A large model-based electronic forensics data intelligent question and answer analysis method and system

Abstract

This application proposes an intelligent question-answering analysis method and system for electronic evidence data based on a large model. The large model inputs user requests for intent recognition. Based on the intent recognition results, the large model invokes a case knowledge base, a big data analysis function invocation module, and a Text2SQL module for intelligent question-answering analysis. The Text2SQL module semantically supplements and understands the user's colloquial query requests, correcting the intent recognition results. The big data analysis function invocation module routes user requests to the corresponding function categories based on the content characteristics of the user requests and executes the invocation. The case knowledge base optimizes and sorts the search results and summarizes the results using the Retrieval Enhancement Generation (RAG) technique. The evaluation agent in the dynamic fence module performs quality assessment on the question-answering analysis results and returns a satisfactory result. This application significantly improves the accuracy of electronic evidence collection systems in locating relevant case data and reduces the complexity of electronic evidence collection work.

Description

Technical Field

[0001] This application relates to the fields of artificial intelligence and big data analysis technology, specifically to an intelligent question-answering analysis method and system for electronic forensics data based on a large model. Background Technology

[0002] Traditional electronic forensics data question-answering analysis methods mostly employ Text2SQL technology. Text2SQL aims to convert user-input natural language text into SQL (SQL) database query language through Natural Language Processing (NLP) techniques, thereby enabling interactive natural language query functions. However, this technology is prone to errors when handling special semantics and complex scenarios, especially when dealing with colloquial user queries. User natural language queries are often quite colloquial, and if the system does not correct the user's intent, it is easy to generate incorrect SQL queries, leading to inaccurate results or the omission of key information.

[0003] Existing knowledge base systems typically store raw data and its corresponding vector information through simple text splitting, resulting in low recall rates. Because the retrieval process fails to adequately consider the diversity and semantic differences of user queries, it cannot effectively retrieve data relevant to the questions. Although electronic data forensics involves numerous knowledge bases and technical details, a standardized RAG architecture has yet to be established. Existing research largely focuses on single retrieval or generation models, with few systematic frameworks combining the two. Balancing the complexities of law, technology, and evidence remains a pressing challenge in electronic data forensics tasks.

[0004] The Function Call mechanism is an important technology introduced by large language model platforms in recent years. This mechanism allows models to dynamically call external APIs or functions during the answer generation process to access external systems such as databases and analysis interfaces. However, existing intelligent question-answering analysis systems for electronic evidence data have insufficient coverage of function call scenarios, typically only supporting single-point queries and lacking the ability to adapt to and handle complex scenarios (such as dynamic routing and query scenarios of different business types). How to effectively combine the function call mechanism with the specific context of a case and deeply integrate it with the specific situation of the case is one of the urgent problems that existing intelligent question-answering analysis technologies need to solve.

[0005] In addition, existing question-answering analysis systems lack an effective output evaluation mechanism when generating query results, which may generate results that do not match the actual situation (i.e., model illusion). In other words, existing systems lack relevant mechanisms for detecting and correcting results.

[0006] To address the aforementioned issues, this application proposes an intelligent question-answering analysis method and system for electronic forensics data based on a large model. Summary of the Invention

[0007] This application addresses one or more technical deficiencies in the prior art by proposing the following technical solution.

[0008] Based on the first aspect of this application, an intelligent question-and-answer analysis system for electronic evidence data based on a large model is proposed, including a case knowledge base, a big data analysis function call module, a Text2SQL module, and a dynamic fence module; The user request is input into the large model to perform intent recognition, and the intent recognition result is obtained. Based on the intent recognition result, the large model calls the case knowledge base, the big data analysis function calling module and the Text2SQL module to perform intelligent question answering analysis, and obtain the question answering analysis result. The case knowledge base breaks down user requests, performs structured and vectorized processing on electronic evidence data, and stores it in an Elasticsearch database; the Text2SQL module performs semantic supplementation and intent understanding on users' colloquial query requests, and corrects the intent recognition results; the big data analysis function call module routes user requests to the corresponding function categories and executes the calls based on the content characteristics of the user requests, and the system uses the KNN search algorithm to search the case knowledge base to obtain question-and-answer analysis results; The dynamic fence module performs a quality assessment on the question-and-answer analysis results. If the quality assessment fails, the case knowledge base, the big data analysis function call module, and the Text2SQL module are called again to perform intelligent question-and-answer analysis until the question-and-answer analysis results meet the quality assessment standards. The qualified question-and-answer analysis results are then returned to the user.

[0009] This application constructs a case-level individual knowledge base, introduces the search enhancement generation technology RAG and the big data analysis function call module collaborative mechanism, optimizes the Text2SQL generation logic, and designs a dynamic fence evaluation intelligent agent, achieving accurate question-answering intelligent analysis based on massive electronic evidence data, realizing multi-path processing of user requests, reducing the complexity of electronic evidence collection work, improving case handling efficiency, and enhancing the ability to accurately extract and locate case-related data.

[0010] Furthermore, the case knowledge base is used to store and structure electronic evidence data. Different question expressions are preset for each type of structured electronic evidence data. A vectorization model is called to concatenate the question expressions into text and perform vector conversion. The vectorized and structured electronic evidence data is stored in an Elasticsearch database. Data summarization and intelligent question answering analysis are performed by combining vector retrieval with a large model.

[0011] This step significantly improves the knowledge base's coverage and recall of diverse and colloquial user questions, and enables data summarization and question answering based on the Retrieval Enhancement Generation (RAG) technology, making the system more accurate and interpretable when answering complex and multidimensional questions.

[0012] Furthermore, the electronic evidence data includes the suspect's basic information, communication analysis data, fund flow analysis data, and activity trajectory information.

[0013] Furthermore, the big data analysis function call module writes prompt words and dynamically configures them for different function categories, including fund query functions, bill analysis functions, and trajectory tracking functions.

[0014] This step enables the system to flexibly respond to complex, multi-step data analysis needs, improves the scenario adaptability of function calls and query efficiency, and is suitable for cross-system and cross-interface electronic evidence collection scenarios.

[0015] Furthermore, for scenarios where single-case queries are extended to multi-case queries, the Text2SQL module automatically identifies and filters relevant case data tables based on the table filtering mechanism of the large model, supplements the case ID and related information in the prompt words and embeds them into the SQL query conditions to generate SQL statements.

[0016] Based on a second aspect of this application, a method for intelligent question-answering analysis using the system described above is also proposed, comprising: S1: Input user requests into the large model to perform intent recognition, obtain intent recognition results, and the large model calls the case knowledge base, the big data analysis function calling module and the Text2SQL module to perform intelligent question answering analysis based on the intent recognition results; S2: The Text2SQL module combines the case background and user identity characteristics to semantically supplement and understand the user's colloquial query requests, and corrects the intent recognition results; S3: The big data analysis function call module writes prompt word templates for different function categories and dynamically configures them, routes user requests to the corresponding function categories and executes the call based on the content characteristics of the user requests; S4: The case knowledge base uses the KNN search algorithm to perform scalar retrieval of user requests from the dimensions of case, personnel, and collection, obtains electronic evidence data of the relevant persons in the user request, optimizes and sorts the retrieval results according to the request question, and uses the search enhancement generation technology RAG to summarize the question and answer analysis results. S5: The evaluation agent in the dynamic fence module performs a quality assessment on the question-and-answer analysis results and returns the question-and-answer analysis results that pass the quality assessment to the user.

[0017] Furthermore, before step S2, the method further includes: the case knowledge base performs structured processing on the electronic evidence data, pre-sets different question expressions for each type of processed electronic evidence data, concatenates the question expressions into a text segment using a vectorization model and performs vector conversion, and stores the structured and vectorized electronic evidence data into an Elasticsearch database.

[0018] Furthermore, for scenarios where single-case queries are extended to multi-case queries, the Text2SQL module automatically identifies and filters relevant case data tables based on the table filtering mechanism of a large model. It supplements the case ID and related information in the prompt words and embeds them into the SQL query conditions to generate SQL statements for querying and obtain intelligent question-and-answer analysis results.

[0019] This step enhances the accuracy and contextual relevance of SQL statements, effectively avoiding query confusion caused by case overlap and data redundancy, and improving the system's practicality in cross-case analysis.

[0020] Furthermore, in step S5, the evaluation agent performs a quality assessment on the accuracy, relevance, and completeness of the question-and-answer analysis results. If the quality assessment fails, the case knowledge base, the big data analysis function call module, and the Text2SQL module are called again to perform intelligent question-and-answer analysis until the question-and-answer analysis results meet the quality assessment standards. The question-and-answer analysis results that meet the quality assessment standards are then summarized through a reasoning model.

[0021] This step effectively suppresses model illusions through the dynamic fence module, improving the robustness of the system, the credibility of the results, and the level of intelligence in electronic forensic data analysis.

[0022] Based on a third aspect of this application, a computer program product is also proposed, having one or more computer programs thereon that, when executed by a computer processor, implement the method described above.

[0023] The technical advantages of this application are as follows: By constructing a case-level individual knowledge base, introducing the search enhancement generation technology RAG and the big data analysis function call module collaborative mechanism, optimizing the Text2SQL generation logic, and designing a dynamic fence intelligent agent, this application realizes accurate question-and-answer intelligent analysis of multi-dimensional electronic evidence data, simplifies the analysis and summary process for case handlers when facing massive amounts of electronic evidence data, effectively reduces the complexity of electronic evidence collection, significantly improves the efficiency of electronic evidence collection, and enhances the ability to accurately extract and locate case-related data. Attached Figure Description

[0024] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings.

[0025] Figure 1 This is a block diagram of an intelligent question-and-answer analysis system for electronic forensics data based on a large model, provided according to an embodiment of this application.

[0026] Figure 2 This is a processing logic diagram of an intelligent question-answering analysis system for electronic forensics data based on a large model, provided according to an embodiment of this application.

[0027] Figure 3 This is a flowchart of an intelligent question-answering analysis method for electronic forensics data based on a large model, provided according to an embodiment of this application.

[0028] Figure 4 This is a schematic diagram of the structure of a computer system suitable for implementing the electronic devices of the present application embodiments. Detailed Implementation

[0029] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0030] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0031] Figure 1 This application illustrates an intelligent question-and-answer analysis system for electronic evidence data based on a large model, including a case knowledge base (a), a big data analysis function calling module (b), a Text2SQL module (c), and a dynamic fence module (d). The user request is input into the large model to perform intent recognition, and the intent recognition result is obtained. Based on the intent recognition result, the large model calls the case knowledge base a, the big data analysis function call module b, and the Text2SQL module c to perform intelligent question answering analysis, and obtain the question answering analysis result. The case knowledge base a breaks down user requests, performs structured and vectorized processing on electronic evidence data, and stores it in an Elasticsearch database; the Text2SQL module c performs semantic supplementation and intent understanding on users' colloquial query requests, and corrects the intent recognition results; the big data analysis function call module b routes user requests to the corresponding function categories and executes the calls based on the content characteristics of the user requests, and the system uses the KNN search algorithm to search in the case knowledge base a to obtain question-and-answer analysis results; The dynamic fence module d performs a quality assessment on the question-and-answer analysis results. If the quality assessment fails, the case knowledge base a, the big data analysis function call module b, and the Text2SQL module c are called again to perform intelligent question-and-answer analysis until the question-and-answer analysis results meet the quality assessment standards. The qualified question-and-answer analysis results are then returned to the user.

[0032] It should be noted that this application constructs a case-level single-person knowledge base, introduces the search enhancement generation technology RAG and the big data analysis function call module collaborative mechanism, optimizes the Text2SQL generation logic, and designs a dynamic fence evaluation intelligent agent, achieving accurate question-and-answer intelligent analysis based on massive electronic evidence data, realizing multi-path processing of user requests, reducing the complexity of evidence collection work, improving case handling efficiency, and enhancing the ability to accurately extract and locate case-related data.

[0033] It should be noted that the case knowledge base is used to store and structure electronic evidence data. Different question expressions are preset for each type of structured electronic evidence data. The vectorization model is called to concatenate the question expressions into text and perform vector conversion. The vectorized and structured electronic evidence data is stored in the Elasticsearch database. The data is summarized and intelligently analyzed by combining vector retrieval with a large model.

[0034] It should be noted that this step significantly improves the knowledge base's coverage and recall of diverse and colloquial user questions, and enables data summarization and question answering based on the Retrieval Enhancement Generation (RAG) technology, making the system more accurate and interpretable when answering complex and multidimensional questions.

[0035] It should be noted that the electronic evidence data includes the suspect's basic information, communication analysis data, fund flow analysis data, and activity trajectory information.

[0036] It should be noted that the big data analysis function call module writes prompt words and dynamically configures them for different function categories, including fund query functions, bill analysis functions, and trajectory tracking functions.

[0037] It should be noted that this step enables the system to flexibly respond to complex and multi-step data analysis needs, improves the scenario adaptability of function calls and query efficiency, and is suitable for cross-system and cross-interface electronic evidence collection scenarios.

[0038] It should be noted that, for scenarios where single-case queries are extended to multi-case queries, the Text2SQL module automatically identifies and filters relevant case data tables based on the table filtering mechanism of the large model, supplements the case ID and related information in the prompt words and embeds them into the SQL query conditions to generate SQL statements.

[0039] It should be noted that the processing logic of the system is as follows: Figure 2 As shown, before a user makes a query request, the electronic evidence data undergoes data cleaning, text segmentation, data chunking, vectorization, and scalarization. After being correlated, the electronic evidence data is stored in an Elasticsearch database, and B-tree indexes, inverted indexes, and vector indexes are built to support efficient hybrid retrieval. When a user initiates a query request, they input a natural language question. The system extracts the question keywords and converts them into vector representations. Keyword retrieval and vector retrieval are performed, and the results are filtered in conjunction with filtering conditions. The results are then merged and reordered, and detailed results and a result summary are returned to the user.

[0040] In a specific embodiment, the case knowledge base will perform structured extraction and in-depth characterization of the suspect's case information and related electronic evidence data, and perform standard structured processing on common electronic evidence data in the case investigation process, unifying it into JSON format. All field names of JSON objects use standardized Chinese naming to ensure readability and standardization. The electronic evidence data includes, but is not limited to, the suspect's basic information (such as name, age, and ID number), communication analysis data (call records and social networks), fund flow analysis data (bank transactions and electronic payments), and activity trajectory overview (accommodation records and travel information). The above-mentioned electronic evidence data is vectorized and embedded. A knowledge base table is established based on the case dimension and the personnel dimension. The above-mentioned electronic evidence data is presented with different question expressions from different angles according to the data type. For example, for the "suspect's age" field, the preset question expressions include: "How old is the suspect?", "How old was the suspect at the time of the crime?", and "What was the year of birth?". The question descriptions are concatenated into a text using a vectorization model and then transformed into vectors. The generated vector data and the processed structured data are stored in the Elasticsearch database, as shown in Table 1. During the query phase, scalar retrieval is performed to retrieve the processed data related to the query request based on the case, personnel, and collection dimensions. The retrieval results are then optimized and sorted according to the question and the reordering model. At the same time, a language model is used to enhance the generative data summary.

[0041] Table 1 Knowledge Base Tables

[0042] In a specific embodiment, when the system receives a conversational question, it combines multiple dimensions such as case background information and the identity characteristics of the questioner to perform semantic correction and standardization on the question, and then performs Text2SQL conversion. When processing time-related queries, it uses time processing functions in NLP technology to accurately parse and standardize the ambiguous time expressions (such as "today", "tomorrow" and "before the incident") in the question. Secondly, in response to the change in scenarios from single-case queries to multi-case queries, this application proposes a table filtering mechanism based on a large model, which can automatically identify and filter case data tables related to the query. In terms of prompt word engineering, the system will intelligently supplement key information (such as case ID or collection ID), and the large model will correctly embed key information identifiers into the query conditions when generating the final SQL statement to ensure the accuracy and completeness of the query results, significantly improving the system's performance in multi-case related query scenarios.

[0043] In specific embodiments, the function call mechanism of the big data analysis function call module mainly focuses on handling dynamic parameters and step-by-step data acquisition scenarios. Complex data is acquired and summarized through multi-step function calls. This application designs interfaces for the following typical application scenarios: acquiring data within a specific time range, meeting specific query requirements, and processing data that is not the user's own data. Dynamic acquisition and intelligent summarization of data are achieved through a predefined function call mechanism. Specific query requirements for application scenarios include: "What places did Zhang San and Li Si frequently visit together during a specific time period; "All the commonly used phone numbers registered by Zhang San's mother in her address book; "Zhang San's activity trajectory and frequently visited places in the 72 hours before the incident;" and "Information on Zhang San's companions and cohabitants during the period related to the incident (including the three days before and after the incident);" To address the aforementioned query requirements and similar issues raised by other users, query requirements are categorized into different function call tools based on data type. These categorized query requirements are then provided to the large language model and processed via function calls in a configurable manner. Specific prompt word templates are written for different types of query requirements, and dynamic configuration of the calling methods is supported. The system categorizes function call tools into fund query functions, bill analysis functions, and trajectory tracking functions. The AI ​​model automatically routes the request to the corresponding function category based on the content characteristics of the user's query request and executes the corresponding function call.

[0044] It should be noted that the dynamic routing mechanism enables the system to flexibly respond to different types of query requirements while maintaining the efficiency and accuracy of function calls. Each function category contains a specific set of data processing methods. The large model selects the most appropriate function to call based on the semantic features of the query content, which can ensure the accuracy and completeness of the returned results.

[0045] It should be noted that each user's question response is evaluated by an assessment agent. The assessment agent analyzes the question-and-answer content to determine whether it meets the customer's requirements. If it does, the response is returned to the front end; otherwise, a new query is performed to obtain data for model reasoning and summarization. The specific implementation logic of the dynamic fence module is as follows: When a user submits a natural language query, the intelligent question-answering analysis system generates a preliminary answer and returns preliminary query results. An evaluation agent assesses the quality of these results (specifically, accuracy, relevance, and completeness). Based on the evaluation results, the intelligent question-answering analysis system determines whether the user's requirements are met. If the evaluation passes, the data is directly returned to the user. If the evaluation fails, the query is re-executed to obtain new data, ensuring that the content retrieved from the data source is more accurate and comprehensive. The new data is then summarized and processed using an inference model to ensure that the returned data meets the user's requirements. Finally, the evaluated intelligent question-answering analysis system returns the final data to the front end for display.

[0046] The following is for reference. Figure 3 It demonstrates a method for intelligent question-answering analysis based on the system described above, including: S1: Input user requests into the large model to perform intent recognition, obtain intent recognition results, and the large model calls the case knowledge base, the big data analysis function calling module and the Text2SQL module to perform intelligent question answering analysis based on the intent recognition results; S2: The Text2SQL module combines the case background and user identity characteristics to semantically supplement and understand the user's colloquial query requests, and corrects the intent recognition results; S3: The big data analysis function call module writes prompt word templates for different function categories and dynamically configures them, routes user requests to the corresponding function categories and executes the call based on the content characteristics of the user requests; S4: The case knowledge base uses the KNN search algorithm to perform scalar retrieval of user requests from the dimensions of case, personnel, and collection, obtains electronic evidence data of the relevant persons in the user request, optimizes and sorts the retrieval results according to the request question, and uses the search enhancement generation technology RAG to summarize the question and answer analysis results. S5: The evaluation agent in the dynamic fence module performs a quality assessment on the question-and-answer analysis results and returns the question-and-answer analysis results that pass the quality assessment to the user.

[0047] It should be noted that before step S2, the following steps are also included: the case knowledge base performs structured processing on the electronic evidence data, presets different question expressions for each type of processed electronic evidence data, concatenates the question expressions into a text segment through a vectorization model and performs vector conversion, and stores the structured and vectorized electronic evidence data into the Elasticsearch database.

[0048] It should be noted that, for scenarios where single-case queries are extended to multi-case queries, the Text2SQL module automatically identifies and filters relevant case data tables based on the table filtering mechanism of the large model, supplements the case ID and related information in the prompt words and embeds them into the SQL query conditions, generates SQL statements for querying, and obtains intelligent question-answering analysis results.

[0049] It should be noted that this step enhances the accuracy and contextual relevance of SQL statements, effectively avoiding query confusion caused by case overlap and data redundancy, and improving the system's practicality in cross-case analysis.

[0050] It should be noted that in step S5, the evaluation agent performs a quality assessment on the accuracy, relevance, and completeness of the question-and-answer analysis results. If the quality assessment fails, the case knowledge base, the big data analysis function call module, and the Text2SQL module are called again to perform intelligent question-and-answer analysis until the question-and-answer analysis results meet the quality assessment standards. The question-and-answer analysis results that meet the quality assessment standards are then summarized through a reasoning model.

[0051] It should be noted that this step effectively suppresses model illusion through the dynamic fence module, improving the robustness of the system, the credibility of the results, and the level of intelligence in electronic forensic data analysis.

[0052] It should be noted that this application adds a user query intent recognition and correction function to the Text2SQL module. By using NLP algorithms to convert colloquial time phrases into standardized time formats and forcibly associating the relevant data tables with the case ID, it solves the problem that traditional Text2SQL is prone to errors when processing colloquial user queries, and significantly improves the accuracy of SQL generation and the relevance of query results.

[0053] It should be noted that, in response to the problem that existing knowledge bases cannot support multi-question retrieval, this application improves the recall rate of multi-question retrieval by splitting the case knowledge base entries into questions, generating multiple-dimensional versions of question descriptions, and performing vector processing. This ensures that data with higher relevance to the user's query is returned.

[0054] It should be noted that, in response to the situation where the generated query results in the prior art do not match the reality, this application adopts a dynamic fence evaluation mechanism. After generating intelligent question-answering analysis results, the reasonableness of the results is evaluated cyclically. If it is found that the answer does not meet the standard or expected results, the query is re-performed and new analysis results are generated, which greatly improves the accuracy and reliability of the query results.

[0055] It should be noted that, in response to the fact that existing technologies only support single-point queries and lack the ability to adapt to complex scenarios, this application designs multiple types of functions and uses model intent recognition for dynamic routing. When a user queries, it can intelligently route to different functions and execute them according to the specific business type of the question, thereby improving flexibility and adaptability, enabling it to handle more complex query requests, and also improving query efficiency.

[0056] The following is for reference. Figure 4 It shows a schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application. Figure 4 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0057] like Figure 4 As shown, the computer system includes a central processing unit (CPU) 401, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 402 or programs loaded from storage section 408 into random access memory (RAM) 403. RAM 403 also stores various programs and data required for system operation. CPU 401, ROM 402, and RAM 403 are interconnected via bus 404. Input / output (I / O) interface 405 is also connected to bus 404.

[0058] The following components are connected to I / O interface 405: an input section 406 including a keyboard, mouse, etc.; an output section 407 including a liquid crystal display (LCD) and speakers, etc.; a storage section 408 including a hard disk, etc.; and a communication section 409 including a network interface card such as a LAN card and a modem, etc. The communication section 409 performs communication processing via a network such as the Internet. Drive 410 is also connected to I / O interface 405 as needed. Removable media 411, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 410 as needed so that computer programs read from them can be installed into storage section 408 as needed.

[0059] Specifically, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable storage medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 409, and / or installed from removable medium 411. When the computer program is executed by central processing unit (CPU) 401, it performs the functions defined in the methods of this application. It should be noted that the computer-readable storage medium of this application can be a computer-readable signal medium or a computer-readable storage medium or any combination thereof. The computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable storage medium other than a computer-readable storage medium that can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. Program code contained on a computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0060] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages—such as Java, Smalltalk, and C++—as well as conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0061] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0062] The modules described in the embodiments of this application can be implemented in software or in hardware.

[0063] In another aspect, this application also provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by the electronic device, the electronic device performs the following actions: It inputs a user request into a large model for intent recognition, obtains the intent recognition result, and the large model, based on the intent recognition result, calls the case knowledge base, the big data analysis function call module, and the Text2SQL module for intelligent question-and-answer analysis. The Text2SQL module, combining case background and user identity characteristics, semantically supplements and understands the user's colloquial query request, correcting the intent recognition result. The big data analysis function call module writes prompt word templates for different function categories and dynamically configures them, routing the user request to the corresponding function category and executing the call based on the content characteristics of the user request. The case knowledge base performs scalar retrieval of the user request from the case, personnel, and collection dimensions using the KNN search algorithm, obtaining electronic evidence data of the person related to the user request, optimizing and ranking the retrieval results according to the request question, and summarizing the question-and-answer analysis results using the Retrieval Enhancement Generation (RAG) technology. The evaluation agent in the dynamic fence module performs quality assessment of the question-and-answer analysis results and returns the qualified question-and-answer analysis results to the user.

[0064] Finally, it should be noted that the above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described inventive concept. For example, technical solutions formed by substituting the above-described features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A smart question-answering analysis system for electronic forensics data based on a large model, characterized in that, This includes a case knowledge base, a big data analysis function call module, a Text2SQL module, and a dynamic fence module; The user request is input into the large model to perform intent recognition, and the intent recognition result is obtained. Based on the intent recognition result, the large model calls the case knowledge base, the big data analysis function calling module and the Text2SQL module to perform intelligent question answering analysis, and obtain the question answering analysis result. Specifically, the case knowledge base breaks down user requests, performs structured and vectorized processing on electronic evidence data, and stores it in an Elasticsearch database; the Text2SQL module performs semantic supplementation and intent understanding on users' colloquial query requests, and corrects the intent recognition results; the big data analysis function call module routes user requests to the corresponding function categories and executes the calls based on the content characteristics of the user requests, and the system uses the KNN search algorithm to search the case knowledge base to obtain question-and-answer analysis results; The dynamic fence module performs a quality assessment on the question-and-answer analysis results. If the quality assessment fails, the case knowledge base, the big data analysis function call module, and the Text2SQL module are called again to perform intelligent question-and-answer analysis until the question-and-answer analysis results meet the quality assessment standards. The qualified question-and-answer analysis results are then returned to the user.

2. The system according to claim 1, characterized in that, The case knowledge base is used to store and structure electronic evidence data. Different question expressions are preset for each type of structured electronic evidence data. The vectorization model is called to concatenate the question expressions into text and perform vector conversion. The vectorized and structured electronic evidence data is stored in the Elasticsearch database. The data is summarized and intelligently analyzed by combining vector retrieval and large models.

3. The system according to claim 2, characterized in that, The electronic evidence data includes the suspect's basic information, communication analysis data, fund flow analysis data, and activity trajectory information.

4. The system according to claim 1, characterized in that, The big data analysis function call module writes prompt words and dynamically configures them for different function categories, including fund query function, bill analysis function and trajectory tracking function.

5. The system according to claim 1, characterized in that, For scenarios where single-case queries are extended to multi-case queries, the Text2SQL module automatically identifies and filters relevant case data tables based on the table filtering mechanism of the large model, supplements the case ID and related information in the prompt words and embeds them into the SQL query conditions to generate SQL statements.

6. A method for intelligent question-answering analysis based on the system according to any one of claims 1-5, characterized in that, include: S1: Input user requests into the large model to perform intent recognition, obtain intent recognition results, and the large model calls the case knowledge base, the big data analysis function calling module and the Text2SQL module to perform intelligent question answering analysis based on the intent recognition results; S2: The Text2SQL module combines the case background and user identity characteristics to semantically supplement and understand the user's colloquial query requests, and corrects the intent recognition results; S3: The big data analysis function call module writes prompt word templates for different function categories and dynamically configures them, routes user requests to the corresponding function categories and executes the call based on the content characteristics of the user requests; S4: The case knowledge base uses the KNN search algorithm to perform scalar retrieval of user requests from the dimensions of case, personnel, and collection, obtains electronic evidence data related to the user requests, optimizes and sorts the retrieval results according to the request questions, and uses the search enhancement generation technology RAG to summarize the question-and-answer analysis results. S5: The evaluation agent in the dynamic fence module performs a quality assessment on the question-and-answer analysis results and returns the question-and-answer analysis results that pass the quality assessment to the user.

7. The method according to claim 6, characterized in that, Before step S2, the process also includes: the case knowledge base performs structured processing on the electronic evidence data, pre-sets different question expressions for each type of processed electronic evidence data, concatenates the question expressions into a text segment using a vectorization model and performs vector conversion, and stores the structured and vectorized electronic evidence data into an Elasticsearch database.

8. The method according to claim 6, characterized in that, For scenarios where single-case queries are extended to multi-case queries, the Text2SQL module automatically identifies and filters relevant case data tables based on the table filtering mechanism of a large model. It supplements the case ID and related information in the prompt words and embeds them into the SQL query conditions to generate SQL statements for querying and obtain intelligent question-answering analysis results.

9. The method according to claim 6, characterized in that, In step S5, the evaluation agent performs a quality assessment on the accuracy, relevance, and completeness of the question-and-answer analysis results. If the quality assessment fails, the case knowledge base, the big data analysis function call module, and the Text2SQL module are called again to perform intelligent question-and-answer analysis until the question-and-answer analysis results meet the quality assessment standards. The question-and-answer analysis results that meet the quality assessment standards are then summarized through a reasoning model.

10. A computer program product having one or more computer programs thereon, characterized in that, When the computer program is executed by a computer processor, the method described in any one of claims 6-9 is performed.

Images