Electronic data evidence obtaining system and method based on big data analysis

Abstract

The invention discloses an electronic data forensics system and method based on big data analysis, and relates to the technical field of electronic data forensics, and the method comprises the following steps: collecting current case information and dividing case types, carrying out the statistics of forensics keywords of different types of historical cases to construct a historical lexicon, obtaining basic keywords based on the current case type, and storing the basic keywords in a database; reading the electronic data of the current user equipment, and carrying out evidence collection on the related electronic data under the basic keyword; based on user operation behaviors, case time laws and case similarity of a current case and a historical case, historical similar cases are screened, keywords are obtained by combining recent case evidence, candidate words are obtained through association rules and vector reasoning, and an innovative keyword set is obtained. According to the method, on the basis of big data analysis, expansion secondary evidence obtaining is carried out on the dynamic keywords, and key evidence is marked, so that the practicability and functionality of electronic data evidence obtaining are enhanced.

Description

Technical Field

[0001] This invention relates to the field of electronic data forensics, and more specifically, to an electronic data forensics system and method based on big data analysis. Background Technology

[0002] In the digital age, electronic data has become core evidence in case investigation and judicial trials. The comprehensiveness, accuracy and timeliness of electronic data evidence collection directly affect the quality of case handling. With the rapid development of network technology, case types are becoming increasingly complex and diverse, and new types of cybercrime and cross-platform crimes are emerging one after another. Current electronic data forensics largely rely on fixed keyword libraries and single forensic processes, lacking in-depth mining and dynamic reuse of historical case data. Investigators often set forensic keywords based on experience, resulting in inconsistent forensic standards for different types of cases. This leads to insufficient standardization and low efficiency in the forensic process. At the same time, traditional forensic keyword libraries are outdated and limited to fixed terms accumulated from historical cases, failing to adapt to the hidden and evolving keywords emerging in new cases. This can easily lead to the omission of key electronic data, limiting the scope of forensic evidence collection. Furthermore, they cannot provide a variety of different forensic approaches to inspire users' investigative thinking, resulting in low practicality and functionality. Summary of the Invention

[0003] In response to the problems in related technologies, this invention proposes an electronic data forensics system and method based on big data analysis to overcome the aforementioned technical problems existing in the existing related technologies.

[0004] Therefore, the specific technical solution adopted by the present invention is as follows: A method for electronic data forensics based on big data analysis, comprising the following steps: S1. Collect current case information and classify case types, collect evidence keywords from different types of historical cases to build a historical thesaurus, obtain basic keywords based on the current case type, read the electronic data of the current user device, and collect evidence from the relevant electronic data under the basic keywords. S2. Based on user operation behavior, case time patterns, and case similarity of current and historical cases, filter similar historical cases and combine them with recent case evidence keywords. Obtain candidate words through association rules and vector reasoning, and obtain a set of innovative keywords. S3. Based on the obtained innovative keywords, combine them with the electronic data content of the user equipment to conduct secondary evidence collection, integrate the electronic data evidence under the basic keywords and the electronic data evidence under the innovative keywords, identify the suspicious time periods and suspicious evidence in the current user evidence, and mark the suspicious time periods and suspicious evidence.

[0005] In a preferred embodiment, S1 includes the following steps: S11. Collect basic information about the current case, including the case name, involved persons, and case description. Use a text classification model to categorize the case into a predefined type and output the case type label. This includes the following steps: Preprocessing is performed on the basic information of the current case, including segmenting the case description in the basic information of the current case using jieba word segmentation, filtering meaningless words based on the stop word list, normalizing word form using the domain dictionary, and inputting the preprocessed text into the BERT model using a BERT model pre-trained on a large-scale general corpus and legal corpus to obtain context-related vectors. Collect labeled historical case data to train a neural network classifier to obtain a classification model. The historical case data includes historical case text, type labels, and feature vectors. Input the feature vector of the current case into the classification model to obtain the current case type label. S12, Collect different types of historical cases List of keywords for evidence collection Calculate each word For specific case types of : ; in, The frequency of the keyword 'w' in all case keywords of type C is represented by N, where N is the total number of case types, and CF(w) is the number of case types containing the keyword 'w'. A keyword list is constructed for each case type, sorted in descending order of importance score, to obtain a historical thesaurus. The top-n words are extracted from the historical thesaurus based on the current case type label to form the basic keyword set. ; S13. Based on the basic keyword set Read the current user equipment electronic data and extract all data containing [the relevant information] from the current user equipment electronic data. Data fragments, files, or records containing any of the keywords in the text.

[0006] In a preferred embodiment, S2 includes the following steps: S21. Based on the user operation behavior, case time pattern and case similarity extracted from the current case device, the historical cases are filtered to obtain a set of similar historical cases; S22. Extract all valid evidence keywords from the set of similar historical cases and keywords from recent cases, obtain candidate words through association rules and vector reasoning, and obtain innovative keywords.

[0007] In a preferred embodiment, S21 includes the following steps: S211. Collect background data from the user's device in the current case and extract feature vectors, including behavioral pattern feature vectors, time pattern feature vectors, and case content feature vectors. Specifically, this includes the following steps: The user operation logs in the user device are categorized, and the user's behavioral state is defined to determine the set of all unique operation types. Where m is the number of operation types, for consecutive operation pairs in the sequence Statistical operations Transferred to The number of iterations is used to calculate the transition probability and obtain the Markov transition probability matrix. Simultaneously, the time interval is divided into 24-hour periods, and the timestamps of all operations are mapped to the corresponding hour segments. The number of operations in each hour is counted to calculate the current user activity distribution, that is, the proportion of operation events in different hours to the total number of operation events, resulting in an activity distribution vector A. The distribution vector A represents the proportion of various types of operations, resulting in an operation type distribution vector. Concatenate to obtain the pattern feature vector ; For electronic data extracted from user equipment, the timestamp sequence of all behaviors is statistically analyzed, and the Fourier transform of the time density function of the behaviors is performed to obtain the spectral coefficients. Simultaneously, the mean, standard deviation, skewness, and kurtosis of the time intervals between consecutive behaviors are calculated, and these are concatenated to form a temporal regularity feature vector. ; For the current user's case description text, the output vector at the [CLS] position is obtained through the BERT model and used as the semantic representation vector of the entire case text. Simultaneously, record the keyword set; S212. Calculate the overall similarity between the current case and historical cases, including behavioral pattern similarity. for: ; in , representing the similarity of the activity distribution between the current case and the i-th historical case, the negative exponent of the KL divergence of the operation type distribution, and the matrix similarity, respectively. Let C represent the i-th historical case, and C represent the current case. These are the weighting coefficients, and The sum is 1; Among them, time correlation , These represent the Fourier coefficient cosine similarity and statistical feature similarity between the current case and the i-th historical case, respectively. Content relevance ,in The semantic representation vector representing the case text of the current case. The semantic representation vector representing the case text of the i-th historical case. The set of keywords representing the current case and the set of keywords representing the i-th historical case; S213. Calculate the comprehensive similarity score by combining content relevance, behavioral pattern similarity, and temporal relevance. ,in These represent the weights for behavioral pattern similarity, temporal relevance, and content relevance, respectively. Similar cases are filtered based on a weighted overall similarity score. Cases with a weighted overall similarity score greater than a similarity threshold are sorted in descending order, and the top-n cases are retained as a set of similar historical cases. .

[0008] In a preferred embodiment, S22 includes the following steps: S221. Extract keywords for similar cases from historical cases in the set of similar historical cases. ,in For historical cases A set of effective evidence-gathering keywords, and also extracting keywords from recent cases. ,in Representing the current time and historical cases respectively. The time of occurrence, Construct a comprehensive seed set for recent cases within a timeframe. ,in A set of basic keywords; S222. Construct a transaction database from the keywords in the comprehensive seed set. ,in Support was calculated using the Apriori algorithm. Confidence level and improvement Filter rules that meet the minimum threshold condition: ; in, These represent the minimum support threshold, minimum confidence threshold, and minimum lift threshold, respectively, for further extraction of candidate words. ; S223. Output the corresponding vector for each keyword k using a pre-trained word vector model. To perform semantic reasoning, where the query vector ,in These represent the target semantic direction vector and the semantic direction vector to be avoided, respectively. The direction adjustment coefficient is calculated in the word vector space, identifying the top K words in the vocabulary that are most similar to the query vector, and then compared with... The union of the two sets yields the set of innovative keywords.

[0009] In a preferred embodiment, step S3 includes the following steps: S31. Extract relevant evidence from the electronic data content of the current user equipment using keywords in the innovative keyword set, and combine the electronic data evidence under the basic keywords to obtain the current equipment evidence dataset; S32. Combining basic keyword electronic data evidence with innovative keyword electronic data evidence, summarize the data patterns and mark suspicious time periods and suspicious evidence.

[0010] In a preferred embodiment, S31 includes the following steps: S311. For the set of innovative keywords, read the current user equipment electronic data, and capture all data fragments, files or records containing any keyword in the set of innovative keywords from the current user equipment electronic data to obtain the set of innovative keyword evidence. S312. Merge the evidence set captured through basic keywords with the evidence set captured through innovative keywords to form a total evidence dataset.

[0011] In a preferred embodiment, S32 includes the following steps: S321. For the obtained total evidence dataset, extract the timestamp of each piece of evidence and count the average frequency of various behaviors in different time periods. Draw a 24-hour activity distribution map. Based on the 3sigma criterion, determine the typical active time period of the current user. Identify dense evidence occurring in inactive time periods as suspicious evidence and mark the time periods as suspicious time periods in red in the total evidence dataset.

[0012] The electronic data forensics system based on big data analytics includes a data acquisition module, a basic keyword matching module, an innovative keyword generation module, and a secondary forensics and suspicious data marking module. The data acquisition module and the basic keyword matching module collect current case information and classify case types, collect evidence-gathering keywords of different types of historical cases to build a historical thesaurus, obtain basic keywords based on the current case type, read the electronic data of the current user device, and collect evidence from the relevant electronic data under the basic keywords. The innovative keyword generation module filters historical cases based on the user operation behavior of the current case user, the case time pattern, and the case similarity to obtain a set of similar historical cases. It extracts all valid evidence-gathering keywords and recent case keywords from the set of similar historical cases, obtains candidate words through association rules and vector reasoning, and obtains a set of innovative keywords. The secondary evidence collection and suspicious marking module extracts relevant evidence from the electronic data content of the current user device using keywords in the innovative keyword set. It then combines the electronic data evidence under the basic keywords to obtain the current device evidence dataset. Finally, it summarizes the data patterns based on the electronic data evidence of the basic keywords and the electronic data evidence of the innovative keywords, and marks suspicious time periods and suspicious evidence.

[0013] The beneficial effects of this invention are as follows: This invention categorizes user cases by type and uses evidence-gathering keywords from historical cases of the same type to conduct a primary evidence gathering process for the current user case. Simultaneously, it combines the backend data of the user's device to extract user behavior, case time patterns, and case similarity, uncovering similar historical cases. Furthermore, it uses innovative keyword association reasoning by combining evidence-gathering keywords from historical cases with those from recent cases, thereby conducting a secondary evidence gathering process on the current user's electronic data. This expands the scope of evidence gathering, facilitates the discovery of useful evidence by users, standardizes the evidence gathering process, improves overall work efficiency and standardization, and enhances practicality. This invention enables the evidence keyword database to dynamically evolve by associating keywords from recent cases and constructing a semantic reasoning model. It can discover abnormal and patterned behavioral clues, and by performing correlation analysis between the keyword database of historical cases and the keywords of recent new cases, it can intelligently deduce new, evolving, or hidden evidence keywords, maintain the cutting edge of evidence collection strategies, inspire users' thinking, and enhance functionality. This invention analyzes the time patterns of the collected evidence to mark suspicious time periods and suspicious evidence in the current user equipment evidence data, thereby making it easier for users to focus on key evidence. Attached Figure Description

[0014] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0015] Figure 1 This is a flowchart of an electronic data forensics method based on big data analysis according to an embodiment of the present invention. Detailed Implementation

[0016] To further illustrate the various embodiments, the present invention provides accompanying drawings, which are part of the disclosure of the present invention. These drawings are mainly used to illustrate the embodiments and can be used in conjunction with the relevant descriptions in the specification to explain the operating principles of the embodiments. With reference to these drawings, those skilled in the art should be able to understand other possible implementation methods and the advantages of the present invention. The components in the drawings are not drawn to scale, and similar component symbols are generally used to represent similar components.

[0017] According to embodiments of the present invention, an electronic data forensics system and method based on big data analysis are provided.

[0018] The present invention will now be further described in conjunction with the accompanying drawings and specific embodiments:

[0019] Example 1: like Figure 1 As shown, according to an embodiment of the present invention, an electronic data forensics method based on big data analysis includes the following steps: S1. Collect current case information and classify case types, collect evidence keywords from different types of historical cases to build a historical thesaurus, obtain basic keywords based on the current case type, read the electronic data of the current user device, and collect evidence from the relevant electronic data under the basic keywords. S11. Collect basic information about the current case, including the case name, involved persons, and case description. Use a text classification model to categorize the case into a predefined type and output the case type label. This includes the following steps: Preprocessing is performed on the basic information of the current case, including segmenting the case description in the basic information of the current case using jieba word segmentation, filtering meaningless words based on the stop word list, normalizing word form using the domain dictionary, and inputting the preprocessed text into the BERT model using a BERT model pre-trained on a large-scale general corpus and legal corpus to obtain context-related vectors. It should be noted that the Chinese text sequence in the case description can be segmented into independent tokens through Jieba segmentation. By filtering meaningless words based on a stop word list, common but low-information-content words such as "de", "le", "zai", "he", etc. are removed. Specific words are standardized to standard expressions through a domain dictionary. For example, "WeChat", "Alipay", and "bank card" are unified as [payment tools]; "occupy for oneself" and "illegal possession" are unified as [illegal possession]. The domain dictionary can be pre-set based on the domain of different cases through an empirical method. Large-scale general language corpora and legal corpora can be obtained by consulting experts in relevant fields or through an empirical method. The pre-processed text is input into the BERT model, and BERT will generate a context-related vector for each word. For example, the vectors of "theft" in "theft of electricity" and "theft of trade secrets" are different. Usually, the output vector corresponding to the special token is taken as the comprehensive semantic representation of the entire case text.

[0020] Collect historical case data with labels for training a neural network classifier to obtain a classification model. The historical case data includes historical case texts, type labels, and feature vectors. The current case feature vector is input into the classification model to obtain the current case type label. It should be noted that the training data is a large number of historical case comprehensive texts and their feature vectors that have been labeled with type labels by relevant field experts. When using BERT as a feature extractor, end-to-end fine-tuning is required, that is, all parameters of BERT are slightly adjusted on the case classification data to make the output vector more suitable for the current task. In the classification model, for the input feature vector, the model outputs a probability distribution representing the probability of belonging to each predefined type. The final case type label is the type with the highest probability.

[0021] S12. Collect historical cases of different types forensics keyword list and calculate each word for a specific case type of : ; Among them, represents the frequency of the word w appearing in all case keywords of type C, N is the total number of case types, CF(w) is the number of case types containing the word w. The keyword list for each case type is constructed in descending order of importance scores to obtain a historical thesaurus. Based on the current case type label, the top-n words are extracted from the historical thesaurus as the basic keyword set ; It should be noted that n is the selection number, usually set to 3, and can also be adjusted according to actual needs.

[0022] S13. Based on the basic keyword set Read the current user equipment electronic data and extract all data containing [the relevant information] from the current user equipment electronic data. Data fragments, files, or records containing any of the keywords in the text.

[0023] It should be noted that during the electronic data scraping process, string matching algorithms such as the Boyer-Moore algorithm that supports fuzzy matching or regular expressions can be used to collect evidence of electronic data related to basic keywords. Semantic synonyms of keywords can be obtained through word vector calculation and data scraping can be performed at the same time.

[0024] Example 2: S2. Based on user operation behavior, case time patterns, and case similarity of current and historical cases, filter similar historical cases and combine them with recent case evidence keywords. Obtain candidate words through association rules and vector reasoning, and obtain a set of innovative keywords. S21. Based on the user operation behavior, case time pattern and case similarity extracted from the current case device, the historical cases are filtered to obtain a set of similar historical cases; S211. Collect background data from the user's device in the current case and extract feature vectors, including behavioral pattern feature vectors, time pattern feature vectors, and case content feature vectors. Specifically, this includes the following steps: The user operation logs in the user device are categorized, and the user's behavioral state is defined to determine the set of all unique operation types. Where m is the number of operation types, for consecutive operation pairs in the sequence Statistical operations Transferred to The number of iterations is used to calculate the transition probability and obtain the Markov transition probability matrix. Simultaneously, the time interval is divided into 24-hour periods, and the timestamps of all operations are mapped to the corresponding hour segments. The number of operations in each hour is counted to calculate the current user activity distribution, that is, the proportion of operation events in different hours to the total number of operation events, resulting in an activity distribution vector A. The distribution vector A represents the proportion of various types of operations, resulting in an operation type distribution vector. Concatenate to obtain the pattern feature vector ; It should be noted that the operation types include reading, writing, uploading, downloading, etc., and the user's operation log includes file, network, application usage records, etc. The specifics need to be determined based on the current user's device. The proportion distribution of each type of operation is the ratio of the total number of different types of operations to the total number of all operations. The transition probability matrix of Markov can be used to characterize the transition patterns between different operations.

[0025] For electronic data extracted from user equipment, the timestamp sequence of all behaviors is statistically analyzed, and the Fourier transform of the time density function of the behaviors is performed to obtain the spectral coefficients. Simultaneously, the mean, standard deviation, skewness, and kurtosis of the time intervals between consecutive behaviors are calculated, and these are concatenated to form a temporal regularity feature vector. ; It should be noted that in the process of constructing the time density function, the time axis is divided into equal intervals, and the number of events in each interval is counted to form a discrete sequence. The discrete sequence is then subjected to a fast Fourier transform to obtain a complex sequence. After discarding high-frequency noise, the first q core coefficients are taken, and the real part and imaginary part are separated. The real part and imaginary part need to be set empirically according to the actual situation. The real part, imaginary part, mean, standard deviation, skewness and kurtosis are concatenated to obtain the time regularity feature vector. For the current user's case description text, the output vector at the [CLS] position is obtained through the BERT model and used as the semantic representation vector of the entire case text. Simultaneously, record the keyword set; It should be noted that when the case description text is input into the BERT model, it can be converted into a token sequence that the model can process. [CLS] is the classification label, which is the global semantic aggregation position of the BERT model. The keywords of the case can be set manually or extracted based on TF-IDF.

[0026] S212. Calculate the overall similarity between the current case and historical cases, including behavioral pattern similarity. for: ; in , representing the similarity of the activity distribution between the current case and the i-th historical case, the negative exponent of the KL divergence of the operation type distribution, and the matrix similarity, respectively. Let C represent the i-th historical case, and C represent the current case. These are the weighting coefficients, and The sum is 1; It should be noted that, represents the similarity of the activity distribution between the current case and the i-th historical case, the negative exponent of the KL divergence of the operation type distribution, and the matrix similarity, respectively. , , , The value is usually set to 0.4, 0.3, or 0.3, but can be adjusted according to actual needs. By analyzing the similarity between user behavior and the behavior of different users in historical cases, commonalities between different cases can be discovered, which facilitates the subsequent acquisition of useful electronic data evidence.

[0027] Among them, time correlation , These represent the Fourier coefficient cosine similarity and statistical feature similarity between the current case and the i-th historical case, respectively. Content relevance ,in The semantic representation vector representing the case text of the current case. The semantic representation vector representing the case text of the i-th historical case. The set of keywords representing the current case and the set of keywords representing the i-th historical case; It should be noted that: ; represents the mean, standard deviation, skewness, and kurtosis of the time interval between consecutive actions in the current case and the i-th historical case, respectively. This represents the similarity decay parameter, which controls the rate at which similarity decreases as distance increases. It needs to be set based on empirical methods.

[0028] S213. Calculate the comprehensive similarity score by combining content relevance, behavioral pattern similarity, and temporal relevance. ,in These represent the weights for behavioral pattern similarity, temporal relevance, and content relevance, respectively. Similar cases are filtered based on a weighted overall similarity score. Cases with a weighted overall similarity score greater than a similarity threshold are sorted in descending order, and the top-n cases are retained as a set of similar historical cases. .

[0029] It should be noted that n is the number of choices, which is usually set to 3, but can be adjusted according to actual needs, keeping it consistent with n in S12. The values ​​need to be set based on the actual situation to assign relative importance to different dimensions of similarity. The similarity threshold needs to be set in consultation with experts in the relevant field, taking into account the actual similarity weight, time correlation weight, and content relevance weight.

[0030] S22. Extract all valid evidence keywords from the set of similar historical cases and keywords from recent cases, obtain candidate words through association rules and vector reasoning, and obtain innovative keywords; S221. Extract keywords for similar cases from historical cases in the set of similar historical cases. ,in For historical cases A set of effective evidence-gathering keywords, and also extracting keywords from recent cases. ,in Representing the current time and historical cases respectively. The time of occurrence, Construct a comprehensive seed set for recent cases within a timeframe. ,in A set of basic keywords; It should be noted that, The time window for recent cases is usually set to 30 days, but it can be adjusted according to the actual application environment. This makes it easier to find strongly related candidate words by mining the co-occurrence patterns of keywords in historical cases to supplement related words at the statistical level, thereby discovering hidden co-occurrence relationships.

[0031] S222. Construct a transaction database from the keywords in the comprehensive seed set. ,in Support was calculated using the Apriori algorithm. Confidence level and improvement Filter rules that meet the minimum threshold condition: ; in, These represent the minimum support threshold, minimum confidence threshold, and minimum lift threshold, respectively, for further extraction of candidate words. ; It should be noted that the support is calculated using the Apriori algorithm. Confidence level and improvement ,in , , X and Y represent keyword item sets. The minimum threshold needs to be set by consulting experts in the field and considering the actual application.

[0032] S223. Output the corresponding vector for each keyword k using a pre-trained word vector model. To perform semantic reasoning, where the query vector ,in These represent the target semantic direction vector and the semantic direction vector to be avoided, respectively. The direction adjustment coefficient is calculated in the word vector space, identifying the top K words in the vocabulary that are most similar to the query vector, and then compared with... The union of the two sets yields the set of innovative keywords.

[0033] It should be noted that the word vector model can be trained using historical case texts, technical documents, network data, and log data as training corpora, and the Word2Vec model is selected as the framework for training. When calculating the top K most similar words to the query vector in the vocabulary in the word vector space, similarity can be calculated using cosine similarity to select the top K most similar words. The target semantic direction vector represents the desired semantic direction of shift, and the semantic direction vector to be avoided represents the semantic direction to be avoided. These settings need to be flexibly adjusted according to the different types of cases.

[0034] S3. Based on the obtained innovative keywords, combine the electronic data content of the user equipment to conduct secondary evidence collection, integrate the electronic data evidence under the basic keywords and the electronic data evidence under the innovative keywords, identify the suspicious time periods and suspicious evidence in the current user evidence, and mark the suspicious time periods and suspicious evidence. S31. Extract relevant evidence from the electronic data content of the current user equipment using keywords in the innovative keyword set, and combine the electronic data evidence under the basic keywords to obtain the current equipment evidence dataset; S311. For the set of innovative keywords, read the current user equipment electronic data, and capture all data fragments, files or records containing any keyword in the set of innovative keywords from the current user equipment electronic data to obtain the set of innovative keyword evidence. S312. Merge the evidence set captured through basic keywords with the evidence set captured through innovative keywords to form a total evidence dataset.

[0035] It should be noted that when scraping innovative keyword data, string matching algorithms such as the Boyer-Moore algorithm that supports fuzzy matching or regular expressions are used to collect evidence of relevant electronic data under basic keywords.

[0036] S32. Combining basic keyword electronic data evidence with innovative keyword electronic data evidence, summarize the data patterns and mark suspicious time periods and suspicious evidence; S321. For the obtained total evidence dataset, extract the timestamp of each piece of evidence and count the average frequency of various behaviors in different time periods. Draw a 24-hour activity distribution map. Based on the 3sigma criterion, determine the typical active time period of the current user. Identify dense evidence occurring in inactive time periods as suspicious evidence and mark the time periods as suspicious time periods in red in the total evidence dataset.

[0037] It should be noted that by marking suspicious evidence and suspicious time periods in the total evidence set, users can focus on suspicious evidence to improve efficiency.

[0038] Example 3: The electronic data forensics system based on big data analytics includes a data acquisition module, a basic keyword matching module, an innovative keyword generation module, and a secondary forensics and suspicious data marking module. The data acquisition module and the basic keyword matching module collect current case information and classify case types, collect evidence-gathering keywords from different types of historical cases to build a historical thesaurus, obtain basic keywords based on the current case type, read the electronic data of the current user device, and collect evidence from the relevant electronic data under the basic keywords. The innovative keyword generation module filters historical cases based on user behavior, case time patterns, and case similarity to obtain a set of similar historical cases. It extracts all valid evidence-gathering keywords from the set of similar historical cases and keywords from recent cases, obtains candidate words through association rules and vector reasoning, and obtains an innovative keyword set. The secondary evidence collection and suspicious marking module extracts relevant evidence from the electronic data content of the current user device using keywords in the innovative keyword set. It combines the electronic data evidence under the basic keywords to obtain the current device evidence dataset. By combining the electronic data evidence under the basic keywords and the electronic data evidence under the innovative keywords, it summarizes the data patterns and marks suspicious time periods and suspicious evidence.

[0039] In summary, this invention categorizes user cases by type and uses evidence-gathering keywords from historical cases of the same type to conduct a primary evidence gathering process for current user cases. Simultaneously, it combines backend data from the user's device to extract user behavior, case time patterns, and case similarity, uncovering similar historical cases. Furthermore, it uses innovative keyword association reasoning by combining evidence-gathering keywords from historical cases with those from recent cases, thereby conducting a secondary evidence gathering process on the user's electronic data. This expands the scope of evidence gathering, facilitates the discovery of useful evidence, standardizes the evidence gathering process, and improves overall efficiency and standardization. By associating keywords from recent cases and constructing a semantic reasoning model, the evidence-gathering keyword database possesses dynamic evolution capabilities, enabling the discovery of abnormal and patterned behavioral clues. By analyzing the association between the keyword database of historical cases and keywords from recent new cases, it intelligently infers new, evolving, or hidden evidence-gathering keywords, maintaining the cutting edge of evidence gathering strategies and inspiring user thinking.

[0040] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for electronic data forensics based on big data analysis, characterized in that, The method includes the following steps: S1. Collect current case information and classify case types, collect evidence keywords from different types of historical cases to build a historical thesaurus, obtain basic keywords based on the current case type, read the electronic data of the current user device, and collect evidence from the relevant electronic data under the basic keywords. S2. Based on user operation behavior, case time patterns, and case similarity of current and historical cases, filter similar historical cases and combine them with recent case evidence keywords. Obtain candidate words through association rules and vector reasoning, and obtain a set of innovative keywords. S3. Based on the obtained innovative keywords, combine them with the electronic data content of the user equipment to conduct secondary evidence collection, integrate the electronic data evidence under the basic keywords and the electronic data evidence under the innovative keywords, identify the suspicious time periods and suspicious evidence in the current user evidence, and mark the suspicious time periods and suspicious evidence.

2. The electronic data forensics method based on big data analysis according to claim 1, characterized in that, S1 includes the following steps: S11. Collect basic information about the current case, including the case name, involved persons, and case description. Use a text classification model to categorize the case into a predefined type and output the case type label. This includes the following steps: Preprocessing is performed on the basic information of the current case, including segmenting the case description in the basic information of the current case using jieba word segmentation, filtering meaningless words based on the stop word list, normalizing word form using the domain dictionary, and inputting the preprocessed text into the BERT model using a BERT model pre-trained on a large-scale general corpus and legal corpus to obtain context-related vectors. Collect labeled historical case data to train a neural network classifier to obtain a classification model. The historical case data includes historical case text, type labels, and feature vectors. Input the feature vector of the current case into the classification model to obtain the current case type label. S12, Collect different types of historical cases List of keywords for evidence collection Calculate each word For specific case types of : ； in, The frequency of the keyword 'w' in all case keywords of type C is represented by N, where N is the total number of case types, and CF(w) is the number of case types containing the keyword 'w'. A keyword list is constructed for each case type, sorted in descending order of importance score, to obtain a historical thesaurus. The top-n words are extracted from the historical thesaurus based on the current case type label to form the basic keyword set. ; S13. Based on the basic keyword set Read the current user equipment electronic data and extract all data containing [the relevant information] from the current user equipment electronic data. Data fragments, files, or records containing any of the keywords in the text.

3. The electronic data forensics method based on big data analysis according to claim 2, characterized in that, S2 includes the following steps: S21. Based on the user operation behavior, case time pattern and case similarity extracted from the current case device, the historical cases are filtered to obtain a set of similar historical cases; S22. Extract all valid evidence keywords from the set of similar historical cases and keywords from recent cases, obtain candidate words through association rules and vector reasoning, and obtain innovative keywords.

4. The electronic data forensics method based on big data analysis according to claim 1, characterized in that, S21 includes the following steps: S211. Collect background data from the user's device in the current case and extract feature vectors, including behavioral pattern feature vectors, time pattern feature vectors, and case content feature vectors. Specifically, this includes the following steps: The user operation logs in the user device are categorized, and the user's behavioral state is defined to determine the set of all unique operation types. Where m is the number of operation types, for consecutive operation pairs in the sequence Statistical operations Transferred to The number of iterations is used to calculate the transition probability and obtain the Markov transition probability matrix. Simultaneously, the time interval is divided into 24-hour periods, and the timestamps of all operations are mapped to the corresponding hour segments. The number of operations in each hour is counted to calculate the current user activity distribution, that is, the proportion of operation events in different hours to the total number of operation events, resulting in an activity distribution vector A. The distribution vector A represents the proportion of various types of operations, resulting in an operation type distribution vector. Concatenate to obtain the pattern feature vector ; For electronic data extracted from user equipment, the timestamp sequence of all behaviors is statistically analyzed, and the Fourier transform of the time density function of the behaviors is performed to obtain the spectral coefficients. Simultaneously, the mean, standard deviation, skewness, and kurtosis of the time intervals between consecutive behaviors are calculated, and these are concatenated to form a temporal regularity feature vector. ; For the current user's case description text, the output vector at the [CLS] position is obtained through the BERT model and used as the semantic representation vector of the entire case text. Simultaneously, record the keyword set; S212. Calculate the overall similarity between the current case and historical cases, including behavioral pattern similarity. for: ； in , representing the similarity of the activity distribution between the current case and the i-th historical case, the negative exponent of the KL divergence of the operation type distribution, and the matrix similarity, respectively. Let C represent the i-th historical case and C represent the current case. These are the weighting coefficients, and The sum is 1; Among them, time correlation , These represent the Fourier coefficient cosine similarity and statistical feature similarity between the current case and the i-th historical case, respectively. Content relevance ,in The semantic representation vector representing the case text of the current case. The semantic representation vector representing the case text of the i-th historical case. The set of keywords representing the current case and the set of keywords representing the i-th historical case; S213. Calculate the comprehensive similarity score by combining content relevance, behavioral pattern similarity, and temporal relevance. ,in These represent the weights for behavioral pattern similarity, temporal relevance, and content relevance, respectively. Similar cases are filtered based on a weighted overall similarity score. Cases with a weighted overall similarity score greater than a similarity threshold are sorted in descending order, and the top-n cases are retained as a set of similar historical cases. .

5. The electronic data forensics method based on big data analysis according to claim 4, characterized in that, S22 includes the following steps: S221. Extract keywords for similar cases from historical cases in the set of similar historical cases. ,in For historical cases A set of effective evidence-gathering keywords, and also extracting keywords from recent cases. ,in Representing the current time and historical cases respectively. The time of occurrence, Construct a comprehensive seed set for recent cases within a timeframe. ,in A set of basic keywords; S222. Construct a transaction database from the keywords in the comprehensive seed set. ,in Support was calculated using the Apriori algorithm. Confidence level and improvement Filter rules that meet the minimum threshold condition: ； in, These represent the minimum support threshold, minimum confidence threshold, and minimum lift threshold, respectively, for further extraction of candidate words. ; S223. Output the corresponding vector for each keyword k using a pre-trained word vector model. To perform semantic reasoning, where the query vector ,in These represent the target semantic direction vector and the semantic direction vector to be avoided, respectively. The direction adjustment coefficient is calculated in the word vector space, identifying the top K words in the vocabulary that are most similar to the query vector, and then compared with... The union of the two sets yields the set of innovative keywords.

6. The electronic data forensics method based on big data analysis according to claim 5, characterized in that, S3 includes the following steps: S31. Extract relevant evidence from the electronic data content of the current user equipment using keywords in the innovative keyword set, and combine the electronic data evidence under the basic keywords to obtain the current equipment evidence dataset; S32. Combining basic keyword electronic data evidence with innovative keyword electronic data evidence, summarize the data patterns and mark suspicious time periods and suspicious evidence.

7. The electronic data forensics method based on big data analysis according to claim 6, characterized in that, S31 includes the following steps: S311. For the set of innovative keywords, read the current user equipment electronic data, and capture all data fragments, files or records containing any keyword in the set of innovative keywords from the current user equipment electronic data to obtain the set of innovative keyword evidence. S312. Merge the evidence set captured through basic keywords with the evidence set captured through innovative keywords to form a total evidence dataset.

8. The electronic data forensics method based on big data analysis according to claim 7, characterized in that, S32 includes the following steps: S321. For the obtained total evidence dataset, extract the timestamp of each piece of evidence and count the average frequency of various behaviors in different time periods. Draw a 24-hour activity distribution map. Based on the 3sigma criterion, determine the typical active time period of the current user. Identify dense evidence occurring in inactive time periods as suspicious evidence and mark the time periods as suspicious time periods in red in the total evidence dataset.

9. An electronic data forensics system based on big data analysis, characterized in that, The system employs the electronic data forensics method based on big data analysis as described in any one of claims 1-8, including a data acquisition module, a basic keyword matching module, an innovative keyword generation module, and a secondary forensics and suspicious data marking module: The data acquisition module and the basic keyword matching module collect current case information and classify case types, collect evidence-gathering keywords of different types of historical cases to build a historical thesaurus, obtain basic keywords based on the current case type, read the electronic data of the current user device, and collect evidence from the relevant electronic data under the basic keywords. The innovative keyword generation module filters historical cases based on the user operation behavior of the current case user, the case time pattern, and the case similarity to obtain a set of similar historical cases. It extracts all valid evidence-gathering keywords and recent case keywords from the set of similar historical cases, obtains candidate words through association rules and vector reasoning, and obtains a set of innovative keywords. The secondary evidence collection and suspicious marking module extracts relevant evidence from the electronic data content of the current user device using keywords in the innovative keyword set. It then combines the electronic data evidence under the basic keywords to obtain the current device evidence dataset. Finally, it summarizes the data patterns based on the electronic data evidence of the basic keywords and the electronic data evidence of the innovative keywords, and marks suspicious time periods and suspicious evidence.

Images