Method and device for extracting case-related document in electronic data

Abstract

The invention discloses a method and a device for extracting a case-related document in electronic data, and the method comprises the steps: carrying out the content analysis and preprocessing enhancement of the document in the electronic data, and obtaining a standardized text and structured basic information corresponding to the document; based on the obtained standardized text and structured basic information of the document, extracting basic text features and domain specific features, and forming a multi-dimensional feature set of the document; for the multi-dimensional feature set of the document, adopting a multi-layer classification strategy to judge whether the document is a case-related document or not and a specific case-related type; and if the document is judged to be a case-related document, extracting key case-related information in the document by adopting a corresponding structured extraction technology aiming at a specific case-related type of the document. According to the method, multi-source / format data adaptation, accurate identification and classification and structured information extraction are realized by comprehensively applying multiple technologies, and high efficiency, integrity and effectiveness of evidence obtaining are guaranteed.

Description

Technical Field

[0001] This invention relates to the field of electronic data forensics, and in particular to a method and apparatus for extracting documents involved in a case from electronic data. Background Technology

[0002] This invention relates to the field of electronic evidence collection technology and is applicable to judicial evidence collection scenarios in criminal cases such as economic crimes, fraud, and smuggling. In recent years, cybercrime and economic crimes have become increasingly complex, making electronic evidence collection increasingly important in judicial practice. Documents involved in the case (including fund flow records, fraudulent scripts, business reports, customs declarations, contracts, etc.) are key evidence for determining the facts of a case. However, current methods for extracting documents involved in the case still face many technical bottlenecks. Traditional methods generally rely on keyword searches and simple rule matching. For example, for fund flow records, extraction is only done by identifying keywords such as "amount," "transfer," and "account," and for contract documents, filtering is only based on features such as "Party A," "Party B," and "terms," ​​which is insufficient to meet the precise requirements of judicial evidence collection.

[0003] This traditional method has significant limitations: First, the wording of documents involved in cases varies greatly, with significant differences between documents from different cases and entities. Simple keyword matching is prone to generating a large number of false positives and false negatives, making it difficult to guarantee accuracy. Second, it is limited in its compatibility with a single format. For non-text documents such as images and PDF scans, traditional text analysis methods cannot effectively identify the textual information, leading to the omission of key evidence. Third, it does not adequately cover veiled expressions. Documents containing fraudulent language often use industry jargon and veiled expressions to evade screening, making it difficult to comprehensively cover with conventional keywords, and its ability to identify new types of criminal language is particularly weak. Fourth, it has poor adaptability to structured documents. Documents such as customs declarations and contracts have specific field and format requirements, and a single rule cannot adapt to different styles of structured documents, making it difficult to extract standardized structured information from them, thus hindering subsequent case analysis.

[0004] In summary, how to overcome the limitations of traditional methods, solve problems such as false positives and false negatives caused by keyword matching, difficulties in processing non-text formats, insufficient recognition of veiled expressions and new rhetoric, and poor adaptability to structured documents, and achieve rapid and accurate extraction of case-related documents and output of structured information from massive amounts of electronic data are the core technical problems that urgently need to be solved in this field. Summary of the Invention

[0005] The main objective of this invention is to overcome the shortcomings of existing technologies, such as low efficiency, low accuracy, difficulty in processing special documents, and insufficient adaptability to different types of documents, in extracting documents involved in cases from electronic data. This invention proposes a method and apparatus for extracting documents involved in cases from electronic data, which comprehensively utilizes multiple technologies to achieve multi-source / format data adaptation, accurate identification and classification, and structured information extraction, thereby ensuring the efficiency, completeness, and effectiveness of evidence collection.

[0006] The present invention adopts the following technical solution:

[0007] A method for extracting documents involved in a case from electronic data, comprising:

[0008] Content parsing and preprocessing enhancement are performed on documents in electronic data to obtain standardized text and structured basic information corresponding to the documents;

[0009] Based on the standardized text and structured basic information of the document obtained, basic text features and domain-specific features are extracted to form a multi-dimensional feature set of the document;

[0010] For the multi-dimensional feature set of the document, a multi-level classification strategy is used to determine whether the document is a document involved in a case and the specific type of case involved.

[0011] If the document is determined to be a document involved in a case, then according to its specific type of involvement, the corresponding structured extraction technology is used to extract the key information involved in the case from the document.

[0012] Content parsing refers to the extraction and transformation of the core content and related information of the document in electronic data by combining parsing tools with custom parsing logic.

[0013] The preprocessing enhancement involves optimizing the document after content parsing, including performing automatic password cracking attempts on encrypted documents, repairing damaged documents, forcibly restoring or identifying and removing obfuscated documents containing hidden text, white font, or zero-width characters, and performing recursive decompression and content scanning on compressed packages.

[0014] The standardized text refers to plain text data with a unified format that can be directly used for text analysis, including the core text after parsing and converting various documents, and the visible text restored after preprocessing and enhancement; the structured basic information refers to non-plain text information with a fixed format or logical structure extracted during the parsing process, including the table row and column layout, paragraph division, metadata, content classification identifiers, and basic data structure of the document.

[0015] The basic text features include TF-IDF-based word frequency features, semantic vector features based on pre-trained language models, and syntactic structure features; the domain-specific features include financial features, rhetoric features, report features, customs declaration features, and contract features.

[0016] Based on the multi-dimensional feature set, the BERT+BiLSTM deep learning model is used to perform preliminary classification of the document to determine whether the document is a regular document or a document involved in a case; during the classification process, the classification threshold is dynamically adjusted according to the case type.

[0017] For documents identified as being involved in a case, general attributes and specific attributes of each type of document are extracted based on the multi-dimensional feature set. Using several dedicated category discriminators and combined with differentiated domain knowledge rules designed for the characteristics of each type of document, a weighted fusion score is performed on the general attributes and the corresponding specific attributes to obtain a comprehensive score for each category. The specific type of case involving the document is determined based on the maximum comprehensive score and a preset threshold.

[0018] The general attributes include document length, number of paragraphs, average sentence length, TF-IDF vector, and BERT semantic vector. The specific attributes correspond to the core representation parameters of each of the following: financial features, sales pitch features, report features, customs declaration features, and contract features. There are five dedicated category discriminators, each corresponding to one of the five types of cases: fund flow, fraudulent sales pitch, business report, customs declaration, and contract. Each dedicated category discriminator performs weighted fusion calculation based on the specific and general attributes of the corresponding category, combined with differentiated domain knowledge rules, and outputs a comprehensive score for the corresponding category. Finally, the category with the highest comprehensive score that exceeds a preset threshold is selected as the specific type of case involving the document.

[0019] Based on the specific type of case involved, corresponding structured extraction techniques are used to extract key case-related information from the multi-dimensional feature set, including the following:

[0020] Funds flow documentation: A conditional random field sequence labeling model is used to identify key transaction fields, and a funds flow diagram is constructed after logical verification of the amount.

[0021] Fraud script document: It uses a hybrid approach of rules and deep learning to identify leading language, classify script types, and track the patterns of script changes;

[0022] Business report documents: Use OCR to recognize table structure, link data from multiple reports, and detect numerical anomalies;

[0023] Customs declaration documents: After recognizing the table using OCR, key information is extracted using a large model and compared and verified with the customs database;

[0024] Contract documents: Apache Tika is used to extract content, core clauses are extracted through a large model, and the standard template is compared with the validity of the electronic signature.

[0025] It also includes result integration, specifically: linking and integrating similar case-related documents from different data sources; providing multiple visualization methods to display the extraction results, including at least fund flow charts, dialogue heatmaps, and data trend charts; providing targeted case analysis suggestions and investigative breakthroughs for various types of cases based on the extracted case-related documents; and recording the original location and extraction path of each case-related document to ensure that the evidence collection process is verifiable.

[0026] A device for extracting documents involved in a case from electronic data, comprising:

[0027] The document preprocessing module is used to perform content parsing and preprocessing enhancement on documents in electronic data to obtain the standardized text and structured basic information corresponding to the document;

[0028] The feature extraction module is used to extract basic text features and domain-specific features based on the standardized text and structured basic information of the document, forming a multi-dimensional feature set of the document;

[0029] The type recognition module is used to apply a multi-level classification strategy to the multi-dimensional feature set of the document to determine whether the document is a document involved in a case and the specific type of case involved.

[0030] The structured extraction module is used to extract key information related to a case from a document when the document is determined to be a document involved in a case, by employing the corresponding structured extraction technology based on the specific type of case involved.

[0031] As can be seen from the above description of the present invention, compared with the prior art, the present invention has the following beneficial effects:

[0032] 1. This invention integrates document content parsing and preprocessing enhancement technologies to achieve unified parsing and content restoration of multi-source heterogeneous electronic data (including text, images, compressed files, semi-structured data, and instant messaging records, etc.). It effectively overcomes the problem of low recognition rate of encrypted, damaged, hidden text and scanned documents in traditional methods, improves the extractability and information integrity of the documents involved, and lays a reliable data foundation for subsequent analysis.

[0033] 2. This invention constructs a multi-dimensional feature set that integrates basic text features (TF-IDF, BERT semantic vectors, and syntactic structure) with domain-specific features (five types of proprietary features: funds, rhetoric, reports, customs declarations, and contracts). This achieves dual representation of the documents in question at both the semantic and domain rule levels, breaking through the limitations of relying solely on keywords or simple rules for identification, and improving the accuracy and robustness of document identification.

[0034] 3. This invention uses a BERT+BiLSTM deep learning model for initial classification of case-related documents and dynamically adjusts the classification threshold based on case type, achieving an organic unity of semantic-level recognition and scene adaptation. In the fine classification stage, a dedicated discriminator is used to integrate general attributes and domain rule scores to construct a dual-engine classification mechanism of "data-driven + knowledge-guided", effectively reducing false positives and false negatives, and achieving high-precision fine-grained recognition of five types of case-related documents, including fund flow records and fraudulent statements.

[0035] 4. This invention designs differentiated structured extraction techniques for different types of cases, such as using CRF models to identify transaction fields in fund flow records, combining OCR with large models to extract key fields in customs declarations, and using template comparison to verify contract terms and electronic signatures. This achieves accurate mapping from unstructured text to structured evidence elements, improving the analyzability and judicial credibility of case-related information.

[0036] 5. This invention constructs a complete evidence chain support system from raw data to investigative clues by integrating and visualizing multi-source case-related documents (fund flow diagrams, dialogue heatmaps, report trend charts, etc.) and generating intelligent analysis suggestions. It realizes the intuitive presentation of evidence collection results and business closed loop, effectively improving the efficiency of judicial case handling and the accuracy of decision-making.

[0037] 6. In the preprocessing stage, this invention achieves active restoration capabilities such as recursive decompression of compressed packages, zero-width character removal, watermark separation, and password cracking. It also records the original path and extraction trajectory of documents throughout the entire process, ensuring that the evidence collection process is traceable and verifiable, meeting the legality and integrity requirements of electronic data forensics, and enhancing the credibility of the technical solution in judicial practice. Attached Figure Description

[0038] Figure 1 This is the main flowchart of the method of the present invention;

[0039] Figure 2 This is a flowchart illustrating the specific process of the method of the present invention.

[0040] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Detailed Implementation

[0041] The present invention will be further described below through specific embodiments.

[0042] See Figure 1 and Figure 2 A method for extracting documents involved in a case from electronic data mainly includes document preprocessing, feature extraction, type recognition, and structure extraction, specifically including the following:

[0043] S1 performs content parsing and preprocessing enhancement on documents in electronic data to obtain the standardized text and structured basic information corresponding to the documents.

[0044] The electronic data originates from various sources, including data stored in the electronic devices involved in the case (such as computer hard drives), data transmitted and stored over the network (such as emails and attachments, instant messaging chat logs), data provided by third-party collaborators (such as enterprise management system documents), and data from related devices involved in the case (such as printer cache). The types of electronic data are diverse, specifically covering text documents (such as Word, TXT, Excel, PDF, etc.), image data containing text (such as JPG and PNG format chat screenshots, scanned copies of contracts, and report photos), compressed files (such as ZIP and RAR format packages of various document types), and semi-structured / unstructured data (such as CSV format transaction records, HTML format web page archives, and XML format configuration documents).

[0045] To address the diverse document sources and formats in electronic forensics, unified processing of various data sources is required:

[0046] Document content parsing refers to the extraction and transformation of core content and related information from electronic documents using a combination of parsing tools and custom parsing logic. Specifically:

[0047] It employs a combination of Apache Tika and a custom parser to support processing various document formats: specifically, it extracts text, tables, and annotations from Office documents (.doc, .docx, .xls, .xlsx, .ppt, .pptx); it distinguishes between native and scanned PDFs, performing OCR processing on scanned PDFs before extracting text content, table structure, and image region annotations; it extracts email text, attachments, and metadata from email files (.pst, .eml); it performs text recognition on image files (.jpg, .png, .bmp, etc.), optimizing table and handwritten character recognition; it extracts keyframes from video files for OCR analysis and speech-to-text conversion; and it parses instant messaging records from chat software databases such as WeChat and QQ to extract text, images, and file content.

[0048] Preprocessing enhancement optimizes the parsed document, including automatically attempting to crack passwords for encrypted documents, repairing corrupted documents, forcibly restoring or identifying and removing obfuscated documents containing hidden text, white text, or zero-width characters, and recursively decompressing and scanning compressed files. Details are as follows:

[0049] The system performs automatic password cracking attempts on encrypted documents (based on common password rules and case-related information), repairs and extracts content from damaged documents, and provides special processing for obfuscated documents (such as hidden text and white text). This includes: for white text or transparent text, forced highlighting or reversal is performed by analyzing the contrast between foreground and background colors; for invisible text such as zero-width characters and hidden layers, identification and removal are achieved by filtering or decoding Unicode control characters; for small fonts or overlapping text areas, image magnification and OCR enhancement algorithms are used to improve recognition accuracy; for documents with interfering watermarks, image denoising and watermark separation techniques are used to effectively remove background interference, ensuring that key text content can be accurately extracted; and recursively decompresses and scans the contents of compressed files (.zip, .rar) to prevent hidden documents from escaping.

[0050] In this embodiment, standardized text refers to plain text data with a unified format that can be directly used for text analysis. Specifically, it includes core text extracted after parsing various documents, multimedia content (images, videos), and converted and recognized text, as well as visible text restored after preprocessing and enhancement. Structured basic information refers to non-plain text information with a fixed format or logical structure extracted during the parsing process, including the document's table row and column layout, paragraph division, metadata (such as document creation time, author, email sender / recipient, etc.), content classification identifiers, and basic data structures.

[0051] Based on the standardized text and structured basic information of the obtained document, S2 extracts basic text features and domain-specific features to form a multi-dimensional feature set of the document, providing a foundation for subsequent classification and recognition.

[0052] The basic text features include TF-IDF-based word frequency features, semantic vector features based on pre-trained language models, and syntactic structure features; specifically as follows:

[0053] Term frequency statistics: Statistical analysis is performed based on the frequency of keyword occurrence in the text, and a TF-IDF (term frequency-inverse document frequency) vector is constructed to achieve a preliminary quantitative representation of the text content.

[0054] Semantic features: The text is deeply semantically encoded using pre-trained language models such as BERT to generate document-level semantic vectors with context awareness, capturing the latent semantic information of the text.

[0055] Syntactic features: parsing the syntactic structure of a text, including extracting and quantifying syntactic features such as sentence component division and punctuation usage patterns.

[0056] Domain-specific characteristics include financial characteristics, communication style characteristics, report characteristics, customs declaration characteristics, and contract characteristics, as detailed below:

[0057] Funds feature identification: Matching amount expressions using regular expressions (such as \d{1,3}(?:,\d{3})*(?:\.\d{2})?), while also identifying account format specifications and trading-related professional terms.

[0058] Regular expression explanation: \d{1,3}: 1–3 starting digits (e.g., "123"); (?:,\d{3})*: zero or more "comma + three digits" (e.g., ",000"); (?:\.\d{2})?: optional two decimal places (e.g., ".00"), conforming to currency rules.

[0059] Dialogue Feature Mining: Identify typical dialogue patterns, leading statements, and urgency language features in fraud scenarios to capture potential risk signals in the text.

[0060] Report Features: Identifies table structure, data column headers, summary rows, etc. Typical Scam Script Patterns: Builds a high-frequency fraud statement template library based on historical cases (e.g., "Congratulations on winning the prize," "Don't tell anyone your verification code"), uses fuzzy matching + context window rules (e.g., keywords appearing in the same sentence) for identification, and supports synonym replacement (e.g., "verification code" ≈ "dynamic code"); Leading Statements: Defines combination rules for common leading verbs (e.g., "click," "transfer," "download," "contact") and target objects (e.g., "link," "secure account," "customer service"), and judges whether there is an intent to "guide users to perform operations" through dependency parsing or shallow semantic role labeling; Urgent Language: Maintains a dictionary containing time-pressure words (e.g., "within 24 hours," "immediately," "expiring immediately," "overdue will..."), and combines negative word detection (e.g., "not expired if not processed" should be excluded) and tone intensity judgment (e.g., exclamation marks, repeated words) to improve identification accuracy.

[0061] Customs declaration feature extraction: First, locate the table area in the customs declaration and analyze its row and column layout; based on this, identify data column headers with semantic identification functions (such as "customs declaration number", "HS code", "commodity name", "quantity", "declared unit price", "country of origin", etc.) as well as possible summary rows or remarks rows and other customs declaration-specific structural elements; then, based on the spatial correspondence between the headers and data cells, automatically extract the corresponding field values ​​to form structured customs declaration information.

[0062] The Named Entity Recognition (NER) model, based on fine-tuning of a pre-trained language model in the legal domain, automatically identifies key legal elements in contracts, including structured fields such as "Party A," "Party B," "Signing Date," "Contract Amount," "Liability for Breach of Contract," and "Dispute Resolution Method." Simultaneously, it identifies clause numbering patterns (such as "Article 1," "Article 1," "1.1," "(a)," etc.) through rule matching, and reconstructs the logical structure of the contract by combining their hierarchical position in the document, thereby achieving structured parsing of contract content and accurate extraction of key information.

[0063] S3 uses a multi-level classification strategy to determine whether a document is involved in a case and the specific type of case it involves, based on the document's multi-dimensional feature set.

[0064] S31 uses a multi-dimensional feature set and a BERT+BiLSTM deep learning model to perform preliminary classification of documents, determining whether a document is a regular document or a document involved in a case; during the classification process, the classification threshold is dynamically adjusted according to the case type.

[0065] In this step, a multi-dimensional feature set is input into a pre-trained BERT model, which captures the semantic associations of the text context through a multi-layer Transformer encoder to generate dynamic word vectors with strong semantic representation capabilities. Subsequently, the semantic vector sequence output by BERT is input into a BiLSTM model, which uses its bidirectional long short-term memory structure to capture the text context dependencies, enhances the ability to identify logical associations and case-related feature associations in long texts, and further mines potential case-related semantic clues in the text.

[0066] During the model training phase, supervised training is conducted based on a massive amount of labeled ordinary documents and case-related documents (covering text data from various case scenarios) to enable the model to learn the semantic distribution patterns of different document types. During classification reasoning, the model outputs a confidence score indicating whether a document belongs to a case-related document through a fully connected layer. Combined with dynamically adjusted classification thresholds based on case type (0.3 for high-risk cases, 0.5 for general cases, and 0.7 for large-scale screening), an efficient distinction is made between ordinary documents and case-related documents: if the confidence score is higher than the corresponding threshold, it is determined to be a case-related document; if it is lower than the threshold, it is determined to be an ordinary document. This classification method not only ensures the accuracy of semantic-level recognition but also adapts to the needs of different evidence collection scenarios through dynamic thresholds, reducing false positive and false negative rates.

[0067] S32 Detailed Classification of Documents Involved in Cases: For documents identified as being involved in cases, general attributes and specific attributes of various types of documents involved in cases are extracted based on a multi-dimensional feature set. Through several dedicated category discriminators, combined with differentiated domain knowledge rules designed for the characteristics of various types of documents, the general attributes and corresponding specific attributes are weighted and fused to obtain a comprehensive score for each category. The specific type of case involved for each document is determined based on the maximum comprehensive score and a preset threshold.

[0068] Taking the documents involved in the case as an example, they are divided into five categories: fund flow records, fraudulent scripts, business reports, customs declarations, and contracts. Common attributes were extracted for all documents, including document length, number of paragraphs, average sentence length, TF-IDF vector, and BERT semantic vector. The specific attributes for each document category are as follows: core representation parameters for fund characteristics, script characteristics, report characteristics, customs declaration characteristics, and contract characteristics. Fund characteristics include the frequency of amount occurrences, account number occurrences, and transaction terminology density; script characteristics include the density of leading words, the density of urgent words, and the script template matching degree; report characteristics include the number of tables, numerical density, and the number of column headers; customs declaration characteristics include the existence of HS codes, customs declaration number format, and customs terminology density; and contract characteristics include the density of contract terms, the density of legal terms, and the completeness of information from both parties.

[0069] There are five dedicated category discriminators, each corresponding to one of the five types of cases: fund flow, fraudulent scripts, business reports, customs declarations, and contracts. Each dedicated category discriminator performs weighted fusion calculations based on the specific and general attributes of the corresponding category, combined with differentiated domain knowledge rules, and outputs a comprehensive score for the corresponding category. Finally, the category with the highest comprehensive score that exceeds a preset threshold is selected as the specific case type of the document.

[0070] Each discriminator provides a base confidence score M_c(D) between 0 and 1, as follows:

[0071] For documents containing financial statements: Use a "keyword + amount format matching" discriminator. Prepare transaction keywords such as "transfer," "income," "expenditure," and "account" in advance, as well as amount formats such as "123.45 yuan" and "1,234 yuan," and count the frequency of these two types of elements in the document.

[0072] Fraudulent script documents: Use a "typical script vocabulary + inducement combination matching" detector. Build a fraudulent vocabulary database in advance containing words such as "winning a prize," "verification code," "secure account," and "within 24 hours," count the frequency of these words, and check for phrases like "click a link" or "transfer money to XX account."

[0073] For business report documents: use a "table structure + report keyword matching" discriminator. First, check if the document contains tables, then look for report keywords such as "sales revenue," "profit," "summary," and "month," and determine the matching degree based on the presence or absence of tables and the frequency of keyword occurrences.

[0074] For customs declaration documents: Use the "Customs Declaration-Specific Field Matching" discriminator. Pre-list required fields such as "Customs Declaration Number," "HS Code," "Commodity Name," and "Country of Origin," and count the number of fields found in the document to determine the match rate.

[0075] For contract and agreement documents: Use the "Party Signatory + Core Clause Matching" discriminator. Look for party signatory information such as "Party A, Party B, and Company Name," and core clause terms such as "Contract Term, Liability for Breach of Contract, and Payment Method." Determine the degree of match based on the presence of these two types of information.

[0076] To address the unique characteristics of various types of documents involved in cases, this embodiment designs a dedicated scoring rule R_c(D) based on domain knowledge rules, as shown in the table below:

[0077]

[0078] Based on the combined scores and final judgment, calculate the overall score for each category:

[0079] For document D, calculate its overall score across all candidate categories c:

[0080] Score(c)=w1×M_c(D)+w2×R_c(D)

[0081] Where: M_c(D) is the basic score of category c output by the dedicated category discriminator based on the multi-dimensional feature set, reflecting the degree of matching between the document and the features of category c; R_c(D) is the domain knowledge rule matching score designed for category c (i.e., the quantitative result of the scoring rule R_c(D) mentioned above), reflecting the degree of fit of the document to the specific rules of category c; and w1 and w2 are the weights of the basic score and the rule matching score, respectively.

[0082] The final classification result is as follows: take the comprehensive score argmax_cScore(c) corresponding to each candidate category c. If the maximum value is greater than the preset classification threshold Threshold, then the specific case type of document D is the category c corresponding to the maximum value; if the maximum value does not reach the preset threshold, then the document is determined to have no clear corresponding case type (denoted as None).

[0083] S4 If a document is determined to be involved in a case, then, based on its specific type of involvement, the corresponding structured extraction technique is used to extract key case-related information from a multi-dimensional feature set. This includes the following:

[0084] Funds Flow Documentation: A Conditional Random Field (CRF) sequence labeling model is used to identify key transaction fields. After logical verification of amounts, a funds flow graph is constructed. Specifically, the CRF sequence labeling model utilizes features such as part-of-speech tags, numerical patterns, and contextual windows to effectively identify key transaction fields without the need for complex neural networks. Logical verification of amounts ensures data accuracy, and a funds flow graph is automatically constructed to identify suspicious transaction patterns.

[0085] Fraudulent script document: It uses a hybrid approach of rules and deep learning to identify manipulative language, classifying the scripts into types such as "prize winning notification", "impersonating public security, procuratorate and court officials", and "investment and financial management", and tracks the changing patterns of the scripts of the same criminal gang.

[0086] Business report documents: OCR is used to identify table structure, link data from multiple reports, and detect numerical anomalies. Specifically, Tesseract OCR (table mode) is used to identify table boundaries and row and column structure, recognize the semantics of column headers (such as "sales" and "profit"), and automatically link relevant data from different reports based on key fields such as time and department. It also detects outliers and contradictions in the reports by calculating the mean and standard deviation of numerical data, such as imbalances in the balance sheet or inconsistencies between the profit and loss statement and tax return data.

[0087] Customs declaration documents: After OCR recognition of the table, a large model is used to extract key information and compare it with the customs database for verification. Specifically, Tesseract OCR (table mode) is used to identify table boundaries and row and column structure, and entity prompts are written for the customs declaration. The large model is used to extract key information such as customs declaration number, commodity code, quantity, value, and country of origin, which is then compared with the customs database to verify authenticity and identify significant differences between the declared price and the market price.

[0088] Contract documents: Content is extracted using Apache Tika, and core clauses are extracted through a large model. The data is then compared with a standard template to verify the validity of the electronic signature. The documents are primarily in Word format. Apache Tika is used to extract content, and contract entity prompts are written. The large model automatically extracts core clauses such as the contracting parties, amount, term, and liability for breach of contract. Abnormal clauses are identified by comparison with a standard contract template, and image processing technology is used to verify the validity of the electronic signature.

[0089] This embodiment also includes result integration to provide practical forensic support, specifically:

[0090] Multi-source result fusion: It can link and integrate similar case-related documents from different data sources, supporting the linking and integration of similar case-related documents from different data sources such as computers, mobile phones, and emails.

[0091] Visualization; provides various visualization extraction structures, such as fund flow charts, sales script heatmaps, report data trend charts, and contract key clause comparison tables;

[0092] Intelligent analysis and suggestions: Based on extracted case documents, it provides targeted case analysis suggestions and investigative breakthroughs for various types of cases, including: identifying abnormal transaction patterns in fund flow records, tracing the hierarchy of fund flows, and locating core control accounts; determining the type of fraud based on fraudulent scripts, marking key inducement links, and suggesting linking similar cases; identifying signs of financial fraud in business reports, assessing operating conditions, and suggesting necessary supporting materials; assessing smuggling risks in customs declarations, analyzing price and product name anomalies, and marking goods requiring verification; assessing the validity of contracts and agreements, identifying performance risks, and determining whether contracts are fraudulent, and providing targeted investigative suggestions and evidence fixation directions for each type of case.

[0093] Source tracing function: Records the original location and extraction path of each document involved in the case to ensure that the evidence collection process is verifiable.

[0094] Based on this, the present invention also proposes a device for extracting documents involved in a case from electronic data, including a document preprocessing module, a feature extraction module, a type recognition module, a structure extraction module, and a result integration module.

[0095] The document preprocessing module is used to perform content parsing and preprocessing enhancement on documents in electronic data, obtaining standardized text and structured basic information corresponding to the documents. Specifically, this module integrates a document content parsing unit and a preprocessing enhancement unit. The document content parsing unit uses a combination of Apache Tika and a custom parser to extract content (including body text, tables, metadata, etc.) from text documents such as Office documents, native / scanned PDFs, and email files. It also supports text recognition (optimized table and handwriting recognition, video keyframe OCR, and speech-to-text) from multimedia files such as images and videos, as well as parsing and extracting instant messaging records from WeChat, QQ, etc. The preprocessing enhancement unit performs optimization processing on the parsed documents, including automatically attempting to crack encrypted documents based on common password rules and case-related information, repairing damaged documents and extracting valid content, forcibly restoring or identifying and removing obfuscated documents containing hidden text, zero-width characters, etc., and recursively decompressing and scanning ZIP, RAR, and other compressed files to prevent hidden documents from escaping.

[0096] The feature extraction module is used to extract basic text features and domain-specific features from standardized text and structured basic information of documents, forming a multi-dimensional feature set of the document. Specifically, this module can extract basic text features such as word frequency features based on TF-IDF, semantic vector features based on pre-trained language models, and syntactic structure features. At the same time, it can extract domain-specific features, including financial features (amount expressions, account formats, transaction terms, etc.), verbal features (leading expressions, urgency language, verbal template matching degree, etc.), report features (table structure, data column headers, etc.), customs declaration features (specific fields, customs terms, etc.), and contract features (legal elements, clause numbering patterns, etc.), and complete the quantification and integration of various features.

[0097] The type recognition module employs a multi-layered classification strategy on the multi-dimensional feature set of documents to determine whether a document is involved in a case and, if so, the specific type of case it involves. This module includes a preliminary classification unit and a fine-grained classification unit: the preliminary classification unit uses a BERT+BiLSTM deep learning model. It captures the semantic relationships within the text context using a Transformer encoder to generate dynamic word vectors, and combines this with a BiLSTM model to enhance the recognition of logical connections in long texts. It outputs a confidence score indicating whether a document belongs to a case-related document and dynamically adjusts the classification threshold based on the case type to distinguish between ordinary documents and documents involved in cases. The fine-classification unit extracts general document attributes (document length, number of paragraphs, TF-IDF vector, etc.) and specific attributes of various types of documents involved in the case (such as the frequency of occurrence of monetary amounts in financial features and the density of leading words in verbal features). Through five dedicated discriminators adapted to different categories of fund flow, fraudulent language, business reports, customs declarations, and contracts, the two types of attributes are weighted and fused for scoring in combination with differentiated domain knowledge rules. Finally, the category with the highest comprehensive score that exceeds the preset threshold is selected as the specific case type of the document. If the threshold is not reached, it is determined that there is no clear corresponding case type.

[0098] The structured extraction module is used to extract key information related to a case when a document is determined to be involved in a crime. Specifically, it employs a conditional random field sequence labeling model to identify key transaction fields and constructs a fund flow diagram after logical verification of the amount. For fraudulent script documents, it uses a hybrid method of rules and deep learning to identify manipulative language, classify script types, and track the changing patterns of criminal gang scripts. For business report documents, it uses OCR to identify the table structure, correlates data from multiple reports, and detects numerical anomalies. For customs declaration documents, after OCR identification of the table, it uses a large-scale model to extract key information and compares it with the customs database for verification. For contract documents, it uses Apache Tika to extract content, extracts core clauses through a large-scale model, compares them with standard templates, and verifies the validity of electronic signatures.

[0099] The results integration module is used to integrate key information from various case-related documents output by the structured extraction module from multiple dimensions, providing direct and usable analytical support for judicial evidence collection. This module specifically implements three core functions: First, multi-source result fusion, which can integrate similar case-related documents from different data sources such as computer hard drives, mobile phone storage, email attachments, and third-party collaborative data, eliminating data redundancy and establishing relationships between evidence; second, visualization, supporting the generation of diverse visualization results such as fund flow charts, fraud script heatmaps, report data trend charts, and comparison tables of key contract terms, intuitively presenting the internal logic of the case-related information; and third, intelligent analysis suggestions, based on the extracted features of the case-related documents, outputting targeted investigation suggestions for five types of case-related documents: fund flow, fraud scripts, business reports, customs declarations, and contracts. These suggestions include identifying abnormal transaction patterns, determining fraud types, alerting to signs of financial fraud, assessing smuggling risks, and verifying contract validity. Simultaneously, it marks breakthrough points in the case and directions for supplementary evidence, improving the efficiency and accuracy of judicial evidence collection.

[0100] Furthermore, in the description of this application, unless otherwise stated, "multiple" means two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0101] The present invention also provides a computer-readable medium, which may be included in the electronic device described in the above embodiments; or it may exist alone and not assembled into the electronic device.

[0102] The aforementioned computer-readable medium carries one or more programs, which, when executed by an electronic device, cause the electronic device to perform the methods described in the above embodiments.

[0103] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0104] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, touch terminal, or network device, etc.) to execute the method according to the embodiments of this disclosure.

[0105] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein.

[0106] The above are merely specific embodiments of the present invention, but the design concept of the present invention is not limited thereto. Any non-substantial modifications made to the present invention using this concept shall be considered as infringing upon the protection scope of the present invention.

Claims

1. A method for extracting documents involved in a case from electronic data, characterized in that, include: Content parsing and preprocessing enhancement are performed on documents in electronic data to obtain standardized text and structured basic information corresponding to the documents; Based on the standardized text and structured basic information of the document obtained, basic text features and domain-specific features are extracted to form a multi-dimensional feature set of the document; For the multi-dimensional feature set of the document, a multi-level classification strategy is used to determine whether the document is a document involved in a case and the specific type of case involved. If the document is determined to be a document involved in a case, then according to its specific type of involvement, the corresponding structured extraction technology is used to extract the key information involved in the case from the document.

2. The method for extracting documents involved in a case from electronic data as described in claim 1, characterized in that, Content parsing refers to the extraction and transformation of the core content and related information of the document in electronic data by combining parsing tools with custom parsing logic.

3. The method for extracting documents involved in a case from electronic data as described in claim 1, characterized in that, The preprocessing enhancement involves optimizing the document after content parsing, including performing automatic password cracking attempts on encrypted documents, repairing damaged documents, forcibly restoring or identifying and removing obfuscated documents containing hidden text, white font, or zero-width characters, and performing recursive decompression and content scanning on compressed packages.

4. The method for extracting documents involved in a case from electronic data as described in claim 1, characterized in that, The standardized text refers to plain text data with a unified format that can be directly used for text analysis, including the core text after parsing and converting various documents, and the visible text restored after preprocessing and enhancement; the structured basic information refers to non-plain text information with a fixed format or logical structure extracted during the parsing process, including the table row and column layout, paragraph division, metadata, content classification identifiers, and basic data structure of the document.

5. The method for extracting documents involved in a case from electronic data as described in claim 1, characterized in that, The basic text features include TF-IDF-based word frequency features, semantic vector features based on pre-trained language models, and syntactic structure features; the domain-specific features include financial features, rhetoric features, report features, customs declaration features, and contract features.

6. The method for extracting documents involved in a case from electronic data as described in claim 1, characterized in that, Based on the multi-dimensional feature set, the BERT+BiLSTM deep learning model is used to perform preliminary classification of the document to determine whether the document is a regular document or a document involved in a case. During the classification process, the classification thresholds are dynamically adjusted based on the case type. For objects identified as documents involved in the case, extract common document attributes and specific attributes of various types of documents involved in the case based on the multi-dimensional feature set; By using several dedicated category discriminators and combining differentiated domain knowledge rules designed for the characteristics of various documents, a weighted fusion score is applied to general attributes and corresponding proprietary attributes to obtain a comprehensive score for each category. The specific type of case involved in the document is determined based on the maximum comprehensive score and a preset threshold.

7. The method for extracting documents involved in a case from electronic data as described in claim 6, characterized in that, The general attributes include document length, number of paragraphs, average sentence length, TF-IDF vector, and BERT semantic vector. The specific attributes correspond to the core representation parameters of each of the following: financial features, sales pitch features, report features, customs declaration features, and contract features. There are five dedicated category discriminators, each corresponding to one of the five types of cases: fund flow, fraudulent sales pitch, business report, customs declaration, and contract. Each dedicated category discriminator performs weighted fusion calculation based on the specific and general attributes of the corresponding category, combined with differentiated domain knowledge rules, and outputs a comprehensive score for the corresponding category. Finally, the category with the highest comprehensive score that exceeds a preset threshold is selected as the specific type of case involving the document.

8. The method for extracting documents involved in a case from electronic data as described in claim 1, characterized in that, Based on the specific type of case involved, corresponding structured extraction techniques are used to extract key case-related information from the multi-dimensional feature set, including the following: Funds flow documentation: A conditional random field sequence labeling model is used to identify key transaction fields, and a funds flow diagram is constructed after logical verification of the amount. Fraud script document: It uses a hybrid approach of rules and deep learning to identify leading language, classify script types, and track the patterns of script changes; Business report documents: Use OCR to recognize table structure, link data from multiple reports, and detect numerical anomalies; Customs declaration documents: After recognizing the table using OCR, key information is extracted using a large model and compared and verified with the customs database; Contract documents: Apache Tika is used to extract content, core clauses are extracted through a large model, and the standard template is compared with the validity of the electronic signature.

9. The method for extracting documents involved in a case from electronic data as described in claim 1, characterized in that, It also includes result integration, specifically: linking and integrating similar case-related documents from different data sources; providing multiple visualization methods to display the extraction results, including at least fund flow charts, dialogue heatmaps, and data trend charts; providing targeted case analysis suggestions and investigative breakthroughs for various types of cases based on the extracted case-related documents; and recording the original location and extraction path of each case-related document to ensure that the evidence collection process is verifiable.

10. A device for extracting documents involved in a case from electronic data, characterized in that, include The document preprocessing module is used to perform content parsing and preprocessing enhancement on documents in electronic data to obtain the standardized text and structured basic information corresponding to the document; The feature extraction module is used to extract basic text features and domain-specific features based on the standardized text and structured basic information of the document, forming a multi-dimensional feature set of the document; The type recognition module is used to apply a multi-level classification strategy to the multi-dimensional feature set of the document to determine whether the document is a document involved in a case and the specific type of case involved. The structured extraction module is used to extract key information related to a case from a document when the document is determined to be a document involved in a case, by employing the corresponding structured extraction technology based on the specific type of case involved.

Images