Railway criminal case clue mining method and system based on knowledge graph retrieval

Abstract

The invention discloses a railway criminal case clue mining method based on knowledge graph retrieval, and belongs to the technical field of railway criminal cases, and the method comprises the following steps: data fusion and preprocessing: obtaining and fusing data sources through a data access layer, the data sources at least comprising police service data, railway operation data and spatio-temporal data, the data processing and constructing layer is used for cleaning and standardizing the data source; knowledge graph construction: defining a domain ontology including an entity type and a relationship type; extracting a triple from the data source by using the data processing and constructing layer, and storing the triple into a graph database of a graph storage layer to form a railway criminal case knowledge graph; and clue mining and retrieval: executing graph query and a graph analysis algorithm on the knowledge graph through an analysis and mining engine. The invention provides an intelligent clue mining method capable of effectively fusing railway multi-source heterogeneous data and deeply mining time-space association and hidden relation.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of railway criminal cases, and in particular to a railway criminal case clue mining method and system based on knowledge graph retrieval. BACKGROUND

[0002] In the railway operation environment, the criminal case investigation work faces high complexity, which is mainly due to the following characteristics of the railway system: (1) large spatial span, with lines extending longitudinally and transversely, involving multiple administrative regions; (2) strong time-space mobility, with passenger and cargo flow showing high speed, high frequency and large scale characteristics; (3) multiple data sources, complex business systems and low degree of mutual correlation.

[0003] Currently, in the process of railway criminal case investigation, investigators usually need to deal with information island data sources, such as police information systems, railway operation systems, and time-space data, which are independent of each other, lacking effective data integration and linkage mechanism.

[0004] Under the existing technical conditions, clue mining mainly relies on the experience of investigators, through manual investigation, information comparison, or simple conditional queries in scattered and independent databases, such as querying ticketing systems and case databases based on the same ID number.

[0005] However, this traditional method has significant limitations, including the following points: (1) investigators need to frequently switch between multiple systems, making it difficult to achieve unified correlation analysis of multi-dimensional information such as people, cases, objects, time and location; (2) in the face of massive data, the manual investigation process is time-consuming and labor-intensive, and it is easy to miss critical information, and only relying on simple database query tools can only find known direct associations, and is powerless against hidden and indirect complex relationships; (3) railway cases contain key spatiotemporal dynamic characteristics, and traditional techniques are difficult to effectively model and analyze spatiotemporal data, for example, for criminal gangs with similar methods and close spatiotemporal trajectories in different cases, it is difficult to achieve rapid identification through manual means; (4) lack of intelligent analysis tools to automatically identify abnormal patterns, predict potential risks, and automatically string and parallel cases to improve investigation efficiency. SUMMARY

[0006] The purpose of the present application is to provide an intelligent clue mining method and system that can effectively integrate railway multi-source heterogeneous data and deeply mine spatiotemporal correlations and hidden relationships.

[0007] In order to achieve the above purpose, the present application adopts the following technical solution: a railway criminal case clue mining method based on knowledge graph retrieval, comprising the following steps: a. Data fusion and preprocessing: Data sources are acquired and fused through the data access layer. The data sources include at least police data, railway operation data, and spatiotemporal data. The data processing and construction layer then cleans and standardizes the data sources. b. Knowledge Graph Construction: Define a domain ontology including entity types and relation types; use the data processing and construction layer to extract triples from the data source and store them in the graph database of the graph storage layer to form a railway criminal case knowledge graph. c. Clue mining and retrieval: Through the analysis and mining engine, graph query and graph analysis algorithms are performed on the knowledge graph to realize the discovery of related paths, spatiotemporal collision analysis and graph pattern matching; d. Clue generation and visualization: The results of the clue mining and retrieval in c are used to generate high-value clues, and the association network is presented graphically through the display and interaction layer.

[0008] As a further description of the above technical solution: the police data includes case registration forms, police call records, a database of individuals with prior convictions, and information on items involved in the case; The railway operation data includes train timetables, passenger ticketing data, and freight transport documents; The spatiotemporal data includes metadata of station and carriage surveillance videos, base station positioning data, and GIS geographic information.

[0009] As a further description of the above technical solution: the entity types include people, cases, items, locations, vehicles, organizations, and virtual identities; The relationship types include suspected, traveling together, riding, occurring at, carrying, theft, and injury.

[0010] As a further description of the above technical solution: the clue mining and retrieval step c includes using the spatiotemporal data and the railway operation data to query entities that appear simultaneously in a specific location or on a specific means of transportation within a specific time period, thereby realizing spatiotemporal companion analysis; In addition, the historical trajectory data of multiple individuals were analyzed to find points of intersection in time and space in order to uncover clues about the gang; It also defines the feature map pattern of cases and retrieves other cases with similar patterns to achieve case merging.

[0011] A railway criminal case clue mining system based on knowledge graph retrieval includes a data access layer for connecting and extracting data sources; The data processing and construction layer, connected to the data access layer, is used to preprocess the data source, define entity types and relationship types, and perform knowledge extraction to construct a knowledge graph. The knowledge graph storage layer, connected to the data processing and construction layer, is used to store the knowledge graph. An analysis and mining engine, connected to the graph storage layer, is used to execute graph query and graph analysis algorithms for clue mining; The application service layer connects to the analysis and mining engine and provides API interfaces for data and analysis. The display and interaction layer, connected to the application service layer, provides a graphical user interface to display mining results and receive user interactions.

[0012] As a further description of the above technical solution: the data processing and construction layer includes a named entity recognition module for identifying the entity type from unstructured text of the data source; A relationship extraction module for identifying the relationship types between the entity types; And a knowledge fusion module for disambiguating and fusing the extracted entities and relations.

[0013] As a further description of the above technical solution: the analysis and mining engine 43 has a built-in graph query language interpreter for performing associated path discovery; The spatiotemporal analysis algorithm module is used to perform spatiotemporal collision and trajectory intersection analysis; The graph algorithm module includes a community discovery algorithm for mining the organization 26 or closely related groups of the individuals 21.

[0014] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are: 1. By constructing a knowledge graph in the field of railway criminal cases, data that was originally scattered across policing, railway operations, and spatiotemporal monitoring are modeled in a unified manner. This not only integrates the data but also establishes semantic connections between the data, transforming the data from relational to associative, thus solving the problem of data fusion difficulties in existing technologies.

[0015] 2. By utilizing graph databases and graph analysis algorithms, it is possible to uncover hidden paths at any depth between entities. This association analysis capability greatly expands the depth of clue discovery and can uncover complex relationship networks that are easily overlooked by manual investigation.

[0016] 3. Modeling spatiotemporal data for the railway environment enables efficient execution of complex queries such as spatiotemporal collision, accompaniment analysis, and trajectory intersection. This is crucial for solving cases such as railway theft and mobile crimes, effectively addressing the pain point of existing technologies being unable to handle dynamic spatiotemporal correlations.

[0017] 4. Through pattern matching and anomaly detection, high-value clues and crime patterns can be automatically discovered, freeing investigators from tedious manual investigations. At the same time, the visual interactive interface intuitively displays complex correlation networks, helping investigators to quickly locate targets, significantly shortening the investigation cycle and improving work efficiency. Attached Figure Description

[0018] Figure 1 A flowchart of the railway criminal case clue mining method of the present invention is shown; Figure 2 A schematic diagram of the data source of this invention is shown; Figure 3 A schematic diagram of the entity type of the present invention is shown; Figure 4 A schematic diagram of the relationship types of the present invention is shown; Figure 5 A schematic diagram of the system of the present invention is shown.

[0019] Legend: 10. Data Sources; 11. Police Data; 111. Case Registration Forms; 112. Police Response Records; 113. Criminal Record Database; 114. Information on Seized Items; 12. Railway Operation Data; 121. Train Timetables; 122. Passenger Ticketing Data; 123. Freight Transport Documents; 13. Spatiotemporal Data; 131. Station and Carriage Surveillance Videos; 132. Base Station Positioning Data; 133. GIS Geographic Information; 20. Entity type; 21. Person; 22. Case; 23. Item; 24. Location; 25. Vehicle; 26. Organization; 27. Virtual identity; 30. Relationship type; 31. Suspected; 32. Accompanying; 33. Riding; 34. Occurred in; 35. Carrying; 36. Theft; 37. Injury; 40. Data Access Layer; 41. Data Processing and Construction Layer; 42. Graph Storage Layer; 43. Analysis and Mining Engine; 44. Application Service Layer; 45. Display and Interaction Layer. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Please see Figures 1-5 This invention provides a technical solution: a method and system for mining clues in railway criminal cases based on knowledge graph retrieval, the workflow of which includes the following steps: S1: Data Source Integration and Preprocessing for Railway Criminal Cases The first step of this invention is to perform data fusion and preprocessing on the data source 10 of railway criminal cases. In a specific embodiment, the contents of the data source 10 include the following aspects: police data 11, railway operation data 12 and spatiotemporal data 13.

[0022] Police data 11 comes from data in the internal business system of the railway public security bureau and is used to support case investigation and analysis. Specifically, it includes case registration form 111, police call record 112, suspect and criminal record database 113, and information on items involved in the case 114.

[0023] Specifically, the case registration form 111 includes structured information such as case number, time of incident, location of incident, case summary, and the unit that filed the case; the police dispatch record 112 is an unstructured text that describes the details of the report and the initial handling situation; the suspect and prior criminal record database 113 includes the basic identity information, physical characteristics, criminal records, and relationship networks of suspects and related personnel; and the case item information 114 describes the characteristics of the case items, such as the specific information of the stolen items and the tools used in the crime.

[0024] The railway operation data 12 comes from the railway operation department and specifically includes train timetables 121, passenger ticketing data 122, and freight transport documents 123.

[0025] Specifically, the train timetable 121 defines the train's route, stops, and arrival and departure times; passenger ticketing data 122 includes the passenger's real name information, train number, travel date and time, and seat or berth number; and freight transport documents 123 include the shipper, consignee, handler, type of goods, quantity, value, and transport route.

[0026] Spatiotemporal data 13 is key data used to construct geographic and temporal dimensions, specifically including metadata of station and carriage surveillance videos 131, base station positioning data 132, and GIS geographic information 133.

[0027] Specifically, the metadata of the station and carriage surveillance video 131 consists of structured tags for the video content, such as specific times and locations, like the connection between platform 3 and carriage 5, as well as feature tags for people, vehicles, and objects identified by an artificial intelligence visual analysis system; base station positioning data 132 is used to track the approximate activity trajectory of suspects or victims; GIS geographic information 133 includes the spatial coordinates of the railway line, the precise geographical location of the station, and the kilometer markers of the railway line.

[0028] After collecting data source 10, this step also includes preprocessing data source 10. Preprocessing includes, but is not limited to: performing data cleaning operations, such as removing duplicate records and correcting obviously erroneous data, such as incorrect ID number formats; and standardizing the data, especially uniformly formatting key information such as addresses, names, and ID numbers, so as to facilitate subsequent entity alignment and knowledge fusion.

[0029] S2: Construction of a knowledge graph for railway criminal cases. Based on data preprocessing, a knowledge graph for railway criminal cases is constructed. This step includes the following sub-steps.

[0030] S2.1: Define the core entity type 20 and relation type 30 in the field of railway criminal investigation.

[0031] Specifically, entity type 20 includes: Character 21: For example, suspects, victims, complainants, passengers, train attendants, etc.; Case 22: For example, theft, robbery, and damage to railway facilities; Item 23: For example, stolen goods, tools used in the crime, and left-behind evidence; Location 24: For example, xx station, xx platform, xx carriage, xx kilometer marker, xx meters along the line, etc.; Transportation vehicle 25: such as G123 train, DF4 locomotive, specific train sets, etc.; Organization 26: For example, known criminal gangs, railway internal units, security companies, etc.; Virtual identities 27: such as phone numbers, social media accounts, online IDs, etc.

[0032] Relationship type 30 defines the relationships between entities. Relationship type 30 includes: Suspected of 31, for example: Person 21 - Suspected of 31 -> Case 22; For example, Person 21 - Person 32 -> Person 21, determined by the same order or adjacent seats; Take 33, for example: Person 21 - Take 33 -> Vehicle 25; Occurred at 34, for example: Case 22 - Occurred at 34 -> Location 24; Carrying 35, for example: Character 21 - Carrying 35 -> Item 23; Theft 36, for example: Person 21 - Theft 36 -> Item 23; Damage 37, for example: Character 21 - Damage 37 -> Character 21.

[0033] S2.2: During operation, the system uses Natural Language Processing (NLP) technology to automatically identify entity type 20 and relation type 30 from unstructured text.

[0034] For example, given the text "Suspect Zhang San stole Li Si's computer on train G123," the system should be able to extract: Entity: Zhang San, Person 21; Entity: G123 Train, Transportation 25; Entity: Li Si, Person 21; Entity: Computer, Item 23.

[0035] Relationship: Zhang San - takes train 33->G123; Zhang San - steals computer 36; computer - originally belongs to Li Si; Li Si - takes train 33->G123.

[0036] At the same time, the system will merge triples (e.g., Li Si, taking train 33, G123) from structured data (such as passenger ticket data 122).

[0037] S2.3: Store all extracted and merged triples (entity-relationship-entity) and entity attributes into a graph database. In this embodiment, high-performance graph databases such as Neo4j, JanusGraph, or HugeGraph are selected to form a unified knowledge graph of railway criminal cases.

[0038] S3: After the knowledge graph is constructed, clue mining is achieved through deep querying and analysis of the graph, including but not limited to the following mining methods: 1. Retrieve all potential connection paths between any two or more entity types 20. For example, if the investigator inputs suspect A and case B, the system will find that suspect A and victim C of case B were traveling together on train G567 32 3 days before the incident and were in the same compartment. However, there is no direct record of suspect A and case B. This hidden path is a high-value clue.

[0039] 2. Spatiotemporal collision analysis is key to solving railway cases. For example, query the time period of the incident in case 22, such as 14:00-16:00 on October 1st, and find all the individuals 21 who appeared at the crime scene 24, such as carriage 8 of train G123, and filter out the members 113 from the database of people with prior criminal records.

[0040] 3. Analyze the historical trajectories of multiple suspects based on passenger ticketing data 122 and base station positioning data 132; for example, using community detection algorithms, such as the Louvain algorithm, identify closely related groups of people. The system finds a group of people 21 who, although they do not have direct travel records 32, frequently appear in similar time periods and on similar routes, such as different trains traveling between station A and station B, and have a high degree of overlap in the map, which may indicate an organization 26.

[0041] 4. Define the characteristic graph pattern of the case, such as the modus operandi, tools used in the crime, and the type of target goods. The system searches the graph database for cases with similar graph neighborhood structures, realizes automatic case merging, and helps investigators to investigate cases together.

[0042] S4: Transform the findings into clues that can be used for decision-making.

[0043] The system automatically identifies strongly correlated paths or abnormal patterns as high-risk clues and proactively pushes them to investigators. The complex network of relationships is displayed graphically on the display and interaction layer 45, allowing investigators to intuitively see the complex relationships between people, cases, objects, time, and place. Interactive exploration is also supported; for example, clicking on a "Person 21" node will expand all of its information.

[0044] To implement the above method, a railway criminal case clue mining system based on knowledge graph retrieval is also provided. The system includes the following modules: Data access layer 40: As the input interface of the system, it is responsible for connecting and periodically or in real time extracting data from multiple heterogeneous data sources 10, including police data 11, railway operation data 12 and spatiotemporal data 13.

[0045] Data Processing and Construction Layer 41: Responsible for performing preprocessing in S1 and knowledge graph construction in S2. This layer embeds data cleaning scripts, natural language processing (NLP) tools such as NER, RE models and knowledge fusion algorithms.

[0046] Specifically, the data processing and construction layer 41 includes a named entity recognition module for identifying entity types 20 from unstructured text of the data source 10; a relation extraction module for identifying relation types 30 between entity types 20; and a knowledge fusion module for disambiguating and fusing the extracted entities and relations.

[0047] Graph storage layer 42: Employs one or more graph database instances, such as a Neo4j cluster, to persistently store the knowledge graph built in S2, including all entity types 20, relation types 30, and their attributes.

[0048] Analysis and Mining Engine 43: This is the core computing module of the system, responsible for executing S3. This engine has a built-in graph query language interpreter, such as Cypher or Gremlin.

[0049] Specifically, the graph query language interpreter is used to perform associated path discovery; the spatiotemporal analysis algorithm module is used to perform spatiotemporal collision and trajectory intersection analysis; and the graph algorithm module includes a community discovery algorithm for discovering organizations or closely related groups of people.

[0050] Application Service Layer 44: This layer encapsulates the functions of the analysis and mining engine 43 (such as path query and spatiotemporal collision) into standard services through APIs (such as RESTful APIs) for upper-layer applications to call.

[0051] Display and Interaction Layer 45: As the user interface of the system, it is aimed at the end case handlers. Display and Interaction Layer 45 calls the interface of Application Service Layer 44 to provide convenient search input boxes, visualization canvas of relationship graphs, GIS map display of spatiotemporal trajectories and other functions, and receives user interaction operations, such as drag and drop, zoom.

[0052] The modules in the system can be implemented through software, hardware, or a combination of both. For example, the analysis and mining engine 43 can be deployed on a dedicated high-performance computing server, while the presentation and interaction layer 45 can be a web application running in the browser of the investigator's computer.

[0053] This invention constructs a knowledge graph in the field of railway criminal cases, unifying the modeling of structured and unstructured data that were originally scattered in multiple data silos such as police affairs, railway operations, and spatiotemporal monitoring. This not only integrates the data but also establishes semantic relationships between the data, such as "riding 33", "traveling with 32", and "occurring in 34", transforming the data from relational to associative and solving the problem of data fusion difficulties in existing technologies.

[0054] At the same time, by utilizing graph databases and graph analysis algorithms, it is possible to uncover hidden paths at any depth between entity types 20. For example, through "Suspect A - ride - G123 - Victim B" or "Suspect A - companion - middleman C - suspect D", this association analysis capability greatly expands the depth of clue mining and can discover complex relationship networks that are easily overlooked by manual investigation.

[0055] Furthermore, by modeling spatiotemporal data (such as ticketing, trajectory, and monitoring) for the railway environment, it can efficiently perform complex queries such as spatiotemporal collision, accompanying analysis, and trajectory intersection. This is crucial for solving cases such as railway theft and mobile crimes, and effectively solves the pain point of existing technologies being unable to handle dynamic spatiotemporal correlations.

[0056] Furthermore, through pattern matching (such as gang detection and case linkage) and anomaly detection (such as short-distance high-frequency travel), it can automatically discover high-value clues and crime patterns, freeing investigators from tedious manual investigations. The visual interactive interface intuitively displays complex correlation networks, assisting investigators in quickly analyzing and locking onto targets, significantly shortening the investigation cycle and improving work efficiency.

[0057] Usage process: refer to Figure 1 When using it, input police data 11, railway operation data 12, and spatiotemporal data 13, and then output the original data source 10. Perform data preprocessing on the original data source 10, including cleaning, deduplication, format unification, and standardization, and then output the standardized data. Next, perform ontology design, define entity type 20 and relation type 30, and output the domain ontology.

[0058] Knowledge extraction is performed on standardized data and domain ontology, including NER (Named Entity Recognition) and RE (Relation Extraction). (Entity-Relation-Entity) triples are extracted, and the original triples and entity attributes are fused and stored. Specific steps include entity disambiguation and knowledge fusion. The data is then stored in a graph database. Finally, a railway criminal case knowledge graph is output and stored in the graph storage layer 42.

[0059] Then, the system inputs the railway criminal case knowledge graph, user queries, and preset rules to perform clue mining and retrieval. The mining and retrieval methods include correlation path discovery, spatiotemporal collision analysis (spatiotemporal accompaniment, trajectory intersection), and graph pattern matching (gang mining, case consolidation analysis). The system outputs raw mining results (correlation paths, abnormal patterns). The raw mining results are then used for clue evaluation and screening. The methods include prioritizing and filtering the results according to preset rules or machine learning models, identifying high-value clues, and then outputting high-value clues. These high-value clues are then input into the clue visualization and push system, which graphically displays the complex correlation network and pushes it to the case handlers through the display and interaction layer 45. The system also outputs visualized clues and early warning information.

[0060] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for mining clues in railway criminal cases based on knowledge graph retrieval, characterized in that, Includes the following steps: (a) Data fusion and preprocessing: Data sources (10) are acquired and fused through the data access layer (40). The data sources (10) include at least police data (11), railway operation data (12) and spatiotemporal data (13). The data sources (10) are then cleaned and standardized by the data processing and construction layer (41). (b) Knowledge graph construction: Define a domain ontology including entity type (20) and relation type (30); use the data processing and construction layer (41) to extract triples from the data source (10) and store them in the graph database of the graph storage layer (42) to form a railway criminal case knowledge graph; (c) Clue mining and retrieval: Through the analysis and mining engine (43), graph query and graph analysis algorithms are performed on the knowledge graph to realize the discovery of associated paths, spatiotemporal collision analysis and graph pattern matching; (d) Clue generation and visualization: The results of the clue mining and retrieval (c) are generated into high-value clues and the association network is presented graphically through the display and interaction layer (45).

2. The method for mining clues in railway criminal cases based on knowledge graph retrieval according to claim 1, characterized in that, The police data (11) includes case registration forms (111), police call records (112), a database of criminals (113), and information on items involved in the case (114). The railway operation data (12) includes train timetables (121), passenger ticketing data (122), and freight transport documents (123). The spatiotemporal data (13) includes metadata of station and carriage monitoring videos (131), base station positioning data (132), and GIS geographic information (133).

3. The method for mining clues in railway criminal cases based on knowledge graph retrieval according to claim 1, characterized in that, The entity types (20) include people (21), cases (22), items (23), locations (24), vehicles (25), organizations (26) and virtual identities (27); The relationship types (30) include suspected (31), traveling together (32), riding (33), occurring at (34), carrying (35), theft (36), and injury (37).

4. The method for mining clues in railway criminal cases based on knowledge graph retrieval according to claim 1, characterized in that, The clue mining and retrieval step (c) includes using the spatiotemporal data (13) and the railway operation data (12) to query entities that appear simultaneously in a specific location (24) or on a means of transportation (25) within a specific time period, thereby realizing spatiotemporal companion analysis; And analyze the historical trajectory data of multiple individuals (21) to find the intersection of time and space in order to uncover clues about the gang; And define the feature map pattern of case (22) and retrieve other cases (22) with similar patterns to achieve case merging.

5. A railway criminal case clue mining system based on knowledge graph retrieval, characterized in that, Includes a data access layer (40) for connecting to and extracting data sources (10); The data processing and construction layer (41), connected to the data access layer (40), is used to preprocess the data source (10), define entity types (20) and relation types (30), and perform knowledge extraction to construct a knowledge graph; The knowledge graph storage layer (42) is connected to the data processing and construction layer (41) and is used to store the knowledge graph; The analysis and mining engine (43), connected to the graph storage layer (42), is used to perform graph query and graph analysis algorithms for clue mining; The application service layer (44) is connected to the analysis and mining engine (43) and provides an API interface for data and analysis. The display and interaction layer (45), connected to the application service layer (44), is used to provide a graphical user interface to display mining results and receive user interactions.

6. The railway criminal case clue mining system based on knowledge graph retrieval according to claim 5, characterized in that, The data processing and construction layer (41) includes a named entity recognition module for identifying the entity type (20) from unstructured text of the data source (10); A relationship extraction module for identifying relationship types (30) between the entity types (20); And a knowledge fusion module for disambiguating and fusing the extracted entities and relations.

7. The railway criminal case clue mining system based on knowledge graph retrieval according to claim 5, characterized in that, The analysis and mining engine (43) has a built-in graph query language interpreter for performing associated path discovery; The spatiotemporal analysis algorithm module is used to perform spatiotemporal collision and trajectory intersection analysis; The graph algorithm module includes a community discovery algorithm for mining the organization (26) or closely related groups of people (21).

Images