An automatic intelligent forensics system based on cloud-end cooperation and multi-channel control

Abstract

This invention relates to the field of computer forensics and information security technology, specifically to an automated intelligent forensics system based on cloud-edge collaboration and multi-channel control. It includes: a video signal acquisition and processing module: capturing screen images of the target machine, preprocessing them, and then uploading them; an HID simulation control module: simulating the forensics terminal as an input device, receiving operation commands from the cloud and injecting control signals into the target machine; a network communication module: establishing a connection with the target machine for data transmission and command execution, and communicating with the cloud; a cloud-based large-scale model scheduling module: calling a cloud-based large-scale language model to analyze screen images and generate simulated operation commands or plan forensics tasks; a task planning and execution module: decomposing forensics requirements into a sequence of task steps and calling the corresponding modules to execute forensics operations according to the control channels; a data storage and management module: storing and managing forensic data; and a report generation module: generating formatted reports. This technical solution can improve the efficiency and accuracy of electronic data forensics.

Description

Technical Field

[0001] This invention relates to the field of computer forensics and information security technology, specifically to an automated intelligent forensics system based on cloud-edge collaboration and multi-channel control. Background Technology

[0002] In the field of computer electronic data forensics, traditional methods primarily rely on manual operation. Forensic personnel must physically interact with the target computer (hereinafter referred to as the "target machine"), manually operating the keyboard and mouse while visually observing the screen to navigate the system, locate data, and execute commands. This model has numerous drawbacks, severely restricting the efficiency and quality of forensic work.

[0003] First, manual evidence collection is extremely inefficient. Because the entire process relies on manual operation, it is slow and cannot meet the current demand for batch evidence collection from a large number of devices. When faced with large-scale electronic data forensics tasks, manual operation not only consumes a lot of time but is also prone to errors due to fatigue and other factors, further reducing efficiency.

[0004] Secondly, manual evidence collection relies heavily on experts. Operators must be familiar with various operating systems, application software, and evidence collection tools, requiring significant investment in professional training. Furthermore, differences in the technical skills and experience of different evidence collectors can affect the standardization and normalization of the evidence collection process.

[0005] Furthermore, the consistency of manual operations is poor. During the evidence collection process, oversights are prone to occur, and the steps taken by different personnel, or even the same person at different times, may be inconsistent, negatively impacting the completeness and legal validity of the evidence. The completeness and legality of evidence are core requirements for electronic data forensics; any problems with these can render the evidence invalid.

[0006] Furthermore, traditional automated forensics tools have limited adaptability. While some remote forensics tools on the market are based on a single connection method, such as purely network-based remote forensics tools, these tools heavily rely on pre-defined interface elements and application programming interfaces (APIs). When encountering unknown software versions, customized interfaces, or unexpected pop-ups, traditional automated scripts or robotic process automation (RPA) tools often fail to function properly and are ill-suited to complex and ever-changing forensics scenarios.

[0007] Although some remote forensic tools based on network control have emerged in the market, they have significant limitations in certain scenarios. In black-box scenarios where the target machine has no network service, the system is crashed, or physical contact is required, remote forensic tools based on a single connection method will be completely ineffective, unable to obtain electronic data from the target machine, thus making forensic work impossible. Summary of the Invention

[0008] The purpose of this invention is to propose an automatic intelligent evidence collection system based on cloud-edge collaboration and multi-channel control, which can improve the efficiency and accuracy of electronic data evidence collection.

[0009] To achieve the above objectives, in a first aspect, the present invention proposes an automated intelligent evidence collection system based on cloud-edge collaboration and multi-channel control, comprising: The video signal acquisition and processing module is used to capture real-time screen images of the target machine and upload them to the cloud-based intelligent dispatch center after preprocessing the images. The HID simulation control module is used to simulate the local evidence collection terminal as an input device, receive operation instructions sent from the cloud and inject control signals into the target machine; The network communication module is used to establish a network connection with the target machine through the network interface for data transmission and command execution, as well as to communicate with the cloud-based intelligent dispatch center. The cloud-based large model scheduling module is used to dynamically call the cloud-integrated large language model according to the task stage, analyze the screen image and generate simulated operation instructions, or plan tasks for evidence collection needs. The task planning and execution module is used to decompose the evidence collection requirements into a sequence of task steps, and call the corresponding module to perform the evidence collection operation according to the control channel selected by the system. The data storage and management module is used to store and manage the data obtained during the evidence collection process. The report generation module is used to integrate and analyze the evidence collection results and generate formatted reports.

[0010] Beneficial effects of the basic solution: This technical solution offloads computationally intensive AI tasks such as visual analysis, task planning, and report generation to the cloud, giving full play to the powerful inference capabilities and computing power of large cloud models; the local forensic terminal is only responsible for real-time image acquisition, hardware interaction, and command execution, reducing the cost and complexity of terminal hardware, while ensuring high real-time performance and high reliability of on-site control, achieving the optimal balance between intelligent capabilities, deployment costs, and usage flexibility.

[0011] The system integrates three control channels: video capture, HID simulation, and network communication, and supports intelligent dynamic upgrades from basic general-purpose channels to high-speed dedicated channels. In harsh environments such as when the target machine is restricted, there is no network, or the system malfunctions, basic forensic control can be completed using the HID and video channels; when conditions permit, it automatically switches to the network channel to achieve high-speed data interaction, ensuring the availability of forensic evidence in extreme scenarios while significantly improving the efficiency of forensic evidence collection and data transmission capabilities in conventional scenarios.

[0012] The system intelligently schedules dedicated visual models and general-purpose language models to work together based on the type of evidence collection task. The dedicated model focuses on screen interface recognition and operation localization, while the general-purpose model is responsible for logical reasoning, task decomposition, and decision planning. Compared with a single model, it has stronger scene understanding, execution accuracy, and task success rate, while effectively reducing the cost of model invocation.

[0013] As a feasible and preferred solution, the video signal acquisition and processing module captures real-time screen images of the target device through a video input interface, which is an HDMI input port, a USB interface is a Type-C interface that supports USB OTG, and network interfaces include a Gigabit Ethernet port and a Wi-Fi / Bluetooth module.

[0014] As a feasible and preferred solution, the video signal acquisition and processing module receives the video signal from the target device via an HDMI cable, converts the analog signal into a digital signal using an image acquisition chip, and preprocesses the digital image using an image processing library, including noise reduction and enhancement operations.

[0015] As a feasible and preferred solution, the HID simulation control module enables the local forensic terminal to simulate the device identification and communication protocol of the keyboard and mouse by writing drivers and applications, converting the input characters into keyboard scan codes or mouse operation information into mouse data packets, and sending them to the target machine via the USB interface.

[0016] As a feasible and preferred solution, the network communication module uses the TCP / IP protocol for data transmission and establishes a TCP connection through a three-way handshake process.

[0017] As a feasible and preferred solution, the cloud-based large model scheduling module receives task requests and data uploaded by local forensic terminals through an API interface, and selects a large language model for processing according to the task type and stage. This includes: calling the system operation large model to analyze screen images to identify graphical user interface elements and generate simulated operation instructions, and calling the task planning and report generation large model to decompose the user's advanced forensic needs into a detailed sequence of steps.

[0018] As a feasible and preferred solution, the data storage and management module sets up data storage areas in both the local evidence collection terminal and the cloud, uses a database management system to store and manage the data, creates an independent data storage directory for each evidence collection task, and records the metadata of the data in the database.

[0019] As a feasible and preferred solution, the task planning and execution module calls the corresponding functional modules to execute tasks based on the control channel currently selected by the system. The control channels include the video acquisition and HID simulation channel and the SSH connection channel.

[0020] As a feasible and preferred solution, the system collaboratively implements forensics through the following stages: During the initial access and exploration phase, the local forensic terminal captures real-time screen images of the target machine and uploads them to the cloud. The cloud-based large model scheduling module calls the system's large model to analyze the screen images and generate simulated operation commands. The HID simulation control module injects control signals into the target machine while continuously capturing screen images to provide feedback on the operation results. During the channel optimization and enhancement phase, the task planning and execution module actively detects and attempts to establish a control channel. It configures the network and enables the SSH service on the target machine through HID simulation. When the SSH service port is detected to be open, an SSH connection is automatically established, and subsequent command-line forensics commands are executed through the SSH channel. During the hybrid execution phase, the system maintains multiple control channels simultaneously. While executing background data extraction commands via SSH, it monitors the front-end interface through the video signal acquisition and processing module and the HID analog control module. When an interface requiring interaction is detected, the interface image is uploaded to the cloud for analysis and operation instructions are generated, which are then responded to through the HID analog control module. During the report generation phase, the data storage and management module uploads the raw data to the cloud, and the report generation module calls the large model to analyze and process the data to generate a formatted report.

[0021] As a feasible and preferred solution, after gaining initial control, the pre-compiled lightweight agent program is copied to the target machine and run through the HID simulation control module and file transfer function. The agent program communicates with the local forensics terminal through an encrypted network connection, receives structured commands and performs corresponding operations, and returns structured data to the local forensics terminal. Attached Figure Description

[0022] Figure 1 This is a schematic diagram of the architecture of an automated intelligent evidence collection system based on cloud-edge collaboration and multi-channel control. Detailed Implementation

[0023] To make the technical solution and advantages of this application clearer, the technical solution of the present invention will be further described in detail below with reference to the accompanying drawings. It is understood that the specific embodiments described herein are only some embodiments of the present invention, and are only used to explain this application, not to limit it. It should be noted that the technical features or combinations of technical features described in the following embodiments should not be considered isolated; they can be combined with each other to achieve better technical effects. The same reference numerals appearing in the accompanying drawings of the following embodiments represent the same features or components, and can be applied to different embodiments.

[0024] Furthermore, unless otherwise defined, the technical or scientific terms used in this invention description shall have the ordinary meaning understood by one of ordinary skill in the art to which this invention pertains.

[0025] The present invention will now be described in further detail with reference to the accompanying drawings.

[0026] Example 1 This disclosure provides an automated intelligent evidence collection system based on cloud-edge collaboration and multi-channel control. The hardware of this system mainly includes a local evidence collection terminal and a cloud-based intelligent dispatch center.

[0027] In this embodiment, the local forensics terminal uses an industrial tablet PC equipped with a Rockchip RK3588 ARM processor, running the Ubuntu 22.04 LTS operating system. The tablet is equipped with an HDMI input port for capturing real-time screen images from the target device. This works by transmitting the target device's video signal to the tablet's HDMI IN port via an HDMI cable. The tablet's internal circuitry decodes and processes the signal, converting it into displayable image data. It also has a USB OTG-enabled Type-C interface, which acts as a USB keyboard and mouse, injecting control signals into the target device. When the target device and tablet are connected via USB, the tablet utilizes USB OTG functionality to simulate the device identifier and communication protocol of a keyboard and mouse, enabling keyboard and mouse control of the target device. A Gigabit Ethernet port is used to establish a high-speed network connection with the target device for efficient data transmission and command execution. Connecting the target device and tablet's Ethernet ports via a network cable establishes a physical network connection, enabling rapid data transmission. Furthermore, it has built-in Wi-Fi / Bluetooth for connecting to the cloud, establishing a connection with the cloud server via a wireless communication module to upload and download data, as well as receive and send commands.

[0028] The cloud-based intelligent scheduling center is deployed on a server cluster equipped with high-performance GPUs, providing large-scale model services via APIs. The high-performance GPUs provide powerful computing support for running large models, enabling rapid processing of massive amounts of image data and complex logical operations. The server cluster communicates with local forensic terminals via API interfaces, receiving data and requests uploaded by the terminals and returning corresponding processing results and instructions.

[0029] Reference Figure 1 An automated intelligent evidence collection system based on cloud-edge collaboration and multi-channel control includes a video signal acquisition and processing module, an HID analog control module, a network communication module, a cloud-based large model scheduling module, a task planning and execution module, a data storage and management module, and a report generation module.

[0030] The video signal acquisition and processing module is used to capture real-time screen images of the target machine and perform preprocessing operations such as noise reduction and enhancement to improve image quality and provide clear and accurate image data for subsequent visual analysis.

[0031] Specifically, the video signal from the target device is received via the HDMI input port of the local forensics terminal. The analog signal is converted to a digital signal using the tablet's internal image acquisition chip. Then, an open-source image processing library (such as OpenCV) is used to preprocess the digital image. For example, a median filtering algorithm is used to remove noise from the image, as shown in the following formula:

[0032] in, It is the pixel value of the original image at coordinates (x, y). It is the pixel value of the original image at coordinates (x, y). It is a filter window.

[0033] The HID simulation control module is used to simulate a USB keyboard and mouse on the local forensic terminal, inject control signals into the target machine, and realize basic operations on the target machine, such as clicking and inputting.

[0034] Specifically, by utilizing a USB port that supports USB Gadget / OTG functionality, and by developing corresponding drivers and applications, the tablet computer can simulate the device identifiers and communication protocols of a keyboard and mouse. When a keyboard input command needs to be sent to the target machine, the application converts the input characters into corresponding keyboard scan codes and sends them to the target machine via the USB interface; when a mouse operation command needs to be sent, information such as the mouse movement distance and click position is converted into corresponding mouse data packets and sent to the target machine.

[0035] The network communication module is used to establish a high-speed network connection with the target machine for data transmission and command execution. Simultaneously, it communicates with the cloud-based intelligent dispatch center to upload data and receive instructions.

[0036] Specifically, a network connection is established between the local forensics terminal and the target machine and the cloud via its gigabit Ethernet port or built-in Wi-Fi / Bluetooth module. Standard network communication protocols (such as TCP / IP) are used for data transmission to ensure data reliability and integrity. For example, during TCP connection establishment, a three-way handshake process ensures connection reliability, with the specific steps as follows: The client (local forensic terminal) sends a SYN packet to the server (target machine or cloud) to request the establishment of a connection.

[0037] After receiving the SYN packet, the server replies with a SYN-ACK packet, indicating that it agrees to establish a connection.

[0038] After receiving the SYN-ACK packet, the client sends an ACK packet to confirm the connection establishment.

[0039] The cloud-based large model scheduling module dynamically calls various multimodal large language models (LLMs) integrated in the cloud according to the task stage, such as the system operation large model and the task planning and report generation large model, to realize functions such as screen image analysis, task planning, and report generation.

[0040] Specifically, the cloud-based intelligent dispatch center receives task requests and data uploaded by local forensic terminals via API interfaces. Based on the task type and stage, it selects an appropriate large-scale language model for processing. For example, when a screen image analysis request is received, the system's large-scale operation model is invoked to analyze the image, identify graphical user interface (GUI) elements, and generate specific simulated operation instructions. When a task planning request is received, the task planning and report generation model is invoked to decompose the user's advanced forensic needs into a detailed sequence of steps.

[0041] The task planning and execution module is used to break down the user's advanced forensics requirements into a detailed sequence of task steps, and to perform corresponding forensics operations based on the control channel selected by the system, such as extracting system logs and obtaining network connection information.

[0042] Specifically, the task planning and execution module receives the task step sequence decomposed by the cloud-based large-scale model scheduling module, and calls the corresponding functional modules to execute the task based on the currently selected control channel (such as video capture + HID simulation channel, SSH connection channel, etc.). For example, if the current control channel is a video capture + HID simulation channel, the module calls the HID simulation control module to send operation commands to the target machine; if the current control channel is an SSH connection channel, the module sends command-line commands to the target machine through the network communication module.

[0043] The data storage and management module is used to store various data obtained during the evidence collection process, such as screenshots, operation logs, and extracted files, and to manage and classify the data for subsequent querying and analysis.

[0044] Specifically, data storage areas are set up on both the local forensics terminal and the cloud, and a database management system (such as MySQL) is used to store and manage the data. An independent data storage directory is created for each forensics task, and the relevant data files are stored in the directory. Meta-information of the data, such as filename, storage path, and retrieval time, is recorded in the database to facilitate subsequent querying and retrieval.

[0045] The report generation module is used to integrate and analyze the evidence collection results and generate formatted reports (such as Word / PDF). The report content includes a description of the evidence collection process, a summary of the extracted data, and signs of security incidents found, for investigators to review.

[0046] Specifically, the report generation module receives forensic data from the data storage and management module, and calls the cloud-based task planning and report generation model to analyze and process the data. Based on user needs and preset report templates, it generates formatted report documents. For example, it uses Python document generation libraries (such as python-docx) to generate Word format reports and the ReportLab library to generate PDF format reports.

[0047] The collaborative implementation process of this system is as follows.

[0048] During the initial access and exploration phase, the local forensic terminal captures real-time screen images of the target device through its video signal acquisition and processing module and uploads the image data to the cloud. The cloud-based large-scale model scheduling module calls the system's large-scale operation model to analyze the screen images, identifying graphical user interface (GUI) elements such as menus, buttons, and input boxes. Based on the analysis results, specific simulated operation instructions are generated, such as clicking a button, entering a username and password, etc., and these instructions are sent to the local forensic terminal through the cloud-based large-scale model scheduling module. The local forensic terminal's HID simulation control module receives the instructions, simulating itself as a USB keyboard and mouse, injecting control signals into the target device to achieve operation. Simultaneously, the video signal acquisition and processing module continuously captures screen images of the target device and provides feedback on the operation results, forming a complete "observation-decision-control" hardware closed loop.

[0049] During this phase, the combination of video capture and HID simulation channel enabled complete external control of the target machine without relying on the target machine's network services. This allowed the machine to handle various black-box scenarios, such as when the target machine has no network services or the system crashes, laying the foundation for subsequent forensic work.

[0050] During the channel optimization and enhancement phase, the task planning and execution module actively probes and attempts to establish a more efficient control channel during the control process. For example, on a Linux system, HID simulation is used to configure a temporary network and enable the SSH service. Specifically, the task planning and execution module calls the HID simulation control module to send commands to the target machine, executing network configuration commands (such as `sudo ifconfig eth0 192.168.1.100 netmask 255.255.255.0`) and SSH service startup commands (such as `sudo systemctl start ssh`) on the target machine. Simultaneously, the network communication module continuously monitors the target machine's network port status, and automatically establishes an SSH connection when port 22 (the default port for the SSH service) is detected to be open. Subsequently, the task planning and execution module sends the following command-line forensics commands (such as journalctl --since "7 days ago"| grep auth>auth.log, netstat -tulnp) to the target machine through the network communication module. The commands are executed through a high-speed and reliable SSH channel, and the data is directly transmitted back to the local forensics terminal.

[0051] Through collaborative work in this phase, the system can dynamically upgrade from a low-speed, general-purpose HID analog channel to a high-speed, dedicated network channel, greatly improving the efficiency of data transmission and command execution, reducing evidence collection time, and is especially suitable for evidence collection tasks that process large amounts of data.

[0052] During the hybrid execution phase, the system can maintain multiple control channels simultaneously. For example, while executing background data extraction commands via SSH, the video signal acquisition and processing module and the HID analog control module monitor the front end for interactive interfaces such as permission pop-ups. When a permission pop-up is detected, the video signal acquisition and processing module uploads the pop-up image to the cloud. The cloud-based large-scale model scheduling module calls the system's large-scale operation model to analyze the pop-up content, generate corresponding operation instructions, such as entering a password or clicking a confirmation button, and sends the instructions to the target machine via the HID analog control module for response.

[0053] The collaborative work during the hybrid execution phase enables the system to fully leverage the advantages of different control channels, ensuring efficient extraction of backend data while promptly addressing the interactive needs of the frontend interface. This improves the system's stability and reliability, ensuring the smooth progress of evidence collection.

[0054] During the report generation phase, the local forensic terminal's data storage and management module uploads all raw data (screenshots, operation logs, and extracted files) to the cloud. The report generation module receives this data and uses the cloud-based task planning and report generation model to analyze and process it. Based on user needs and preset report templates, it generates formatted report documents, such as Word or PDF reports, for investigators to review.

[0055] Through the collaborative work of its various modules, the system can automatically integrate and analyze the evidence collection results, generate detailed and accurate reports, provide investigators with strong evidentiary support, and improve the efficiency and quality of evidence collection.

[0056] Example 2 For Windows systems, after gaining initial control, a pre-compiled, lightweight agent program (such as a static executable file written in Go) can be copied to the target machine and run using HID and file transfer functions.

[0057] After the HID emulation control module and file transfer function of the local forensics terminal copy the agent program to the target machine, the agent program is launched through HID emulation. The agent program communicates with the forensics terminal via an encrypted network connection, receiving structured commands such as "read registry path HKLM...", "enumerate process list", and "package specified directory files". Based on the received commands, the agent program executes the corresponding operations on the target machine and sends the returned structured data back to the local forensics terminal via the network connection. After this, the local forensics terminal can eliminate its reliance on a graphical interface and communicate with the target machine via the agent program to obtain structured data, greatly improving the efficiency and reliability of data extraction.

[0058] The application of the agent program realizes the paradigm shift from "unstructured visual control" to "structured data communication", enabling the system to obtain more in-depth information about the target machine. It is especially suitable for deep forensics of complex systems and improves the system's versatility and adaptability.

[0059] The above content is merely an embodiment of the present invention. Commonly known structures and characteristics of the solutions are not described in detail here. Those skilled in the art are aware of all common technical knowledge in the field prior to the application date or priority date, are aware of all prior art in that field, and have the ability to apply conventional experimental methods prior to that date. Those skilled in the art can improve and implement this solution based on the guidance provided in this application and their own capabilities. Some typical well-known structures or systems should not be obstacles for those skilled in the art to implement this application. It should be noted that those skilled in the art can make several modifications and improvements without departing from the structure of the present invention. These should also be considered within the scope of protection of the present invention, and will not affect the effectiveness of the implementation of the present invention or the practicality of the patent. The scope of protection claimed in this application should be determined by the content of its claims, and the specific embodiments described in the specification can be used to interpret the content of the claims.

Claims

1. An automated intelligent evidence collection system based on cloud-edge collaboration and multi-channel control, characterized in that, include: The video signal acquisition and processing module is used to capture real-time screen images of the target machine and upload them to the cloud-based intelligent dispatch center after preprocessing the images. The HID simulation control module is used to simulate the local evidence collection terminal as an input device, receive operation instructions sent from the cloud and inject control signals into the target machine; The network communication module is used to establish a network connection with the target machine through the network interface for data transmission and command execution, as well as to communicate with the cloud-based intelligent dispatch center. The cloud-based large model scheduling module is used to dynamically call the cloud-integrated large language model according to the task stage, analyze the screen image and generate simulated operation instructions, or plan tasks for evidence collection needs. The task planning and execution module is used to decompose the evidence collection requirements into a sequence of task steps, and call the corresponding module to perform the evidence collection operation according to the control channel selected by the system. The data storage and management module is used to store and manage the data obtained during the evidence collection process. The report generation module is used to integrate and analyze the evidence collection results and generate formatted reports.

2. The automatic intelligent evidence collection system based on cloud-edge collaboration and multi-channel control according to claim 1, characterized in that, The video signal acquisition and processing module captures real-time screen images of the target device through the video input interface, which is an HDMI input port. The USB interface is a Type-C interface that supports USB OTG, and the network interface includes a Gigabit Ethernet port and a Wi-Fi / Bluetooth module.

3. The automatic intelligent evidence collection system based on cloud-edge collaboration and multi-channel control according to claim 1, characterized in that, The video signal acquisition and processing module receives the video signal from the target device via an HDMI cable, converts the analog signal into a digital signal using an image acquisition chip, and preprocesses the digital image using an image processing library, including noise reduction and enhancement operations.

4. The automatic intelligent evidence collection system based on cloud-edge collaboration and multi-channel control according to claim 1, characterized in that, The HID simulation control module enables the local forensic terminal to simulate the device identifiers and communication protocols of a keyboard and mouse by writing drivers and applications. It converts input characters into keyboard scan codes or mouse operation information into mouse data packets, which are then sent to the target machine via the USB interface.

5. The automatic intelligent evidence collection system based on cloud-edge collaboration and multi-channel control according to claim 1, characterized in that, The network communication module uses the TCP / IP protocol for data transmission and establishes a TCP connection through a three-way handshake process.

6. The automatic intelligent evidence collection system based on cloud-edge collaboration and multi-channel control according to claim 1, characterized in that, The cloud-based large model scheduling module receives task requests and data uploaded by local forensic terminals through API interfaces. It selects a large language model for processing based on the task type and stage, including: calling the system operation large model to analyze screen images to identify graphical user interface elements and generate simulated operation instructions, and calling the task planning and report generation large model to decompose the user's advanced forensic needs into a detailed sequence of steps.

7. The automatic intelligent evidence collection system based on cloud-edge collaboration and multi-channel control according to claim 1, characterized in that, The data storage and management module sets up data storage areas on both the local evidence collection terminal and the cloud, uses a database management system to store and manage the data, creates an independent data storage directory for each evidence collection task, and records the metadata of the data in the database.

8. The automatic intelligent evidence collection system based on cloud-edge collaboration and multi-channel control according to claim 1, characterized in that, The task planning and execution module calls the corresponding functional modules to execute tasks based on the control channel currently selected by the system. The control channels include the video acquisition and HID simulation channel and the SSH connection channel.

9. The automatic intelligent evidence collection system based on cloud-edge collaboration and multi-channel control according to claim 1, characterized in that, The system collaboratively conducts evidence collection through the following stages: During the initial access and exploration phase, the local forensic terminal captures real-time screen images of the target machine and uploads them to the cloud. The cloud-based large model scheduling module calls the system's large model to analyze the screen images and generate simulated operation commands. The HID simulation control module injects control signals into the target machine while continuously capturing screen images to provide feedback on the operation results. During the channel optimization and enhancement phase, the task planning and execution module actively detects and attempts to establish a control channel. It configures the network and enables the SSH service on the target machine through HID simulation. When the SSH service port is detected to be open, an SSH connection is automatically established, and subsequent command-line forensics commands are executed through the SSH channel. During the hybrid execution phase, the system maintains multiple control channels simultaneously. While executing background data extraction commands via SSH, it monitors the front-end interface through the video signal acquisition and processing module and the HID analog control module. When an interface requiring interaction is detected, the interface image is uploaded to the cloud for analysis and operation instructions are generated, which are then responded to through the HID analog control module. During the report generation phase, the data storage and management module uploads the raw data to the cloud, and the report generation module calls the large model to analyze and process the data to generate a formatted report.

10. The automatic intelligent evidence collection system based on cloud-edge collaboration and multi-channel control according to claim 1, characterized in that, After gaining initial control, the pre-compiled lightweight agent program is copied to the target machine and run through the HID simulation control module and file transfer function. The agent program communicates with the local forensics terminal through an encrypted network connection, receives structured commands and executes corresponding operations, and returns structured data to the local forensics terminal.

Images