to simplify the evidence collection work process as much as possible, to realize the automation of evidence collection work, to meet the needs of relevant staff for convenient and timely evidence collection, analysis, business processing, and work, to solve specific technical problems in the process of network content governance, and to effectively improve the level of Internet space governance.

[0006] To achieve the above objectives, the technical solution of the present invention includes the following contents.

[0007] A distributed batch Internet content clue automatic evidence collection method, the method comprising:

[0008] Obtaining the webpage address of the target webpage in the forensic operation, and after obtaining the webpage data of the target webpage according to the webpage address, rendering the webpage;

[0009] extracting first forensic content from the generated web page;

[0010] Enhance and generate the first forensic content to obtain a web page similar to the forensic content, and extract second forensic content from the web page similar to the forensic content;

[0011] The first evidence collection content, the second evidence collection content and the evidence collection process are encapsulated to obtain a first evidence file, and the first evidence file is digitally signed; wherein the evidence collection process includes: evidence collection time, evidence collector and evidence collection process log.

[0012] Furthermore, obtaining the webpage data of the target webpage according to the webpage address includes:

[0013] Add the web page address to a distributed queue and generate a forensics task in the distributed queue;

[0014] The evidence collection task is distributed to multiple server nodes so that the multiple server nodes process the evidence collection task in parallel to obtain the web page data of the target web page; if any server node fails in executing the evidence collection task, the web page address is re-added to the distributed queue to redistribute the multiple server nodes.

[0015] Furthermore, the first evidence collection content includes: web page screenshots, web page text, web page code, static resources in the web page, website server information, web page request and server response process and server information where the static resources in each web page are located.

[0016] Further, enhancing and generating the first forensic content to obtain a web page similar to the forensic content, and extracting second forensic content from the web page similar to the forensic content, including:

[0017] extracting entity words and a keyword list from the first forensic content, generating web page content features and sentiment features of the first forensic content, and then calculating a structured tag of the target web page using the web page content features of the first forensic content;

[0018] Incrementally crawling the entity words and keyword lists in the first forensic content to obtain a number of community member data, including social platform data, interaction data, user avatars, and image content;

[0019] Generate web page content features and sentiment features of community members based on community member data, and use web page content features to calculate structured tags of community members;

[0020] generating a graph structure, wherein nodes in the graph structure include: a target webpage node and a community member node, wherein node representations of the target webpage node and the community member node are generated based on webpage content features, sentiment features, and structured tags, and weighted edges in the graph structure are constructed based on the webpage content features and structured tags;

[0021] Construct a graph neural network and use the neighbor sampling strategy of GraphSAGE to extract and propagate features of node representations and edge weights in the graph structure to obtain the final representation of each node;

[0022] Using a classifier to classify the final representation to obtain a legal risk label of the node; wherein, when the label output by the classifier is unknown, the legal risk label of the node is predicted based on the distribution of legal risk labels of the node's adjacent nodes;

[0023] For a community member with the same legal risk label as the target webpage, the community member data of the community member is output and the risk category and relevant legal terms of the community member data are marked to obtain the second evidence content.

[0024] Furthermore, after encapsulating the first evidence collection content, the second evidence collection content, and the evidence collection process to obtain a first evidence file and digitally signing the first evidence file, the method further includes:

[0025] Digitally notarizing the first evidence document and performing tamper-proof processing on the digitally notarized first evidence document to obtain a second evidence document;

[0026] Upload the second evidence file to the evidence server for archiving and storage.

[0027] Furthermore, after uploading the second evidence file to the evidence server for archiving and storage, the method further includes:

[0028] Associate the second evidential document with the case.

[0029] Furthermore, after uploading the second evidence file to the evidence server for archiving and storage, the method further includes:

[0030] Download the second evidence file to the local computer and verify the second evidence file by combining anti-tampering processing technology and digital signature;

[0031] After the verification is passed, check the evidence collection time, evidence collection process records and evidence file information; wherein, the evidence file information includes: evidence screenshots, text code of the evidence collection webpage, server information and network information of the website where the evidence collection webpage is located.

[0032] Furthermore, after uploading the second evidence file to the evidence server for archiving and storage, the method further includes:

[0033] Categorize and manage the second evidence files and provide a tree structure display;

[0034] Manage and maintain the evidence labeling system;

[0035] The second evidence files in the evidence server are statistically analyzed for the number of evidence collected, the trend of evidence collected, the classification of evidence collected, the method of evidence collected, and the source of evidence collected, and a visual analysis chart is generated to display the evidence classification information, evidence collection unit information, and jurisdiction information within the business scope.

[0036] Furthermore, after uploading the second evidence file to the evidence server for archiving and storage, the method further includes:

[0037] Multi-threaded computing is used to optimize the image in the second evidence file.

[0038] A distributed batch Internet content clue automatic evidence collection system, the system comprising:

[0039] A web page rendering module is used to obtain the web page address of the target web page in the forensic operation, and after obtaining the web page data of the target web page according to the web page address, perform web page rendering;

[0040] An evidence sampling and extraction module is used to extract first evidence content from the generated web page;

[0041] an evidence enhancement processing module, configured to enhance and generate the first evidence content to obtain a web page similar to the evidence content, and extract a second evidence content from the web page similar to the evidence content;

[0042] The evidence encapsulation module is used to encapsulate the first evidence content, the second evidence content and the evidence collection process to obtain a first evidence file and digitally sign the first evidence file; wherein the evidence collection process includes: evidence collection time, evidence collector and evidence collection process log.

[0043] Compared with the prior art, the present invention has at least the following beneficial effects.

[0044] The present invention provides professional management agencies in the field of Internet governance and law enforcement with a set of business processes for evidence collection that are simplified as much as possible, realizes the automation of evidence collection work, and solves the specific business pain points of relevant professional agencies in the process of network content governance through software technology, thereby effectively improving the level of Internet space governance.

[0045] This invention can be deployed on the server side, supports distributed deployment, and is suitable for large-scale and large-scale internet forensics work. System users can submit batches of forensic URLs to the system. The system also supports receiving URL lists pushed by other systems through a data interface and automatically collects evidence based on the URL lists. Through a unified interface and standard, the forensic method, content, and results are directly integrated into the law enforcement business process at the technical level, effectively supporting the management requirements of professional organizations for automated intelligent forensic labeling in the internet space. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 Block diagram of a distributed batch Internet content clue automatic forensics system.

[0047] Figure 2 Flowchart of the evidence enhancement processing module.

[0048] Figure 3 Architectural diagram of the unified model of visual-textual dual reference.

[0049] Figure 4 Flowchart of the distributed batch Internet content clue automatic forensics method. DETAILED DESCRIPTION

[0050] In order to more clearly understand the purpose, technical solutions and advantages of this application, the present invention is described and illustrated below with reference to the accompanying drawings.

[0051] The core operating principle of this invention is as follows: the system is deployed on the server side and supports distributed deployment. System users can submit batches of URLs for forensic collection to the system. The system also supports receiving URL lists pushed from other systems via a data interface and automatically collects evidence based on these URL lists. Batch automated forensics involves the system distributing forensic jobs (or machine forensic tasks, or simply tasks) to the forensic core module deployed on the server side. The forensic core module then performs forensic collection in a distributed and fully automated manner, collecting and packaging webpage evidence according to standard forensic procedures, calculating digital signatures, and storing evidence using computer algorithms that meet relevant requirements.

[0052] like Figure 1 As shown, the technical solution of the present invention includes the following core software modules.

[0053] Module 1, web page rendering module. This module is implemented using technology that complies with web page rendering standards. The web page rendering module is the basis for evidence sampling and extraction in the forensic service of the present invention, and is mainly used for web page rendering and the control of the content loading process.

[0054] Module 2, the evidence sampling and extraction module, primarily utilizes a layered acquisition engine to achieve comprehensive evidence collection of web content. This module supports web content sampling and extraction, specifically extracting web content data according to specific standards and protocols, generating formatted evidence data. This serves as the data source for the evidence collection service.

[0055] The object of web page content sampling and extraction is Internet web pages. Therefore, the goal of web page content sampling and extraction is to go from the web page presentation to the web page nodes from the outside to the inside, including taking fast and stable high-definition screenshots of the presented web pages, extracting web page text and code, collecting static resources in the sampled web pages, extracting website server information, recording the web page request and server response process and the server information where each resource is located.

[0056] Module 3, the evidence enhancement processing module, is mainly based on multimodal intelligent content understanding, marking the sampled web page content with structured tags; at the same time, it combines graph computing to identify risk networks to enhance the generation of search content, aggregate web pages similar to the evidence content, and ultimately achieve a complete capture of the same evidence data content. The overall module 3 architecture is as follows: Figure 2 As shown, it is mainly divided into the visual-textual dual reference understanding layer and the similar site aggregation layer.

[0057] (1) Visual-textual dual reference understanding layer

[0058] Use the BERT-WWM model for entity linking, eliminate ambiguity, and find key entities such as web page author organizations, ICP registrations, account names, and content keywords.

[0059] Adopting a unified large model of visual-text dual reference (model structure such as Figure 3 As shown in the figure, it is pre-trained on large-scale multimodal datasets such as CLIP and BLIP), performs cross-modal feature extraction on text, images, videos and other content that have been sampled on web pages, and generates structured labels, such as forged evidence, bad information or intellectual property infringement.

[0060] (2) Similar web page aggregation layer

[0061] The topological features of web pages are extracted through graph neural network association analysis, and the Louvain algorithm is used to realize community discovery. The label propagation algorithm is then used to dynamically expand risk labels, forming a closed-loop process of "feature learning-community division-label diffusion". It is mainly divided into the following steps:

[0062] Step 1: Based on the entity words and keyword lists extracted by the visual-textual dual reference understanding layer, we incrementally crawled and constructed community data using the Scrapy framework. This community data ultimately includes social platform data, interaction data, user profile pictures (for identifying duplicate accounts), and image content. Web content features were generated for all community member data, and structured tags were calculated.

[0063] Step 2: Using the method "webpage content features + weight 0.6 * sentiment features + weight 0.4 * structured tags", we construct enhanced node representations of the forensic webpages and community members, using them as nodes. We also construct weighted edges based on content similarity (cosine similarity between webpage content features) and structured tags.

[0064] Step 3: Build a graph neural network and use the neighbor sampling strategy of GraphSAGE to extract and propagate the node features and edge weights obtained in Step 2. To offset data fading, residual connections are introduced to prevent feature dilution, and multi-layer graph convolution is used to extract the topological association features of the nodes.

[0065] Step 4: Using the node features extracted by multi-layer GraphSAGE as input, a classifier is trained to predict the legal risk labels of community members, thereby screening out high-risk sites.

[0066] Step 5: For unlabeled community members, a label propagation algorithm is used to predict the risk level based on the label distribution of their neighboring nodes. A confidence threshold (e.g., propagation probability > 0.7) is introduced to retain only high-confidence predictions to reduce noise interference.

[0067] The final output merges community members with the same label into a "risk community", outputs a set of sampled and extracted high-risk node web page content, and labels the risk category and automatically associates relevant legal clauses to provide judicial evidence support.

[0068] Module 4, the evidence packaging module, uses unified standards to encapsulate the sampled webpage content and necessary information from the evidence collection process into a specific structure and format. After encapsulation, the resulting evidence file is digitally signed using a national encryption algorithm that meets evidence requirements, serving as a unique identifier for the evidence. This step can be managed and stored in accordance with forensic business regulations, or directly through digital technology, through a qualified evidence certification agency for digital evidence verification and solidification.

[0069] The packaged content includes basic website resources, basic website information, and data required by customized requirements. Basic resources include, but are not limited to, webpage screenshots, text, images, JavaScript files, CSS styles, and network request and response data (HAR). Basic website information includes, but is not limited to, website server information (such as IP address), domain name information, URLs corresponding to website pages, titles, and website trace routes (the path taken by IP packets to access the target).

[0070] The evidence collection process refers to the provisions of the evidence collection process, such as the evidence collection time, evidence collector, and evidence collection process log.

[0071] The packaging method adopts a common file format, and the packaging structure adopts a file directory structure that is convenient for grassroots staff to view.

[0072] Module 5, the evidence collection process recording module, uses evidence collection logs and other means to record the evidence collection process in real time. It is necessary to record the process flow and the continuous details of the entire evidence collection process to facilitate future review and reconstruct the detailed process of evidence collection, providing a basis for forensic identification.

[0073] Module 6, the Forensic Service Type Management Module, is supported by the Evidence Sampling and Extraction and Evidence Packaging modules. Building on automated website forensics capabilities, this module primarily addresses the expansion of forensic methods for specialized media platforms, adapting forensic technology to a wide range of mainstream websites and media platforms, such as Weibo and Baidu Tieba. Furthermore, this module leverages deep learning network recognition technology to support automatic and rapid switching between different search engine platforms, addressing evidence sampling and extraction for "related search" terms and "recommended search" terms in search engine search results.

[0074] Module 7, the Evidence Authentication Module, automatically connects to the digital notarization services provided by a qualified third-party notary public based on the business requirements to authenticate and consolidate digital evidence. Furthermore, during the evidence packaging and authentication process, all evidence materials undergo tamper-proofing technology jointly implemented by this system and the third-party notary public. The packaged evidence materials are then notarized and filed.

[0075] Module 8, evidence upload module: After the evidence is successfully collected, the evidence upload module uploads the evidence information to the evidence server for archiving and storage.

[0076] Module 9, the Law Enforcement Linkage Module, primarily addresses the issue of linking evidence provided with the law enforcement system. This is achieved primarily through a technical service interface, ensuring security. This module can link cases and support the integrated law enforcement process of evidence collection, law enforcement, and evidence retrieval from a technical system perspective.

[0077] Module 10, Evidence Verification Module. The Evidence Verification Module verifies and checks all evidence data downloaded to the local computer, ensuring that the evidence data has not been tampered with from a software technology perspective.

[0078] Module 11, the Evidence Collection Management Module, encompasses two core functions: evidence management and evidence collection job management. The Evidence Management Module provides a tabular evidence index and efficient evidence retrieval and viewing capabilities through cache technology. This allows users to intuitively and conveniently access detailed evidence information when working with evidence, and allows for customized batch operations and progress display. Evidence collection job management is implemented through the addition, editing, deletion, and execution of evidence collection jobs.

[0079] Module 12, Evidence Viewing and Display Module. This module provides a batch centralized display function for evidence and provides detailed viewing. Users can view the time of evidence collection, the evidence collection process record, and evidence file information; they can also view evidence screenshots, the text code of the evidence webpage, and the server information and network information of the website where the evidence webpage is located through convenient steps. The main functions of this module are:

[0080] (1) View evidence screenshots, including full webpage screenshots. Screenshots can be downloaded and printed via the forensic browser.

[0081] (2) View evidence text, support viewing the text content of the evidence web page and the code of the web page. You can select and copy the displayed text, support viewing the static compressed file of the web page, and support displaying the status of web page images and text content at the time of evidence collection.

[0082] (3) Viewing evidence network information: You can view evidence network information in HAR (HTTP Archive format). For example, you can use the BSD open source HAR Viewer to view it.

[0083] (4) View the evidence server information, including server IP, website domain name, etc. Supports viewing the routing information from the evidence collection device network to the website server obtained during the evidence collection.

[0084] (5) View Weibo strategy forensic information, support viewing Weibo user public information extracted through forensic sampling, display Weibo user name, number of fans, avatar, etc., support display of Weibo content, including text, pictures, emoticons, etc.; support display of interactive data and other information of Weibo content, support display of relevant user avatars, names, homepage links, etc. for forwarding, commenting, and liking.

[0085] (6) View Tianya strategic forensic information, support viewing the public information of Tianya users that have been sampled and extracted, display the name, number of fans, avatar, etc. of Tianya users, support the display of user-posted content, including text, pictures, emoticons, etc.; support the display of reply information to the posted content, support the display of sampled reply content and related user avatars, names, homepage links and other information.

[0086] (7) View Tieba strategy forensic information, support viewing the public information of Baidu Tieba users that have been sampled and extracted, display Tieba user names, number of fans, avatars, etc., support display of user posting content, which may include text, pictures, emoticons, etc.; support display of follow-up information of published content, support display of follow-up content and related user avatars, names, homepage links and other information.

[0087] (8) View search engine forensic information, and support viewing the forensic sampling and text extraction results of "related search" words, "recommended search" words, etc. in the search engine search results.

[0088] (9) View local evidence packages. Support direct viewing of local evidence packages. Use zip decompression software to directly decompress the evidence package to obtain the evidence directory. By viewing the evidence information text in the root directory, view the structure directory of the evidence data, and view each piece of evidence information one by one.

[0089] Module 13, Evidence Classification Management Module, provides evidence classification functionality. It supports three-level classification and tree-structured display. Categories can be managed through adding, editing, and deleting.

[0090] Module 14, Evidence Label System Management Module: Manages and maintains the evidence label system through adding, editing, and deleting.

[0091] Module 15, the evidence collection statistics and analysis module, mainly consists of functions such as evidence collection quantity statistics, evidence collection trend statistics, evidence collection classification statistics, evidence collection method statistics, and evidence collection source statistics. It supports visual analysis charts, displaying information statistics such as evidence classification, evidence collection unit, and jurisdiction within the business scope; and provides multi-dimensional query interface services.

[0092] Module 16, forensic screenshot optimization processing module. This module uses multi-threaded computing to improve high-pixel image processing and read and write speed. After testing, this system can read, process or write 2 megabytes. 10 Trillion or 2 20 Megapixel sized images.

[0093] Module 17, Distributed Forensic Task Scheduling and Integration Module. This module's distributed queue evenly distributes forensic tasks to multiple server nodes. Multiple server nodes can simultaneously operate forensic tasks in the queue, greatly shortening the total forensic time, while avoiding overloading a single server and improving overall forensic efficiency. The main functions of this module are:

[0094] (1) Parallel processing and accelerated evidence collection. The server nodes are divided into content sampling and extraction nodes and processing nodes. Multiple nodes simultaneously sample and extract web pages, and perform enhanced processing and integrity verification on the sampled content in advance, thereby greatly shortening the total time of evidence collection.

[0095] The distributed queue coordinates different content sampling and extraction modules, queueing these forensic webpage collection tasks based on task priority (users select "general task" or "special task" when creating a task) and task dispatch time. These tasks are then distributed to the corresponding collection tools or server nodes for data collection. Furthermore, forensic tasks can be dynamically allocated based on the node's resource availability, fully utilizing the computing resources of each server node, such as GPU, memory, and storage.

[0096] (2) Fault tolerance and reliability assurance. If a server node fails while executing a forensic task, the distributed queue can detect the failure and re-queue the task, assigning it to other normal nodes for retry, thus ensuring the integrity of the forensic task.

[0097] In one embodiment, the distributed batch Internet content clue automatic evidence collection method of the present invention is as follows: Figure 4 As shown, the following steps are included.

[0098] 1. Receive jobs: Receive forensic jobs or tasks through the system interface, form, or file, and parse the web page address in the job.

[0099] 2. Add to the job queue: Add the forensic address to the forensic job queue and schedule the required content sampling and extraction node resources and processing node resources.

[0100] 3. Process jobs: automatically process jobs in the queue.

[0101] 4. Parse URL: Parse the web page address.

[0102] 5. Web Rendering: Render web pages using a browser engine. Web rendering is achieved using technologies that comply with web rendering standards. This system preferentially uses the Chromium browser as a base module tool for web rendering, which is compatible with most websites. Chromium-based browsers are a common and mature browser technology solution in the global market, and the vast majority of domestic browser products are based on Chromium technology. This system supports four main types of web page rendering.

[0103] (1) Support for all web page types: The system supports all web page types, including news, pictures, videos, live broadcasts, games, chats, emails, network disks, WebAssembly, WebGL and other content.

[0104] (2) Extension ecosystem support: The system supports the standard Chrome extension API and supports the installation of extensions that are currently compatible with various markets.

[0105] (3) Implicit and explicit rendering support: The web page rendering module can be used for automatic forensics on terminal desktop computers and servers, and can render web pages explicitly or implicitly.

[0106] (4) Support for other browser functions: This provides a complete browser experience, including bookmarks, history, downloads, browser settings, etc. For security reasons, this invention does not provide a developer tools (devtools) mode and excludes the web page source code viewing function. Users who need to view web page source code or use developer tools can use it in conjunction with other browsers.

[0107] 6. Forensics: Take screenshots of web pages, obtain static resources, obtain network information, obtain server information, and collect forensic logs. During forensics, take fast, stable, and high-definition screenshots of the presented web page, extract web page text and code, collect static resources within the web page, extract website server information, record the web page request and server response process, and the server information where each resource is located, and encapsulate it into HAR format. HAR is a compression format standard for web page request and response information, and is popularly used in web development tools, such as the network module in the devtools of the Chrome browser, to parse and package network request and response data. HAR contains web page request headers, response headers, request and response content information, as well as resource type, size, loading time, process, etc.

[0108] 7. Enhanced processing: Perform multimodal intelligent content understanding calculations on the sampled and extracted web page content to generate structured tags; at the same time, combine graph computing to identify risk networks to enhance the generation of search content and gather a collection of web pages similar to the forensic web pages.

[0109] 8. Packaging: Pack the forensic data as an evidence package.

[0110] 9. Upload Digital Signatures: Based on the needs of the evidence collection business, the evidence authentication module automatically connects to the digital notarization services provided by a qualified third-party notary public, ensuring the digital identification and solidification of evidence. Furthermore, during the evidence packaging and authentication process, all evidence materials undergo tamper-proofing technology jointly implemented by the system and the third-party notary public. The packaged evidence materials are then notarized and filed.

[0111] 10. Evidence storage: Upload the evidence package to the system storage management module for evidence storage.

[0112] While specific embodiments of the present invention have been disclosed for illustrative purposes, intended to facilitate understanding and implementation of the present invention, those skilled in the art will appreciate that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the present invention and the appended claims. Therefore, the present invention should not be limited to the disclosure of the preferred embodiments, and the scope of protection claimed in the present invention shall be determined by the scope of the claims.

Claims

1. A distributed batch Internet content clue automatic evidence collection method, characterized by: The method comprises: Obtaining the webpage address of the target webpage in the forensic operation, and after obtaining the webpage data of the target webpage according to the webpage address, rendering the webpage; extracting first forensic content from the generated web page; Enhance and generate the first forensic content to obtain a web page similar to the forensic content, and extract second forensic content from the web page similar to the forensic content; The first evidence collection content, the second evidence collection content and the evidence collection process are encapsulated to obtain a first evidence file, and the first evidence file is digitally signed; wherein the evidence collection process includes: evidence collection time, evidence collector and evidence collection process log.

2. The method according to claim 1, characterized in that Obtaining web page data of the target web page according to the web page address includes: Add the web page address to a distributed queue and generate a forensics task in the distributed queue; The evidence collection task is distributed to multiple server nodes so that the multiple server nodes process the evidence collection task in parallel to obtain the web page data of the target web page; if any server node fails in executing the evidence collection task, the web page address is re-added to the distributed queue to redistribute the multiple server nodes.

3. The method according to claim 1, characterized in that The first forensic content includes: web page screenshots, web page text, web page code, static resources within the web page, website server information, web page request and server response process, and server information where the static resources within each web page are located.

4. The method according to claim 1, wherein Enhance the first forensic content to obtain a web page similar to the forensic content, and extract second forensic content from the web page similar to the forensic content, including: extracting entity words and a keyword list from the first forensic content, generating web page content features and sentiment features of the first forensic content, and then calculating a structured tag of the target web page using the web page content features of the first forensic content; Incrementally crawling the entity words and keyword lists in the first forensic content to obtain a number of community member data, including social platform data, interaction data, user avatars, and image content; Generate web page content features and sentiment features of community members based on community member data, and use web page content features to calculate structured tags of community members; generating a graph structure, wherein nodes in the graph structure include: a target webpage node and a community member node, wherein node representations of the target webpage node and the community member node are generated based on webpage content features, sentiment features, and structured tags, and weighted edges in the graph structure are constructed based on the webpage content features and structured tags; Construct a graph neural network and use the neighbor sampling strategy of GraphSAGE to extract and propagate features of node representations and edge weights in the graph structure to obtain the final representation of each node; Using a classifier to classify the final representation to obtain a legal risk label of the node; wherein, when the label output by the classifier is unknown, the legal risk label of the node is predicted based on the distribution of legal risk labels of the node's adjacent nodes; For a community member with the same legal risk label as the target webpage, the community member data of the community member is output and the risk category and relevant legal terms of the community member data are marked to obtain the second evidence content.

5. The method according to any one of claims 1 to 4, characterized in that After encapsulating the first evidence collection content, the second evidence collection content and the evidence collection process to obtain a first evidence file and digitally signing the first evidence file, the following steps are also included: Digitally notarizing the first evidence document and performing tamper-proof processing on the digitally notarized first evidence document to obtain a second evidence document; Upload the second evidence file to the evidence server for archiving and storage.

6. The method according to claim 5, characterized in that After uploading the second evidence file to the evidence server for archiving and storage, the method further includes: Associate the second evidential document with the case.

7. The method according to claim 5, characterized in that After uploading the second evidence file to the evidence server for archiving and storage, the method further includes: Download the second evidence file to the local computer and verify the second evidence file by combining anti-tampering processing technology and digital signature; After the verification is passed, check the evidence collection time, evidence collection process records and evidence file information; wherein, the evidence file information includes: evidence screenshots, text code of the evidence collection webpage, server information and network information of the website where the evidence collection webpage is located.

8. The method according to claim 5, characterized in that After uploading the second evidence file to the evidence server for archiving and storage, the method further includes: Categorize and manage the second evidence files and provide a tree structure display; Manage and maintain the evidence labeling system; The second evidence files in the evidence server are statistically analyzed for the number of evidence collected, the trend of evidence collected, the classification of evidence collected, the method of evidence collected, and the source of evidence collected, and a visual analysis chart is generated to display the evidence classification information, evidence collection unit information, and jurisdiction information within the business scope.

9. The method according to claim 5, characterized in that After uploading the second evidence file to the evidence server for archiving and storage, the method further includes: Multi-threaded computing is used to optimize the image in the second evidence file.

10. A distributed batch Internet content clue automatic evidence collection system, characterized by: The system comprises: A web page rendering module is used to obtain the web page address of the target web page in the forensic operation, and after obtaining the web page data of the target web page according to the web page address, perform web page rendering; An evidence sampling and extraction module is used to extract first evidence content from the generated web page; an evidence enhancement processing module, configured to enhance and generate the first evidence content to obtain a web page similar to the evidence content, and extract a second evidence content from the web page similar to the evidence content; The evidence encapsulation module is used to encapsulate the first evidence content, the second evidence content and the evidence collection process to obtain a first evidence file and digitally sign the first evidence file; wherein the evidence collection process includes: evidence collection time, evidence collector and evidence collection process log.

Images