Law enforcement data intelligent extraction method based on logic rule engine

Abstract

The application discloses a law enforcement data intelligent extraction method based on a logic rule engine and relates to the technical field of law enforcement data processing.The method comprises the following steps: acquiring prior data extraction records and constructing a logic rule engine based on the prior data extraction records; acquiring a law enforcement data extraction instruction and performing data extraction authentication correspondingly; if the data extraction authentication result is passed, the law enforcement data extraction instruction is parsed to determine a data extraction origin; a target electronic device is accessed, original data in the target electronic device is extracted and parsed, and a structured parameterized data list is generated; the data extraction origin and the parameterized data list are input into the logic rule engine for matching, and a matching data list is determined; based on the matching data list, the original data in the target electronic device is matched and extracted, and the matching extraction result is structured, and a law enforcement data extraction result is generated.The application effectively improves the extraction efficiency of the law enforcement data result and reduces the risk of evidence omission.

Description

Technical Field

[0001] This invention relates to the field of law enforcement data processing technology, specifically to a method for intelligent extraction of law enforcement data based on a logic rule engine. Background Technology

[0002] The widespread adoption of smart terminals and internet services has generated a massive amount of electronic data, which can potentially become crucial evidence in cases. The diverse sources and formats of electronic data, coupled with complex interrelationships, present significant challenges to its extraction, understanding, and analysis.

[0003] In current law enforcement data extraction practices, traditional methods, while having the advantages of simple tools and clear objectives, and being able to quickly process routine data from a single source, are inefficient when faced with massive amounts of multi-source, heterogeneous electronic data, leading to a high risk of missing key evidence. Summary of the Invention

[0004] This application provides a method for intelligent extraction of law enforcement data based on a logic rule engine, aiming to solve the technical problems of low efficiency in law enforcement data extraction and high risk of missing key evidence in existing technologies.

[0005] In view of the above problems, this application provides a method for intelligent extraction of law enforcement data based on a logic rule engine, including:

[0006] Obtain prior data extraction records and construct a logical rule engine based on the prior data extraction records, wherein the logical rule engine includes an outer association rule module and multiple inner context rule modules;

[0007] Obtain the law enforcement data extraction instruction and perform corresponding data extraction authentication. If the data extraction authentication result is successful, parse the law enforcement data extraction instruction to determine the data extraction origin.

[0008] Access the target electronic device, extract and parse the raw data in the target electronic device, and generate a structured parameterized data list. Each data record in the parameterized data list contains at least a data source identifier, a spatiotemporal coupling parameter, and a data state parameter.

[0009] The data extraction origin and the parameterized data list are input into the logical rule engine for matching to determine the matching data list;

[0010] Based on the matching data list, the target electronic device is accessed to match and extract the original data, and the matching extraction results are processed in a structured manner to generate law enforcement data extraction results.

[0011] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0012] This application provides a method for intelligent extraction of law enforcement data based on a logical rule engine. By constructing a hierarchical logical rule engine, it connects scattered and isolated evidence collection processes. This not only enables efficient and accurate screening of target evidence from massive amounts of electronic data based on contextual information such as data source and spatiotemporal parameters, but also allows the rule engine to uncover deep relationships hidden between different data fragments. This automatically constructs a logically rigorous, clearly structured, and compliant complete chain of evidence, improving the efficiency of law enforcement data extraction and effectively reducing the risk of evidence omission. Attached Figure Description

[0013] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0014] Figure 1 A flowchart illustrating the intelligent extraction method for law enforcement data based on a logic rule engine provided in this application embodiment. Detailed Implementation

[0015] This application provides a method for intelligent extraction of law enforcement data based on a logic rule engine, which is used to address the technical problems of low efficiency in law enforcement data extraction and high risk of missing key evidence in existing technologies.

[0016] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0017] It should be noted that the terms "comprising" and "having" are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or modules that are not explicitly listed or that are inherent to these processes, methods, products, or devices.

[0018] Examples, such as Figure 1 As shown, this application provides a method for intelligent extraction of law enforcement data based on a logic rule engine, the method including:

[0019] S100: Obtain prior data extraction records and build a logical rule engine based on the prior data extraction records. The logical rule engine includes an outer association rule module and multiple inner context rule modules.

[0020] In this embodiment, prior data extraction records are obtained, and a logical rule engine is constructed based on these records. The logical rule engine includes an outer-layer association rule module and multiple inner-layer context rule modules. This achieves intelligent and standardized evidence collection, automatically discovering cross-data source associations and deeply mining internal patterns through the hierarchical rule engine. This significantly improves the targeting, completeness, and efficiency of evidence extraction, outputting a structured evidence chain with clear spatiotemporal logic.

[0021] Step S100 in the method provided in this application embodiment includes:

[0022] Obtain prior data extraction records and build a logical rule engine based on these records, including:

[0023] Collect historical data to extract records, and filter the historical data extraction records based on preset confidence constraints to obtain prior data extraction records;

[0024] Based on the preset data parameter extraction list, the prior data extraction records are parametrically analyzed to determine the sample data list. The sample data list includes several hierarchical data list clusters, and each hierarchical data list cluster includes a data source list and a context data list of multiple associated data sources.

[0025] Based on the sample data list, an outer association rule module and multiple inner context rule modules are constructed using graph neural networks. The outer association rule module and multiple inner context rule modules are then linked to obtain a logical rule engine.

[0026] First, historical data extraction records are collected and filtered based on preset confidence constraints to obtain prior data extraction records. All past data extraction operation logs are collected and filtered according to clear validity standards, retaining the most reliable records. For example, a certain forensics platform aggregated operation records of all historical investigation tasks for a certain electronic device, collecting 800 data extraction records from commercial leak investigations over the past 5 years. Each record includes the leak event number, the data source involved, the extracted data content, data integrity, and investigation conclusion. Preset confidence constraints are: data integrity ≥ 90%, key fields such as file transfer records and attachment information are not missing; investigation conclusion is confirmed leak. After filtering, 120 records with missing data and 280 records excluding leaks are removed, leaving 400 highly reliable commercial leak data extraction records as prior data extraction records, such as: [Event number X001; involves chat software, corporate email, cloud storage; complete chat logs, email attachments, and cloud files were extracted; leak confirmed]. This step ensures that the data foundation used to build the model is highly effective and reliable, avoiding interference from invalid or erroneous operating patterns on model training, and laying the foundation for building a high-accuracy rule engine in the future.

[0027] Secondly, based on a pre-defined data parameter extraction list, parametric analysis is performed on the prior data extraction records to determine the sample data list. This sample data list comprises several hierarchical data list clusters, each including a data source list and context data lists of multiple associated data sources. Using standardized field definitions, the selected prior records are structurally parsed and converted into a unified, hierarchical parameter format. For example, for a prior record concerning trade secrets, the pre-defined data parameter extraction list is as follows: Data source list: [chat software, corporate email, cloud storage]; Chat software context data list: [chat time, chat partner, message content, file transfer record]; Corporate email context data list: [email sending time, sender / recipient, email subject, attachment information]; Cloud storage context data list: [file creation / modification time, file name, file storage path]. All this information constitutes a structured sample data list. Transforming unstructured investigative experience into a machine-readable unified format provides standardized input for neural network training.

[0028] Furthermore, based on the sample data list, an outer association rule module and multiple inner context rule modules are constructed using graph neural networks, and the outer association rule module and multiple inner context rule modules are associated to obtain a logical rule engine.

[0029] The method provided in this application embodiment, which "constructs an outer-layer association rule module and multiple inner-layer context rule modules based on a sample data list and in conjunction with a graph neural network, and associates the outer-layer association rule module with the multiple inner-layer context rule modules to obtain a logical rule engine," includes:

[0030] Based on the sample data list, multiple data sources are extracted to generate a list of source data, which is then output as the first rule sample data.

[0031] Using the first rule sample data as training input, multiple data sources as outer graph nodes, and the combination of associated data categories between multiple data sources as node edges, an outer graph neural network is constructed and trained to obtain the outer association rule module.

[0032] First, based on the sample data list, multiple data generation source lists are extracted, and the output is the first rule sample data. For example, from the hierarchical data list cluster of the sample data list, all data generation source combinations are extracted, that is, the data source relationships involved in the data breach, such as: [chat software, corporate email], [chat software, cloud storage], [corporate email, cloud storage], [chat software, corporate email, cloud storage], etc., a total of 12 combinations, which are the first rule sample data, and can reflect the possible flow path of the leaked data.

[0033] Secondly, using the first rule sample data as training input, multiple data sources as outer graph nodes, and combinations of associated data categories between multiple data sources as node edges, an outer graph neural network is constructed and trained to obtain the outer association rule module. This step aims to automatically discover and quantify the inherent connections between different data applications in the survey scenario. Continuing the previous example, the outer graph nodes are chat software, corporate email, and cloud storage; the node edges are combinations of associated data categories between data sources, i.e., key data categories used to determine data flow between sources. For example, through graph neural network training, the association strength between nodes is calculated. After training, it is found that the association edge between corporate email and cloud storage is mainly contributed by the data category combination of email attachments and cloud files, with an association weight as high as 0.94. The outer association rule module is output, which encapsulates the association relationships between nodes and edges. When a new survey task involves corporate email, this module can automatically suggest that the investigator check cloud storage simultaneously based on the association weight of 0.94, realizing intelligent association recommendations across data sources.

[0034] The method provided in this application embodiment, which "constructs an outer-layer association rule module and multiple inner-layer context rule modules based on a sample data list and combines a graph neural network, and associates the outer-layer association rule module with the multiple inner-layer context rule modules to obtain a logical rule engine," further includes:

[0035] Based on the sample data of the first rule, determine the set of all data generation sources;

[0036] Using the entire set of data sources as an index, iterate through the sample data list to extract the context data list set corresponding to each data source.

[0037] Multiple inner graph neural networks are constructed and trained using multiple context data lists as training inputs, multiple data category labels within each data source as inner graph nodes, and the association window ratios between multiple data category labels as node edges, to obtain multiple inner context rule modules.

[0038] Using the data source as an index, establish the association mapping relationship between the outer association rule module and multiple inner context rule modules to obtain the logical rule engine.

[0039] First, based on the sample data of the first rule, determine the set of all data sources. For example, by summarizing all data sources in the sample data of the first rule, we obtain the set of all data sources: {chat software, corporate email, cloud storage}.

[0040] Secondly, using the entire set of data sources as an index, the sample data list is iteratively extracted to obtain the context data list set corresponding to each data source. For example, using chat software as an index, the sample data list is traversed to extract the context data of the chat software in all leakage events, forming a chat software context data list set: chat time, chat objects, message content, and file transfer records. Similarly, the context data list set for enterprise email includes: sending time, recipient, attachment information, etc.; the list set for cloud storage includes: file storage path, modification time, etc.

[0041] Furthermore, using multiple contextual data lists as training inputs, multiple data category labels within each data source as inner graph nodes, and the correlation window ratios between multiple data category labels as node edges, multiple inner graph neural networks are constructed and trained to obtain multiple inner contextual rule modules. For example, using a chat software's contextual data list as input, an inner graph neural network is constructed: Inner graph nodes: chat time, chat object, message content, file transfer records; Node edges: correlation window ratio, i.e., the probability of two labels appearing simultaneously in the same leakage event. For example, the proportion of external unfamiliar email addresses and transfer records containing sensitive files appearing simultaneously is 92%, meaning that external objects + sensitive file transfers are a high-risk signal; the proportion of non-working hours and messages containing core data appearing simultaneously is 78%. After training, the chat software's inner contextual rule module is obtained, which can output the rule: When the chat software's chat object is an external unfamiliar email address + a sensitive file transfer, the leakage risk is 85% higher than that of internal objects. Similarly, the enterprise email inner module can identify: recipients from external domains + compressed attachments larger than 10MB with an extremely high risk of leakage; the cloud drive inner module can identify: files with sensitive tagged paths + modifications within 24 hours that are strongly correlated with leakage events.

[0042] Finally, using the data source as an index, an association mapping relationship is established between the outer-layer association rule module and multiple inner-layer context rule modules to obtain the logical rule engine. Using the data source of the outer-layer module as an index, an association mapping is established: when the outer-layer module triggers the association rule for [chat software, corporate email], i.e., data flows from the chat software to the email, the chat software's inner-layer module and the corporate email's inner-layer module are automatically invoked. If the inner-layer module outputs: Chat software: external object + sensitive file; Corporate email: external recipient + 10MB compressed file, it is judged as a high risk of leakage, triggering an alert; if the inner-layer module outputs: Chat software: internal object; Corporate email: internal recipient, it is judged as a low risk. This ultimately forms a commercial data leakage tracking logical rule engine, which can accurately identify leakage behavior by combining cross-source data flow paths and source-internal context details.

[0043] In this embodiment, historical data is filtered through confidence constraints to ensure the reliability of prior data and lay the foundation for rule construction; parametric analysis forms a hierarchical data list cluster, clearly distinguishing cross-source associations and intra-source context, providing structured input; the advantages of graph neural networks in processing graph structured data are utilized to accurately capture the complex associations between and within data categories; and outer and inner modules are linked to achieve synergy between macroscopic and microscopic associations, avoiding the limitations of single-level rules.

[0044] S200: Obtain the law enforcement data extraction instruction and perform corresponding data extraction authentication. If the data extraction authentication result is successful, parse the law enforcement data extraction instruction to determine the data extraction origin.

[0045] Step S200 in the method provided in this application embodiment includes:

[0046] Based on the target scenario, the trusted information platform authenticates and verifies the acquired law enforcement data extraction instructions, including instruction security authentication and data scope authentication.

[0047] If the authentication result is successful, the first evidence data is obtained based on the law enforcement data extraction instruction;

[0048] The first piece of evidence data is analyzed to obtain the corresponding evidence data source, evidence collection spatiotemporal coupling parameters, and evidence data state parameters, which are then determined as the data extraction origin.

[0049] First, based on the trusted information platform for the target scenario, the acquired law enforcement data extraction instructions undergo authentication and verification, including instruction security authentication and data scope authentication. Upon arrival of the law enforcement instruction, it must first undergo dual verification on the trusted platform: instruction security authentication, i.e., whether the instruction itself is legal; and data scope authentication, i.e., whether the data scope requested by the instruction is within the authorized range. After successful verification, preliminary investigative evidence is extracted from the instruction. For example, in a fraud case investigation, the police need to extract data from the suspect's iOS device, generating a law enforcement data extraction instruction containing the case number, the handler's permission ID, the target device ID, and the data type to be extracted. Instruction security authentication: Verifies the digital signature of the instruction and the handler's permissions through the trusted information platform of the public security system to prevent forged or unauthorized instructions. Data scope authentication: Verifies whether the data type to be extracted in the instruction is within the legal scope, such as only allowing the extraction of call records and chat logs related to the case, prohibiting the extraction of irrelevant private photos, ensuring compliance with regulations.

[0050] Secondly, if the authentication result is successful, the first evidence data is obtained based on the law enforcement data extraction instruction. For example, after successful authentication, the first evidence data is initially obtained from the cloud disk server according to the target device ID in the instruction, including: the cloud disk account bound to the device, the time of the last 3 backups, and the synchronization function that has been enabled.

[0051] Furthermore, the first piece of forensic data is analyzed to obtain the corresponding data generation source, spatiotemporal coupling parameters, and data status parameters, which are then used as the data extraction origin. The data generation source refers to the application, system component, or hardware that generates the data; the spatiotemporal coupling parameters refer to the physical and logical location and time information of the data storage, including at least storage location information and storage timestamp; the data status parameters refer to the current state and characteristics of the data. For example, analyzing the above first piece of forensic data, the data extraction origin is determined as follows: Data generation source: [cloud disk server, iPhone 15 device, chat software APP]; Spatiotemporal coupling parameters: [Data generation time: 2025-09-01 to 2025-09-15; Device activity location: a certain district in a certain city]; Data status parameters: [Cloud disk backup encryption: yes; Chat software chat history with attachments: yes].

[0052] The method provided in this application embodiment, which "parses law enforcement data extraction instructions to determine the data extraction origin", further includes:

[0053] If there are multiple data extraction origins, then take each of the multiple data extraction origins as the analysis target and construct multiple isolated data extraction groups in combination with the parameterized data list;

[0054] Multiple isolated extracted data groups are input into the logical rule engine for parallel matching to obtain multiple isolated matching data lists;

[0055] Calculate the intersection of multiple isolated matching data lists, and define it as the preferred data list;

[0056] The difference between the union of multiple isolated matching data lists and the priority data list is calculated and defined as the supplementary data list;

[0057] Using the priority data list as the first extraction target and the supplementary data list as the subsequent extraction target, the original data of the target electronic device pair is accessed for sequential batch data extraction, and the extraction batch is marked accordingly to obtain the law enforcement data extraction results.

[0058] In this embodiment, if multiple data extraction origins exist, each origin is used as the analysis target, and multiple isolated extraction data groups are constructed in conjunction with a parameterized data list. For example, if the case involves two devices belonging to the suspect, an iPhone 15 and an iPad, two data extraction origins are formed: Origin 1: {Device: iPhone 15, Application: Chat software, Time: 2025-09-01 to 09-15}; Origin 2: {Device: iPad, Application: Corporate email, Time: 2025-09-05 to 09-20}. Two isolated extraction data groups are then constructed.

[0059] Then, multiple isolated extracted data sets are input into the logic rule engine for parallel matching, resulting in multiple isolated matching data lists. For example, the two isolated extracted data sets mentioned above are input into the logic rule engine constructed by S100 for parallel matching. For origin 1, the outer association rule module infers based on historical patterns that chat software fraudulent chats are often associated with photo albums and cloud drives, while the inner context rule module identifies chat patterns containing suspicious transfer instructions. For origin 2, the outer module infers that corporate emails are often associated with memos and cloud drives, while the inner module identifies email patterns where the attachment name contains an invoice but the body content does not match the transaction. Two isolated matching data lists are output: List 1: [Chat software - fraudulent transfer chat, photo album - related screenshots, cloud drive - shared folder A]; List 2: [Corporate email - fake invoice email, memo - transaction account record, cloud drive - shared folder A].

[0060] Secondly, the intersection of multiple isolated matching data lists is calculated and defined as the priority data list. The priority data list consists of overlapping data in two lists. For example, comparing two lists, it is found that they both point to the same specific evidence: cloud drive - shared folder A, indicating that the suspicious activities on both devices are associated with the same location in the cloud. Priority data list: [cloud drive - shared folder A].

[0061] Furthermore, the difference between the union of multiple isolated matching data lists and the priority data list is calculated and defined as the supplementary data list. For example, List 1 contains: [Chat software - chat involving fraudulent transfers, album - related screenshots]; List 2 contains: [Corporate email - emails containing fake invoices, memo - transaction account records]. Supplementary data list: [Chat software - chat involving fraudulent transfers, album - related screenshots, corporate email - emails containing fake invoices, memo - transaction account records].

[0062] Finally, using the priority data list as the initial extraction target and the supplementary data list as the subsequent extraction target, the raw data of the target electronic devices was accessed for batch data extraction, and the extraction batches were marked accordingly to obtain the law enforcement data extraction results. For example, Batch 1: According to the priority data list, a certain evidence collection platform first centrally accessed the cloud disk server, accurately downloaded and decrypted all the contents in shared folder A, and marked it as the first batch of core related evidence; Batch 2: According to the supplementary data list, other data was extracted in an orderly manner, extracting chat and photo screenshots from specified chat software from iPhones, and extracting specified corporate emails and memos from iPads. The final law enforcement data extraction result is a structured report that clearly records: the evidence in Batch 1 comes from the cloud disk, and explains the reason for its priority extraction, as it is the key intersection connecting the two devices. The evidence in Batch 2 is listed according to the source device, forming a complete, clear and prioritized chain of evidence.

[0063] In this embodiment, the legality and compliance of the evidence collection operation are ensured through a dual authentication mechanism of instruction security and zero data range. Then, the origin of data extraction is determined by accurately parsing the law enforcement instructions. When there are multiple origins, a priority data list and a supplementary data list are intelligently generated by parallel matching and set operation methods. Based on this, sequential batch data extraction and marking are realized, and finally, law enforcement data extraction results with clear structure, complete evidence chain and clear priority are output, thereby significantly improving the efficiency and quality of evidence collection while ensuring procedural justice.

[0064] S300: Access the target electronic device, extract and parse the raw data in the target electronic device, and generate a structured parameterized data list. Each data record in the parameterized data list contains at least the data source identifier, spatiotemporal coupling parameters, and data status parameters.

[0065] Step S300 in the method provided in this application embodiment includes:

[0066] Access the target electronic device's file system using data extraction tools to obtain raw data;

[0067] Parse the raw data and add data tags to each data record. The data tags should include at least the data source identifier, spatiotemporal coupling parameters, and data status parameters.

[0068] Based on the file topology of the file system, structured storage data tags are generated to produce a parameterized data list;

[0069] Among them, the spatiotemporal coupling parameters include at least the associated storage location information and storage timestamp, and the data status parameters include at least the deletion status identifier, data size attribute and hash value.

[0070] First, data extraction tools are used to access the target electronic device's file system to obtain raw data. Specialized forensic tools are used to interact with the target device's operating system at a low level, bypassing the ordinary user interface to directly read its file system and database, obtaining a raw copy containing all user data and metadata. For example, a certain forensic platform accessed the suspect Wang's iPhone via a physical connection or authorized access protocol, directly accessing its file system. The obtained raw data includes: chat log databases in the ` / var / mobile / Containers / Data / Application / chat software MM.sqlite` directory, raw photo files in the ` / DCIM` folder, system logs in ` / private / var / logs`, etc. Raw data is the foundation of electronic forensics; specialized tools are needed to overcome device access restrictions to ensure complete access to the stored content, obtaining full raw data covering system, application, and user-generated content. This provides a complete data foundation for subsequent analysis and structuring, avoiding the omission of critical information.

[0071] Secondly, the raw data is parsed, and data tags are added to each data record. Data tags must include at least a data source identifier, spatiotemporal coupling parameters, and data status parameters. The data source identifier is a tag that clearly records the source of the data, typically including the application name, account, session object, etc. Spatiotemporal coupling parameters are tags describing the spatiotemporal attributes of data storage, including at least storage location information and storage timestamps. Data status parameters are tags describing the physical state of the data, including at least a deletion status identifier, data size attribute, and hash value. The hash value is a unique digital fingerprint calculated using a specific algorithm, used for integrity verification.

[0072] For example, a message in the MM.sqlite database of a chat software is parsed. The parser decodes the database structure, extracts a specific chat message, and adds the following tags to it: Data source identifier: [Application: Chat software; Account: Wang_123; Session object: Li_456]; Spatiotemporal coupling parameters: [Storage location information: / var / ... / MM.sqlite; Storage timestamp: 2025-10-05 23:15:30 UTC]; Data status parameters: [Deleted status identifier: Deleted; Data size attribute: 1.2MB; Hash value: SHA-256: e3b0c44298fc1c14...]. The raw data is unstructured, and the machine cannot directly understand its semantics. The tagging process transforms the data into information units with unified semantics, which is a prerequisite for achieving automated processing. Each piece of data is given a clear source, spatiotemporal coordinates, and physical state, transforming it from binary data into a structured object that can be accurately matched, associated, and reasoned by the rule engine.

[0073] Finally, based on the file topology of the file system, structured storage data tags are generated to produce a parameterized data list. File topology refers to the logical structure and hierarchical relationship between files and directories within the file system. Forensic investigation is not simply about piling all records into a list, but rather organizing them based on the original file topology. For example, in the parameterized data list, the top level is divided by data source, such as chat software, photos, and corporate email; under the chat software source, it is further grouped by different chat sessions, such as the conversation with Li_456; under each session, all message records are sorted by storage timestamp, and each record fully presents all its spatiotemporal coupling parameters and data status parameters. The final result is a queryable, sortable, and filterable parameterized data list. For example, in the chat software conversation with Li_456, there is a record stored on 2025-10-05 23:15:30, with a deleted status and a size of 1.2MB, whose hash value is SHA-256: e3b0c44298fc1c14. Maintaining the original topological relationships of data helps preserve the data context and facilitates understanding the relationships between data. Structured storage methods greatly optimize the efficiency of data retrieval, filtering, and batch processing.

[0074] In this embodiment, unstructured raw data in the target electronic device is transformed into a standardized parameterized data list. By adding source identifiers, spatiotemporal coupling parameters and data state parameters to each data record and performing structured storage based on file topology, the standardized representation and integrity verification of electronic evidence are realized, providing a complete, reliable and machine-readable data foundation for the accurate matching of subsequent logical rule engines.

[0075] S400: Input the data extraction origin and parameterized data list into the logic rule engine for matching to determine the matching data list.

[0076] Step S400 in the method provided in this application embodiment includes:

[0077] The data extraction origin is fed into the logic rule engine. Based on the source of the evidence data generated by the data extraction origin, the corresponding inner context rule module is matched and determined to be the main context rule module.

[0078] Based on the source of evidence collection data, spatiotemporal coupling parameters of evidence collection, and state parameters of evidence collection data, the backbone data boundary is determined in conjunction with the backbone context rule module.

[0079] Using the backbone data boundary as a constraint, traverse the parameterized data list to perform data matching and obtain the backbone matching data list;

[0080] Based on the source of evidence-collected data and the outer association rule module, a list of associated matching data sources is determined. The list of associated matching data sources is marked with multiple corresponding combinations of associated data categories.

[0081] Using the source list of associated matching data as a constraint, traverse the parameterized data list to perform data matching and obtain the first associated matching data list;

[0082] The first associated matching data list is combined with multiple inner context rule modules for iterative matching to determine the second associated matching data list to the Nth associated matching data list, until the preset iterative constraints are met, where N is greater than or equal to 3;

[0083] The main matching data list, the first associated matching data list, the second associated matching data list, and the Nth associated matching data list are merged and output to form the matching data list.

[0084] First, the data extraction origin is fed into the logic rule engine. Based on the source of the evidence data from the data extraction origin, the corresponding inner context rule module is matched and determined as the main context rule module. For example, input: data extraction origin {source: [corporate email], ...}. The logic rule engine receives the origin and identifies the investigation target as corporate email. Subsequently, among multiple inner context rule modules, the corporate email inner context rule module specifically customized for analyzing corporate email data is matched. Output: The corporate email inner context rule module is determined as the main context rule module. This ensures that the most suitable analysis rules are used for the core investigation target, laying the foundation for subsequent in-depth analysis.

[0085] Secondly, based on the data source, spatiotemporal coupling parameters, and data status parameters, the backbone data boundary is determined using the backbone context rule module. Utilizing the activated backbone context rule module, and combining it with the specific parameters provided in the data extraction origin, a precise initial data filtering range is defined. For example, given the data extraction origin {Source: [Company Email], Time: October 2025, Data Category: Document / Attachment} and the backbone context rule module, the parameters in the origin are parsed using the backbone context rule module, transforming time and data category into executable filtering conditions. The backbone data boundary is defined as: all email records with attachments from the company email address within October 2025. This transforms vague investigative intentions into machine-executable, clear data query boundaries, narrowing the initial scan range and improving positioning efficiency.

[0086] Furthermore, using the backbone data boundaries as constraints, the parameterized data list is traversed for data matching to obtain the backbone matching data list. In the parameterized data list generated in step S300, scanning and filtering are performed according to the conditions set by the backbone data boundaries. For example, the engine traverses all data records marked as originating from corporate email addresses in the parameterized data list, filtering out records with timestamps within the range of October 2025 and whose data status parameters indicate attachments. This yields the backbone matching data list, containing five specific email records sent in October with attachments such as "design draft.pdf" and "technical specifications.docx". The first round of data extraction based on explicit rules is performed to obtain evidence directly related to the case, forming the most direct and highest-weighted set of basic evidence in the evidence chain of this case.

[0087] Furthermore, based on the sources of the evidence-gathering data and the outer association rule module, a list of associated matching data sources is determined. This list is marked with multiple corresponding combinations of associated data categories. The data sources are input into the rule module responsible for analyzing the relationships between data sources to obtain a list of other data sources with strong associations. For example, if a company email address is input into the outer association rule module, this module, based on patterns learned from historical data, outputs other data sources closely related to the company email address and their associated contexts. The output list of associated matching data sources is: {[Target: Chat software; Association combination: Email subject / body, chat content]; [Target: Cloud storage; Association combination: Email attachment, cloud file]}. This list indicates the direction for further association investigation.

[0088] Secondly, using the source list of associated matching data as a constraint, the parameterized data list is traversed for data matching to obtain the first associated matching data list. For example, the engine traverses the [chat software] and [cloud drive] sections of the parameterized data list and combines the time parameter [October 2025] from the data extraction origin to perform preliminary matching. The first associated matching data list is output, containing: chat records in the chat software related to the core email subject or sender, and file records in the cloud drive with the same name as the core email attachment. This completes the horizontal expansion of the evidence chain and obtains circumstantial evidence directly related to the core evidence.

[0089] Furthermore, the first associated matching data list is combined with multiple inner context rule modules for iterative matching to determine the second associated matching data list to the Nth associated matching data list, until the preset iterative constraints are met, where N is greater than or equal to 3.

[0090] The method provided in this application embodiment, which "combines a first associated matching data list with multiple inner context rule modules for iterative matching to determine a second associated matching data list to an Nth associated matching data list, until a preset iterative constraint is met," includes:

[0091] Using the source list of associated matching data as an index, determine the corresponding K associated inner context rule modules;

[0092] The first associated matching data list is split and input into the inner context rule module of K associations to obtain K second-level associated matching data lists, and then merged and output as the second associated matching data list;

[0093] The second associated matching data list is split and input into the inner context rule module of K associations to obtain K third-level associated matching data lists, and then merged and output as the third associated matching data list;

[0094] The input is split iteratively until the preset iteration constraints are met. The iteration constraints include: the number of iterations meets the preset number of extraction levels.

[0095] First, using the list of associated matching data sources as an index, determine the corresponding K inner context rule modules. Based on the previously determined list of associated data sources, find the dedicated inner analysis modules corresponding to each of these data sources. The K associated inner context rule modules refer to specially customized analysis modules that correspond one-to-one with the data sources in the list; the number K is consistent with the number of data sources in the list. For example, given the list of associated matching data sources [chat software, cloud storage], the engine uses this list as an index to search and determine in the rule base: the chat software inner context rule module corresponding to chat software; and the cloud storage inner context rule module corresponding to cloud storage. The output determines K=2 inner rule modules that need to be used in this iteration.

[0096] Secondly, the first set of associated matching data lists is split and input into K related inner context rule modules to obtain K second-level associated matching data lists, which are then merged and output as the second set of associated matching data lists. The results of the first round are distributed to the corresponding inner modules for in-depth analysis according to their data sources, and then the analysis results of each module are summarized. Splitting the input refers to routing the data to the corresponding inner rule module based on the data source identifier of the data record. For example, chat logs from a chat software are only input to the chat software module, and cloud drive files are only input to the cloud drive module. The second-level associated matching data list is a list of newly discovered, deeper-level data that is associated with the input data, after each inner module has performed in-depth analysis of the input data. For example, the first set of associated matching data lists includes: chat logs A and B from a chat software and cloud drive file C. Chat logs A and B are input to the chat software inner context rule module; file C is input to the cloud drive inner context rule module. In-depth analysis: Using the chat software module to analyze chat logs A and B, it was found that log B mentioned a link and password for an external cloud storage service D, so the output is: [Cloud Storage Application D]; Using the cloud storage module to analyze file C, it was found that its creation metadata points to a screenshot E in the photo library, so the output is: [Photo E]. The resulting second list of related matching data is [Cloud Storage Application D, Photo E].

[0097] Furthermore, the second association matching data list is split and input into K related inner context rule modules to obtain K third-level association matching data lists, which are then merged and output as the third association matching data list. The second association matching data list is used as new input, and the above process is repeated. For example, given the second association matching data list [cloud storage application D, photo E], all relevant records of cloud storage application D are input into the cloud storage application inner context rule module; the image file and related metadata of photo E are input into the photo inner context rule module. After training, the cloud storage application inner context rule module can identify abnormal login patterns and discovers a successful login record from an unknown IP address F. The geographical location of this IP address does not match the suspect's usual residence, so the output is: [IP address F]. The photo inner context rule module integrates optical character recognition and natural language processing capabilities to identify text content in images. It successfully identifies a phone number G written on a whiteboard that is not saved in the address book and determines it to be a mobile phone number, outputting: [Phone number G]. The merged output yields K=2 third-level related matching data lists: [IP address F, phone number G], which is the third related matching data list.

[0098] Based on this, the input is iteratively split until the preset iterative constraints are met. These constraints include: the number of iterations must meet a preset extraction level. Iterative constraints are a set of conditions that control loop termination, ensuring the mining process automatically stops after reaching the desired depth, avoiding infinite loops or mining irrelevant information. The extraction level is a preset integer that defines the maximum number of rounds of correlation expansion starting from the data extraction origin. For example, if the preset extraction level is 3, three iterations have already been completed in the previous steps: Level 1: Expanding from the initial origin [corporate email] to [chat software, cloud storage]; Level 2: Expanding from [chat software, cloud storage] to [cloud storage applications, photos]; Level 3: Expanding from [cloud storage applications, photos] to [IP addresses, phone numbers]. The engine's internal counter shows the current iteration count as 3. Comparing the counter with the preset extraction level, since 3 ≥ 3, the iterative constraint is met, and the iterative matching process immediately stops. [IP addresses, phone numbers] will not be input into any inner module for a fourth round of analysis.

[0099] Finally, the main matching data list, the first associated matching data list, the second associated matching data list, and so on up to the Nth associated matching data list are merged to form the matching data list. For example, in a business data breach case, the main matching data list includes: 5 confidential emails with attachments in the company email; the first associated matching data list includes: chat logs in a chat software associated with the email subject, and files in a cloud drive with the same names as the email attachments; the second associated matching data list includes: external cloud drive access logs associated with the chat logs; and the third associated matching data list includes: abnormal IP addresses parsed from the cloud drive logs and meeting whiteboard phone numbers identified from photo metadata. The final matching data list integrates all the above records, forming a complete set of evidence including emails, chat logs, files, logs, IP addresses, and phone numbers.

[0100] In this embodiment, by inputting the data extraction origin and parameterized data list into the logic rule engine, the main data boundary is first determined and the main matching data list is generated based on the inner context rule module of the data generation source matching. Then, the related data generation source list is obtained through the outer association rule module and the first related matching data list is generated. Subsequently, the second to Nth related matching data lists are generated through multiple rounds of iterative matching until the preset iteration constraints are met. Finally, all matching lists are merged to form a structured output that fully covers the main body and multi-level related evidence, realizing the automated construction and in-depth mining of the multi-level evidence network from the initial investigation starting point.

[0101] S500: Based on the matching data list, access the target electronic device to match and extract the original data, and perform structured processing on the matching and extraction results to generate law enforcement data extraction results.

[0102] In this embodiment, based on the matching data list, the target electronic device is accessed to match and extract the original data, and the matching extraction results are structured to generate law enforcement data extraction results. For example, the final matching data list generated by S400 includes: Record A: {Source: Corporate email, Storage path: / var / ... / Mail.sqlite, Record ID: 123, Data status: Not deleted}; Record B: {Source: Chat software, Storage path: / var / ... / MM.sqlite, Record ID: 456, Data status: Deleted}; Record C: {Source: Cloud drive, File path: / Documents / design_draft.pdf}. According to the description in the list, precise extraction is performed: Based on the path and ID of Record A, the complete email content, including sender, recipient, body, and attachments, is extracted from the email database; Based on the path and ID of Record B, the complete chat history and transmitted files are recovered from the unallocated space of the chat software database; Based on the path of Record C, a complete copy of the design_draft.pdf file is downloaded from the cloud drive. A series of complete raw data entities corresponding to the matching data list were extracted, such as .eml email files, chat log text, and .pdf documents. These were then structured to generate the final law enforcement data extraction results, for example: Core evidence: 5 core emails and their attachments; First related evidence: chat logs from relevant chat software and files with the same name in cloud storage; Second related evidence: access logs from external cloud storage; Third related evidence: abnormal IP address records and meeting photos containing phone numbers. Each piece of evidence is accompanied by detailed metadata such as source, time, and hash value.

[0103] The embodiments of this application, through the specific implementation methods described above, achieve the following technical effects: Digital encapsulation of evidence collection rules is achieved by constructing a logical rule engine; the legality of law enforcement operations is ensured and the starting point of the investigation is accurately located through instruction authentication and parsing; raw equipment data is transformed into a standardized parameterized data list; the rule engine is used for backbone positioning and multi-round iterative association matching to generate a matching data list covering multiple levels of evidence; finally, based on this list, data entity extraction and structured encapsulation are completed, and law enforcement data extraction results that meet judicial requirements are output. This achieves intelligent, standardized, and deeply correlated processes for electronic data evidence collection from clue input to evidence output, effectively improving data extraction efficiency and reducing the risk of evidence omission.

[0104] It should be noted that the order of the embodiments described above is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, the above description focuses on specific embodiments of this specification. Additionally, the processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired results. In some implementations, multitasking and parallel processing are possible or may be advantageous.

[0105] The above description is only a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

[0106] This specification and accompanying drawings are merely illustrative examples of this application and are intended to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Clearly, those skilled in the art can make various alterations and modifications to this application without departing from its scope. Therefore, if such modifications and modifications fall within the scope of this application and its equivalents, this application intends to include such modifications and modifications.

Claims

1. A method for intelligent extraction of law enforcement data based on a logic rule engine, characterized in that, include: Obtain prior data extraction records and construct a logical rule engine based on the prior data extraction records, wherein the logical rule engine includes an outer association rule module and multiple inner context rule modules; Obtain the law enforcement data extraction instruction and perform corresponding data extraction authentication. If the data extraction authentication result is successful, parse the law enforcement data extraction instruction to determine the data extraction origin. Access the target electronic device, extract and parse the raw data in the target electronic device, and generate a structured parameterized data list. Each data record in the parameterized data list contains at least a data source identifier, a spatiotemporal coupling parameter, and a data state parameter. The data extraction origin and the parameterized data list are input into the logical rule engine for matching to determine the matching data list; Based on the matching data list, the target electronic device is accessed to match and extract the original data, and the matching and extraction results are processed in a structured manner to generate law enforcement data extraction results; The process of acquiring prior data extraction records and constructing a logical rule engine based on these records includes: Collect historical data extraction records, and filter the historical data extraction records based on preset confidence constraints to obtain prior data extraction records; Based on a preset data parameter extraction list, the prior data extraction records are parametrically analyzed to determine a sample data list. The sample data list includes several hierarchical data list clusters, and each hierarchical data list cluster includes a data source list and a context data list of multiple associated data sources. Based on the sample data list, the outer association rule module and multiple inner context rule modules are constructed using graph neural networks, and the outer association rule module and multiple inner context rule modules are associated to obtain the logical rule engine; This includes accessing the target electronic device, extracting and parsing the raw data from the target electronic device, and generating a structured parameterized data list, including: The raw data is obtained by accessing the file system of the target electronic device using a data extraction tool; The raw data is parsed, and a data tag is added to each data record. The data tag includes at least the data source identifier, spatiotemporal coupling parameters, and data status parameters. Based on the file topology of the file system, the data tags are stored in a structured manner to generate the parameterized data list; The spatiotemporal coupling parameters include at least the associated storage location information and storage timestamp, and the data status parameters include at least the deletion status identifier, data size attribute, and hash value.

2. The intelligent extraction method for law enforcement data based on a logic rule engine as described in claim 1, characterized in that, Based on the sample data list, the outer association rule module and multiple inner context rule modules are constructed using a graph neural network, and the outer association rule module and multiple inner context rule modules are associated to obtain the logical rule engine, including: Based on the sample data list, extract multiple data generation source lists and output them as the first rule sample data; Using the first rule sample data as training input, the multiple data sources as outer graph nodes, and the combinations of associated data categories between the multiple data sources as node edges, an outer graph neural network is constructed and trained to obtain the outer association rule module.

3. The intelligent extraction method for law enforcement data based on a logic rule engine as described in claim 2, characterized in that, Based on the sample data list, the outer association rule module and multiple inner context rule modules are constructed using a graph neural network, and the outer association rule module and multiple inner context rule modules are associated to obtain the logical rule engine, which further includes: Based on the first rule sample data, determine the set of all data generation sources; Using the set of all data sources as an index, the sample data list is iteratively extracted to obtain the context data list set corresponding to each data source. Multiple inner graph neural networks are constructed and trained using multiple context data lists as training inputs, multiple data category labels within each data source as inner graph nodes, and the association window ratios between multiple data category labels as node edges, thereby obtaining multiple inner context rule modules. Using the data source as an index, establish an association mapping relationship between the outer association rule module and multiple inner context rule modules to obtain the logical rule engine.

4. The intelligent extraction method for law enforcement data based on a logic rule engine as described in claim 1, characterized in that, Obtain the law enforcement data extraction instruction and perform corresponding data extraction authentication. If the data extraction authentication result is successful, parse the law enforcement data extraction instruction to determine the data extraction origin, including: Based on the trusted information platform of the target scenario, the acquired law enforcement data extraction instructions are authenticated and verified, including instruction security authentication and data scope authentication. If the authentication result is successful, the first evidence data is obtained based on the law enforcement data extraction instruction; The first evidence data is parsed to obtain the corresponding evidence data generation source, evidence collection spatiotemporal coupling parameters, and evidence data state parameters, which are then determined as the data extraction origin.

5. The intelligent extraction method for law enforcement data based on a logic rule engine as described in claim 1, characterized in that, The data extraction origin and the parameterized data list are input into the logical rule engine for matching to determine the matching data list, including: The data extraction origin is fed into the logic rule engine. Based on the source of the evidence data generated by the data extraction origin, the corresponding inner context rule module is matched and determined to be the main context rule module. Based on the source of the evidence-collected data, the spatiotemporal coupling parameters of the evidence collection, and the state parameters of the evidence-collected data, the backbone data boundary is determined in conjunction with the backbone context rule module. Using the backbone data boundary as a constraint, the parameterized data list is traversed to perform data matching and obtain the backbone matching data list; Based on the source of the evidence-collected data and the outer association rule module, a list of associated matching data sources is determined, wherein the list of associated matching data sources is marked with multiple corresponding combinations of associated data categories; Using the source list of associated matching data as a constraint, the parameterized data list is traversed to perform data matching and obtain the first associated matching data list; The first associated matching data list is combined with multiple inner context rule modules for iterative matching to determine the second associated matching data list to the Nth associated matching data list, until the preset iterative constraints are met, where N is greater than or equal to 3; The main matching data list, the first associated matching data list, the second associated matching data list, and the Nth associated matching data list are merged and output to form the matching data list.

6. The intelligent extraction method for law enforcement data based on a logic rule engine as described in claim 5, characterized in that, Iterative matching is performed between the first associated matching data list and multiple inner context rule modules to determine the second to Nth associated matching data lists, until a preset iterative constraint is met, including: Using the list of sources of the associated matching data as an index, determine the corresponding K associated inner context rule modules; The first associated matching data list is split and input into the K associated inner context rule modules to obtain K secondary associated matching data lists, and then merged and output as the second associated matching data list; The second associated matching data list is split and input into the inner context rule module of K associations to obtain K third-level associated matching data lists, and then merged and output as a third associated matching data list; The input is split iteratively until the preset iterative constraints are met, including: the number of iterations meets the preset number of extraction levels.

7. The intelligent extraction method for law enforcement data based on a logic rule engine as described in claim 1, characterized in that, Parsing the law enforcement data extraction instruction to determine the data extraction origin also includes: If there are multiple data extraction origins, then multiple isolated data extraction groups are constructed by taking each of the multiple data extraction origins as the analysis target and combining them with the parameterized data list; Multiple isolated extracted data groups are input into the logical rule engine for parallel matching to obtain multiple isolated matching data lists; The intersection of multiple isolated matching data lists is calculated and defined as the preferred data list; The difference between the union of multiple isolated matching data lists and the priority data list is calculated and defined as the supplementary data list; Using the priority data list as the initial extraction target and the supplementary data list as the subsequent extraction target, the original data of the target electronic device is accessed for sequential batch data extraction, and the extraction batch is marked accordingly to obtain the law enforcement data extraction results.

Images