Electronic evidence authenticity verification and communication evidence storage system based on visual feature matching

Abstract

The application discloses an electronic evidence authenticity verification and communication evidence storage system based on visual feature matching, comprising data acquisition, feature spectrum construction, constraint source analysis, tampering clustering, verification judgment and evidence storage interaction modules; receiving batch of electronic evidence images to be verified and calling a trusted benchmark original image set, which is spliced into a multi-dimensional feature spectrum matrix through multi-scale wavelet packet decomposition; taking the mean value of the trusted benchmark feature spectrum as a fixed original device source endomorphism, taking the exogenous tampering source endomorphism as an adaptive variable, applying non-negative and abundance and 1 constraints, and decoupling the original device source contribution spectrum and the exogenous tampering source contribution spectrum through the alternating least squares method; performing spectrum series clustering on the exogenous tampering source contribution spectrum to obtain a tampering cluster; performing three-level judgment of device homology, tampering existence and batch modification; generating a three-dimensional label verification report, constructing a Merkle tree with the tampering cluster as a unit, and batch chaining after encryption. The application realizes quantitative decoupling of device original noise and tampering traces, and the verification is accurate and interpretable.

Description

Technical Field

[0001] This invention relates to the field of electronic evidence collection and preservation technology, and in particular to an electronic evidence authenticity verification and communication evidence preservation system based on visual feature matching. Background Technology

[0002] With the widespread adoption of digital imaging technology and mobile internet, electronic images captured by devices such as law enforcement recorders, police terminals, and smartphones have become an important form of evidence in judicial practice, widely used in areas such as administrative law enforcement, criminal investigation, and e-commerce disputes. However, electronic images are inherently easy to copy and modify. With the help of image editing software and even generative artificial intelligence tools, ordinary users can seamlessly alter image content without possessing professional knowledge. The barrier to creating forged evidence is constantly lowering, making the verification of the authenticity of electronic evidence a crucial step in the judicial acceptance process.

[0003] Currently, the verification of the authenticity of electronic evidence mainly relies on forensic experts to manually examine the consistency of light and shadow, edge continuity, and other aspects of images based on their experience. This method is highly subjective and time-consuming, making it difficult to meet the needs of efficient review when faced with a large volume of evidence images entering law enforcement cases. To improve verification efficiency, automated analysis methods based on metadata and file formats have been developed in practice. These methods determine authenticity by checking the EXIF ​​information and compression history of images. However, such information is easily lost or forged after image transfer, screenshotting, or secondary compression, resulting in poor verification reliability. Building on this, digital forensics algorithms, such as sensor mode noise analysis and DCT coefficient analysis, are widely used. These methods extract statistical features from images as a whole. The inherent noise of the device and external traces introduced by tampering operations are mixed together in the feature space. This makes it impossible to quantitatively distinguish between the two independent verification dimensions of whether the image comes from the claimed device and whether the image content has been tampered with, and it is also difficult to explain the source of the features used to reach the judgment, resulting in high false positive and false negative rates. In recent years, deep learning-based tampering detection methods have gradually emerged. However, these methods rely on large-scale labeled samples for training, which limits their ability to generalize to new tampering tools not found in the training set. Furthermore, the network decision-making process is a black box, and the judgment conclusions lack the interpretability required by judicial practice.

[0004] In addition to the aforementioned shortcomings in the verification process itself, existing technologies also have deficiencies in the connection between verification and evidence storage. Existing blockchain evidence storage platforms can only guarantee that evidence will not be tampered with after it is uploaded to the chain, but cannot answer whether the evidence was authentic before it was uploaded to the chain. The verification conclusion and the evidence storage carrier are disconnected, and the evidence chain is incomplete. At the same time, existing verification systems process batch evidence in isolation, making it impossible to discover the homogeneity of multiple images that have been altered in batches by the same tampering tool, and making it difficult to identify organized batch forgery. The benchmark library on which verification depends is static and fixed, and cannot track the temporal drift of noise patterns caused by aging and temperature drift of device sensors. The accuracy of verification continues to decline after long-term operation. Moreover, the existing system has fixed requirements for computing power resources, making it difficult to run stably and continuously on low-computing-power edge terminals such as law enforcement tablets.

[0005] Therefore, how to quantitatively decouple the original characteristics of the device from the traces of tampering, realize the homology classification of batch evidence, and organically combine verification and evidence storage to adapt to the edge computing environment has become a technical problem that urgently needs to be solved in the field of electronic evidence authenticity verification. Summary of the Invention

[0006] This invention overcomes the shortcomings of the prior art and provides an electronic evidence authenticity verification and communication evidence storage system based on visual feature matching.

[0007] To achieve the above objectives, the technical solution adopted by the present invention is as follows: an electronic evidence authenticity verification and communication evidence storage system based on visual feature matching, comprising: a trusted benchmark acquisition and solidification module, a data acquisition module, a feature spectrum construction module, a constraint source analysis module, a tampering clustering module, a verification and judgment module, and an evidence storage interaction module;

[0008] The trusted benchmark acquisition and solidification module is used to execute a standardized benchmark image acquisition process during the registration of evidence collection devices, and to generate and solidify a trusted benchmark native image set and its legal supporting documents.

[0009] The data acquisition module is used to receive batches of electronic evidence images to be verified via streaming, and retrieve the trusted benchmark native image set from the evidence storage platform through a secure channel.

[0010] The feature spectrum construction module is used to perform multi-scale wavelet packet decomposition on the electronic evidence image to be verified, extract sensor noise, edge residuals and texture perturbations, and then standardize and splice them to generate a multi-dimensional feature spectrum matrix. The same processing is performed on the original image set of the credible benchmark to obtain the credible benchmark feature spectrum matrix.

[0011] The constraint source parsing module takes the multidimensional feature spectrum matrix as input, the mean of the reliable benchmark feature spectrum matrix as a fixed native device source end-member, sets the external tampering source end-member as an adaptive iterative variable, applies non-negative constraints and abundance sum to 1 constraints, and solves the problem by alternating least squares method, outputting the native device source contribution spectrum and the external tampering source contribution spectrum.

[0012] The tampering clustering module is used to collect the contribution spectrum of the external tampering sources to construct the tampering source feature spectrum, and to use minimum spanning tree spectrum clustering to perform homology classification to generate tampering clusters corresponding to different tampering tools;

[0013] The verification and judgment module calculates the similarity between the original device source contribution spectrum and the original device source endmember to obtain the device homology. It judges whether there is tampering based on the energy proportion of the external tampering source contribution spectrum, and measures the phylogenetic distance between the tampered image and the cluster center spectrum of its tampering cluster to determine the batch alteration.

[0014] The evidence storage interaction module generates a three-dimensional label verification report with the homology of the attached devices, the proportion of tampering contribution, and the attribution of the tampered clusters. It constructs a Merkle tree indexed evidence storage structure with the tampered clusters as units, and uploads it to the evidence storage platform in batches after being encrypted by the national cryptographic algorithm.

[0015] In a preferred embodiment of the present invention, the trusted benchmark acquisition and solidification module initiates a standardized acquisition process during the initial registration or periodic calibration of the evidence collection device. This acquisition process is performed by qualified operators who, under standard environmental conditions meeting requirements such as lighting and background, control the evidence collection device to capture a predetermined number of test images. The acquisition process is recorded in its entirety via video recording, and the acquisition time, personnel, device identification, and environmental parameters are recorded as metadata. After acquisition, the hash value of all test images is immediately calculated, and the test images, hash values, and metadata are packaged to generate a benchmark data package. Blockchain technology is used to store and solidify the hash value of the benchmark data package, ensuring the immutability of the benchmark image set from its inception. Simultaneously, a benchmark image acquisition and solidification certificate is generated as a necessary attachment to subsequent verification reports, constituting the legitimate starting point of the electronic evidence verification chain.

[0016] In a preferred embodiment of the present invention, the data acquisition module continuously receives batches of electronic evidence images to be verified uploaded by on-site law enforcement terminals via a streaming data interface. Each batch of these electronic evidence images is appended with a timestamp, a unique device identifier, and a case number to form evidence metadata. Upon receiving images, the system mandates the entry or association of a regulatory chain information, which includes the operator's ID, operation type, and operation time, forming a key behavior log. When evidence enters the system, the system immediately calculates its hash value and compares it with the original hash value recorded locally on the law enforcement terminal. If the comparison is inconsistent, a transmission anomaly alarm is issued. After successful comparison, the regulatory chain information, as part of the evidence metadata, is ultimately uploaded to the blockchain for evidence storage.

[0017] The data acquisition module establishes a secure channel with two-way identity authentication with the evidence storage platform based on a preset certificate system, and sends a reference retrieval request carrying the device's unique identifier to the evidence storage platform through the secure channel.

[0018] The evidence storage platform retrieves and returns a set of trusted baseline raw images collected during the device's registration and without any post-processing, based on the device's unique identifier.

[0019] After receiving the trusted benchmark native image set, the data acquisition module performs format unification and resolution normalization processing on the trusted benchmark native image set and the electronic evidence image to be verified.

[0020] In a preferred embodiment of the present invention, the feature spectrum construction module performs three-level wavelet packet decomposition on each of the electronic evidence images to be verified to obtain low-frequency approximate subbands and high-frequency detail subbands in the horizontal, vertical and diagonal directions;

[0021] The low-frequency approximate subband input sensor noise extraction filter separates the inherent noise mode of the device to obtain sensor noise; the high-frequency detail subband input edge residual extraction filter captures boundary inconsistencies to obtain edge residual; and the all subband input texture perturbation extraction filter detects local statistical anomalies to obtain texture perturbation.

[0022] Z-score normalization is applied to the sensor noise, the edge residual, and the texture perturbation to eliminate the dimensional differences between different feature components.

[0023] The standardized three types of feature components are concatenated into a one-dimensional feature vector according to the frequency dimension, and then all one-dimensional feature vectors are stacked according to the spatial dimension to form the multi-dimensional feature spectrum matrix.

[0024] The same process is performed on the original image set of the trusted benchmark to obtain the trusted benchmark feature spectrum matrix.

[0025] In a preferred embodiment of the present invention, the column mean vector of the trusted benchmark feature spectrum matrix is ​​calculated by the constraint source parsing module as the native device source endmember and remains fixed during iteration;

[0026] A non-negative matrix is ​​randomly initialized as the starting value of the externally tampered source end-member;

[0027] Construct an objective function that includes a data fitting term and a constraint penalty term. The data fitting term is the square of the Frobenius norm of the sum of the abundance matrix and the sum of the two endmembers of the multidimensional feature spectrum matrix. The constraint penalty term includes Lagrange multipliers with an abundance sum of 1 constraint and a non-negativity constraint.

[0028] The process is divided into two stages: first, solving for the abundance matrix by fixing the externally tampered source endmembers; and second, updating the externally tampered source endmembers by fixing the abundance matrix. The two stages are executed alternately until the rate of change of the objective function is lower than a preset convergence threshold.

[0029] The native device source contribution spectrum and the external tampering source contribution spectrum are separated from the final abundance matrix.

[0030] In a preferred embodiment of the present invention, the tampering clustering module collects the contribution spectra of all external tampering sources and calculates the Euclidean distance between any two to construct a fully connected distance matrix;

[0031] Using the fully connected distance matrix as input, the minimum spanning tree algorithm is executed. Edges with the largest weights are cut off in descending order of edge weight until the number of subtrees reaches the preset number of tampering tool types or the weight of the cut edges is less than the preset inter-cluster distance threshold. Each subtree corresponds to one tampering cluster.

[0032] The mean vector of all external tampering source contribution spectra within each tampering cluster is calculated as the cluster center spectrum. When a new image is added, the converged constrained source analysis model is called to perform eigenvalue decomposition to obtain the contribution spectrum of the new external tampering source. The phylogenetic distance between the new image and each cluster center spectrum is calculated, and the image is assigned to the tampering cluster with the smallest phylogenetic distance. The cluster center spectrum is updated using the incremental mean formula.

[0033] If the phylogenetic distances are all greater than the preset classification threshold, a new tampering cluster is created with the newly added external tampering source contribution spectrum as the initial center.

[0034] In a preferred embodiment of the present invention, the verification and judgment module performs a three-level judgment on each of the electronic evidence images to be verified;

[0035] The first level is device homology judgment, which calculates the cosine similarity between the source contribution spectrum of the native device and the source endmember of the native device as the device homology. If it is greater than the preset homology threshold, it is determined that the native image set of the trusted benchmark comes from the same device.

[0036] The second level is the determination of tampering existence. The ratio of the L2 norm of the contribution spectrum of the external tampering source to the norm of the total feature energy of the corresponding image is calculated as the tampering contribution ratio. If it exceeds the preset tampering threshold, it is determined that there is external tampering.

[0037] The third level is batch alteration judgment. For images that are determined to have been tampered with, the Euclidean distance between the contribution spectrum of the external tampering source and the cluster center spectrum of the tampering cluster to which the image belongs is calculated as the phylogenetic distance. If it is less than the preset same-source tool threshold, it is determined that the image and other images in the cluster were batch altered by the same tampering tool.

[0038] The summation of the device homology, the percentage of tampering contribution, and the attribution of the tampered clusters constitutes the structured verification results.

[0039] In a preferred embodiment of the present invention, the evidence storage interaction module generates a three-dimensional label verification report with attached device homology, tamper contribution ratio, and tamper cluster affiliation. The verification report includes a legally friendly interpretation section, which transforms the quantitative indicators such as device homology and tamper contribution ratio into legal conclusive opinions. Specifically, it includes: based on the preset numerical range of the device homology, it gives a qualitative conclusion of "highly probable from the same device," "highly probable from the same device," or "cannot be determined to be from the same device." The basis for setting the preset numerical range and judgment threshold is attached to the report as an appendix. The appendix records statistical false positive and false negative rate data or industry standard references to prove its scientificity and reliability. The verification report also includes a visual tamper location map, which marks the specific areas judged as tampered and the reasons for the judgment.

[0040] In a preferred embodiment of the present invention, the evidence storage interaction module serializes three data items—device homology, tampering contribution ratio, and tampering cluster affiliation—of each image into leaf node data blocks in a fixed order for all images within each tampering cluster.

[0041] The SHA-256 hash algorithm is used to calculate the hash value of each leaf node data block to obtain the leaf hash. The hash value of the parent node is calculated again after pairing two adjacent leaf hashes. The calculation is recursively performed layer by layer until a unique root hash value is generated. In this way, a Merkle tree is constructed and the root hash value is used as the on-chain digest index of the tampered cluster.

[0042] The SM4 block cipher algorithm is used to encrypt the complete verification report file containing the three-dimensional label verification report, the tampered area mask, and the tampered area percentage.

[0043] The encrypted complete verification report file, along with the root hash value, number of leaf nodes, and tree depth of the Merkle tree, is submitted in batches to the evidence storage platform via the HTTPS protocol as an evidence storage data packet.

[0044] The evidence storage platform returns an evidence storage receipt containing the block height and transaction hash, completing the on-chain storage of immutable judicial evidence.

[0045] In a preferred embodiment of the present invention, the system further includes an audit and version control module; the audit and version control module assigns a unique task number to each verification task and records the system version number, algorithm model version number, and key threshold parameter configuration used to perform the verification, forming a task version snapshot; the audit and version control module also records modification operation logs of the system's core algorithm and threshold parameters, the modification operation logs including the identity information of the modifier, modification time, modification reason, and parameter values ​​before and after modification; the above-mentioned task version snapshots and modification operation logs are stored on the blockchain through the evidence storage interaction module to ensure the reliability of the system itself and the traceability of the identification conclusions, meeting the requirement of judicial identification that the testing and inspection tools should be confirmed and controlled.

[0046] In a preferred embodiment of the present invention, the benchmark library dynamic update module selects images with a device homology higher than a preset high confidence threshold and a tampering contribution ratio lower than a preset low tampering threshold from the judgment results output by the verification judgment module at a preset period as reliable samples.

[0047] Extract the native device source contribution spectrum obtained by decomposing each of the trusted samples through the constraint source parsing module, divide the time window according to the evidence collection timestamp of the trusted sample, and calculate the weighted average of all the native device source contribution spectra in each time window with the exponential decay function as the weight to obtain the time series reference component;

[0048] The timing reference component of the most recent time window is integrated into the current native device source element with a preset fusion ratio. The sliding update method is used instead of direct overlay, so that the native device source element can smoothly track the timing drift of device sensor noise caused by aging and temperature drift factors.

[0049] After each update, the relative change rate of the native device source terminal before and after the update is calculated. If the relative change rate exceeds the drift alarm threshold, a baseline drift alarm is generated.

[0050] In a preferred embodiment of the present invention, the local tampering location module reads the external tampering source contribution spectrum output by the constraint source parsing module, and transforms the external tampering source contribution spectrum from a one-dimensional vector form into a two-dimensional spatial distribution matrix corresponding to the original image size to obtain a tampering energy distribution map;

[0051] An adaptive threshold segmentation based on the Otsu method is applied to the tampered energy distribution map, and regions with pixel values ​​greater than the automatically calculated optimal threshold are marked as suspected tampering regions, generating a binarized tampering region mask;

[0052] Morphological opening and connected component analysis are performed on the tampered region mask to remove isolated noise points and retain valid tampered blocks. The proportion of the total number of pixels marked as tampered in the denoised tampered region mask to the total number of pixels in the image is calculated as the tampered area percentage.

[0053] The tampered area mask is overlaid on the original image in the form of a heat map to generate a visual tampered location map, and the tampered area ratio and the visual tampered location map are attached to the 3D label verification report.

[0054] In a preferred embodiment of the present invention, the edge computing power scheduling module reads the system resource interface of the law enforcement terminal at a preset monitoring cycle to obtain two real-time resource indicators: CPU utilization and memory remaining amount.

[0055] When the CPU utilization rate is higher than the preset high load threshold or the remaining memory is lower than the preset low memory threshold, the computing power adaptive degradation mechanism is triggered.

[0056] The adaptive degradation mechanism for computing power includes: reducing the number of decomposition layers of the multi-scale wavelet packet decomposition from the default three layers to two layers, and simultaneously reducing the number of channels of the edge residual extraction filter and the texture perturbation extraction filter; at the same time, relaxing the inter-cluster distance threshold and the fractal threshold in the tampered clustering module; when the CPU utilization rate is lower than the preset recovery threshold and the remaining memory is higher than the preset sufficient threshold for multiple consecutive monitoring cycles, gradually restoring the number of decomposition layers and the clustering accuracy threshold to the default configuration.

[0057] This invention addresses the shortcomings of the prior art and has the following beneficial effects:

[0058] (1) This invention constructs a complete technical chain from streaming evidence images into the field, quantitative decoupling verification to anti-tampering evidence storage and on-chain through the coordinated cooperation of the data acquisition module, feature spectrum construction module, constraint source analysis module, tampering clustering module, verification judgment module and evidence storage interaction module. It realizes the integrated technical goal of reliable source of electronic evidence equipment, true and complete content, traceable alteration source, and verifiable verification conclusion. It overcomes the defects of the prior art, such as the difficulty in distinguishing between native noise of equipment and tampering traces, isolated verification of batch evidence, and disconnect between verification and evidence storage.

[0059] (2) The constraint source resolution module of this invention uses the mean of the feature spectrum of the trusted benchmark native image set as the fixed native device source end-member, sets the external tampering source end-member as the adaptive iteration variable, applies non-negativity constraints and abundance sum to 1 constraints, and solves the problem using the alternating least squares method. Since the native device source end-member is constrained by the trusted benchmark image collected during device registration, the tampering traces in the image can only be absorbed by the external tampering source end-member in the iterative solution, thereby quantitatively decomposing the feature spectrum of each image into two parts: the native device source contribution spectrum and the external tampering source contribution spectrum. Compared with the existing technology that extracts statistical features from the image as a whole, this invention makes the device homology and the tampering contribution ratio two independent and quantifiable judgment indicators, avoiding misjudgments caused by the mutual interference of device noise and tampering traces from the source, and significantly reducing the false alarm rate and the false negative rate; furthermore, the decomposition results have clear physical correspondence meaning, the judgment conclusion is interpretable and verifiable, meeting the judicial practice requirements for the interpretability of the evidence identification process, and also providing a pure external feature data foundation for subsequent clustering and typing.

[0060] (3) The tampering clustering module of the present invention performs minimum spanning tree phylogenetic clustering on the decoupled external tampering source contribution spectrum, establishes the physical correspondence between tampering clusters and tampering tools, and cooperates with the three-level judgment of the verification judgment module. It can not only determine whether a single image has been tampered with, but also identify whether multiple images have been batch altered by the same tampering tool through phylogenetic distance, so that organized batch forgery behavior can be exposed as a whole. This is something that the existing image-by-image isolated verification method cannot achieve. The incremental clustering mechanism allows newly added images to be included in the existing tampering clusters without full recalculation, which meets the low latency processing requirements of streaming entry scenarios. Furthermore, the evidence storage interaction module generates a three-dimensional label verification report with the homology of attached devices, the proportion of tampering contribution and the affiliation of tampering clusters, and constructs a Merkle tree indexed evidence storage structure with tampering clusters as units. The verification conclusions are structurally bound to the evidence storage carrier. Any subsequent modification to the verification report will cause a chain change in the root hash value, ensuring the integrity and immutability of the evidence chain. Moreover, the batch chaining method with clusters as units significantly reduces the evidence storage overhead compared to image-by-image chaining.

[0061] (4) The benchmark library dynamic update module updates by exponential decay weighting and sliding fusion within the time window, so that the original device source end-units smoothly track the time drift caused by the aging and temperature drift of the device sensors, thus ensuring the long-term effectiveness of the verification benchmark; the local tampering location module transforms the contribution spectrum of external tampering sources into a tampering energy distribution map and generates a visual tampering location map, so that the verification conclusions can be presented intuitively; the edge computing power scheduling module ensures the continuous availability of the system under different computing power environments by adaptive degradation and recovery of the decomposition layer and clustering threshold.

[0062] (5) By introducing a trusted benchmark collection and solidification module, this invention embeds a collection, witnessing and solidification process that conforms to judicial evidence standards at the source of technology, upgrading the "trusted benchmark" in technology to the "starting point of the evidence chain" in law, fundamentally ensuring the legality and authenticity of the verification benchmark; by mandating the recording and hash comparison of the regulatory chain information, it fills the gap in the circulation of evidence before it is put on the chain; by using legally friendly report interpretation, system version solidification and audit log mechanism, it significantly enhances the reliability and acceptability of the system in the judicial examination process, making this invention not only an efficient technical tool, but also a trusted verification system that conforms to judicial appraisal standards. Attached Figure Description

[0063] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0064] Figure 1 This is a system architecture diagram of a preferred embodiment of the present invention; Detailed Implementation

[0065] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0066] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein. Therefore, the scope of protection of the invention is not limited to the specific embodiments disclosed below.

[0067] This embodiment describes a complete implementation scheme for an electronic evidence authenticity verification and communication evidence storage system based on visual feature matching. For example... Figure 1 As shown, the system consists of a trusted benchmark acquisition and solidification module, a data acquisition module, a feature spectrum construction module, a constraint source analysis module, a tampering clustering module, a verification and judgment module, and an evidence storage interaction module, as well as optional benchmark library dynamic update module, local tampering location module, edge computing power scheduling module, and audit and version control module. The modules are connected sequentially through well-defined data interfaces to form a complete technical chain from image entry to result evidence storage.

[0068] The Trusted Benchmark Acquisition and Consolidation module is responsible for initiating a standardized benchmark image acquisition process during the initial registration or periodic calibration of the evidence-gathering equipment. This process serves as the legal and technical starting point for system verification. The acquisition process is executed by qualified personnel (such as forensic experts) who, under predetermined environmental standards including lighting and background, control the evidence-gathering equipment to capture a predetermined number of test images. The entire acquisition process is recorded on video, with detailed records of the acquisition time, personnel, equipment identification, and environmental parameters as metadata. Upon completion of acquisition, the system immediately calculates the hash value of all test images and packages the test images, hash values, and metadata into a benchmark data package. Subsequently, the system uses blockchain technology to store and solidify the hash value of this benchmark data package, ensuring the immutability of the benchmark image set from its inception. Simultaneously, the module automatically generates a benchmark image acquisition and consolidation certificate, which includes the acquisition personnel, witness information, hash value, and blockchain storage address. This certificate serves as a necessary attachment to the subsequent verification report, constituting the legitimate starting point of the electronic evidence verification chain.

[0069] The data acquisition module is responsible for receiving batches of electronic evidence images to be verified uploaded by on-site law enforcement terminals, and at the same time retrieving the trusted benchmark native image set of the corresponding evidence collection device from the evidence storage platform as a priori constraint.

[0070] The feature spectrum construction module performs multi-scale wavelet packet decomposition on the input image to extract multi-dimensional feature components and concatenates them into a unified feature spectrum matrix.

[0071] As the core computing engine of the system, the constrained source resolution module introduces the constrained positive definite matrix factorization framework into the field of electronic evidence analysis for the first time. It uses the mean of the credible benchmark image set as a fixed native device source end element and solves the abundance matrix by alternating least squares method to achieve quantitative decoupling between native device noise and external tampering traces.

[0072] The tampering clustering module performs minimum spanning tree phylogenetic clustering on the decoupled external tampering source contribution spectrum to establish a physical correspondence between the tampering tool and the clusters;

[0073] The verification and judgment module performs three levels of judgment based on the decoupling results: device homogeneity calculation, tampering existence judgment, and batch alteration confirmation.

[0074] The evidence storage interaction module generates a three-dimensional label verification report for each evidence image, which includes the device homology, the proportion of tampering contribution, and the attribution of the tampering cluster. It also constructs a Merkle tree indexed evidence storage structure based on the tampering cluster, and uploads it in batches to the evidence storage platform after being encrypted with the national cryptographic algorithm, forming an immutable judicial evidence chain.

[0075] Specifically, the data acquisition module serves as the entry point for the system to interact with the external environment and the evidence storage platform. In on-site law enforcement scenarios, law enforcement terminals continuously transmit batches of electronic evidence images to be verified to the system through streaming data interfaces. These images typically include screenshots extracted from the terminals involved in the case, photos of transaction vouchers, and other electronic image evidence related to the case.

[0076] When the system receives each batch of electronic evidence images to be verified, it automatically adds three metadata items to them: evidence collection timestamp, unique device identifier, and case number. The evidence collection timestamp records the exact time when the image was received by the system, the unique device identifier is used to uniquely identify the evidence collection device from which the image originated, and the case number is used to bind the current batch of images to a specific judicial case. These three metadata items together constitute the evidence metadata block, which runs through the subsequent processing flow and is uploaded to the blockchain together when the evidence is finally stored.

[0077] Upon receiving an image, the system mandates the entry or association of a regulatory chain information. This information includes the operator's identification ID (e.g., police badge number), operation type (e.g., "evidence export," "evidence upload"), and operation time, forming a critical behavior log to record the complete flow of evidence before it is uploaded to the blockchain. When evidence enters the system, it immediately calculates its hash value and compares it with the original hash value recorded locally on the law enforcement terminal. If the comparison is inconsistent, a transmission anomaly alarm is issued to ensure that the transmission process has not been tampered with. After successful comparison, the regulatory chain information, as part of the evidence metadata, is ultimately uploaded to the blockchain for evidence storage.

[0078] The system establishes a secure channel with two-way identity authentication based on a preset certificate system and evidence storage platform. This channel uses the TLS protocol for transport layer encryption to ensure that data is not eavesdropped or tampered with during transmission.

[0079] The system sends a baseline retrieval request carrying the device's unique identifier to the evidence storage platform through this secure channel. After verifying the legitimacy of the requester's identity, the evidence storage platform retrieves the device registration database based on the device's unique identifier and returns a set of trusted baseline raw images collected when the device was registered and which have not undergone any post-processing.

[0080] This trusted baseline native image set typically contains dozens of test images taken by the device in a standard environment. Its statistical characteristics reflect the inherent noise patterns of the device's sensors, serving as fixed endmember constraints in subsequent constraint source resolution.

[0081] After receiving the native image set of the trusted benchmark, the system performs format unification and resolution normalization processing on the electronic evidence images to be verified and the native image set of the trusted benchmark, converting all images into a uniform bit depth, color space and pixel size to eliminate interference caused by differences in acquisition parameters to subsequent feature extraction.

[0082] The feature spectrum construction module performs the same multi-scale wavelet packet decomposition process on the preprocessed electronic evidence image to be verified and the original image set of the trusted benchmark, respectively, to extract multi-dimensional feature components that can reflect the underlying statistical characteristics of the image.

[0083] Specifically, the system performs three-level wavelet packet decomposition on each input image, and uses the Daubechies wavelet basis function to decompose the image signal into different frequency subbands layer by layer.

[0084] After three layers of decomposition, each image is decomposed into a low-frequency approximate subband LL3 and seven high-frequency detail subbands. The high-frequency detail subbands include the horizontal subband HLj (j=1,2,3), the vertical subband LHj (j=1,2,3), and the diagonal subband HHj (j=1,2,3). Here, the subscript j represents the decomposition layer index.

[0085] Let the input image be I(x,y), where (x,y) represents the spatial coordinates. Then the wavelet packet decomposition process can be expressed as: in the j-th level decomposition, the coefficient matrix of the k-th sub-band... The low-frequency approximate subband coefficients are calculated using a two-dimensional wavelet transform filter bank. Specifically, the low-frequency approximate subband coefficients are obtained by passing a low-pass filter h and a wavelet scaling function. The high-frequency detail subband coefficients are obtained through convolution operations, while the high-pass filter g and wavelet function are used to obtain them. It is obtained through convolution operations.

[0086] After wavelet packet decomposition, the system extracts three types of feature components from each frequency sub-band. The first type is sensor noise. The system inputs the low-frequency approximate sub-band LL3 into the sensor noise extraction filter. This filter, based on the consistency assumption of local variance of the image, separates the inherent sensor noise pattern of the device by comparing the statistical distribution differences of neighboring pixel blocks, thus obtaining the sensor noise component. .

[0087] The second type is edge residuals. The system inputs the horizontal subband HLj and the vertical subband LHj into the edge residual extraction filter. This filter captures boundary artifacts caused by tampering operations by detecting the inconsistency in energy transfer between subband coefficients at different decomposition levels, thus obtaining the edge residual components. .

[0088] The third type is texture perturbation. The system inputs all frequency sub-bands into the texture perturbation extraction filter. This filter calculates the second-order statistical features of each sub-band based on the gray-level co-occurrence matrix. By comparing the deviation between the local texture pattern and the global texture distribution, it detects texture anomalies introduced by tampering and obtains the texture perturbation components. .

[0089] Z-score standardization is applied to the three types of feature components to eliminate the dimensional differences between them. The mathematical expression for Z-score standardization is:

[0090] ;

[0091] Where v represents the original eigenvalue of a certain eigencomponent, This represents the mean of the feature component across all samples. This represents the standard deviation of the feature component across all samples. This represents the feature value after standardization.

[0092] Standardized sensor noise components Marginal residual components and texture perturbation components The one-dimensional feature vectors of all the electronic evidence images to be verified are then concatenated sequentially according to the frequency dimension to form a multi-dimensional feature spectrum matrix X.

[0093] Suppose there are M images of electronic evidence to be verified, and the dimension of the one-dimensional feature vector of each image after stitching is P. Then the dimension of the multidimensional feature spectrum matrix X is M×P, and its m-th row vector... The complete feature spectrum corresponding to the m-th image.

[0094] Perform the same wavelet packet decomposition, feature extraction, normalization, and stitching process on the original image set of the trusted benchmark to obtain the feature spectrum matrix of the trusted benchmark. Suppose that the native image set of the trusted benchmark contains B images, then The dimension is B×P.

[0095] The constraint source resolution module is the core computing engine of the entire system. It treats the multidimensional feature spectrum of each image as a linear mixture of different feature sources and uses a reliable reference image as a fixed constraint of the native device source to mathematically separate external tampering traces.

[0096] The constraint source resolution module adopts a constrained positive definite matrix factorization model, and its mathematical framework is as follows:

[0097] The system calculates the reliable benchmark feature spectrum matrix. The column mean vector, which represents the average feature representation of the device under standard conditions, is used as the native device source element. And it remains constant in subsequent iterative solutions, that is ,in express The b-th row vector.

[0098] The system assumes that the feature spectrum of each image is generated jointly by two types of sources: native device sources and external tampering sources. Let the number of external tampering source endmembers be K, then all source endmembers constitute a source-endmember matrix. ,in For fixed native device source components, to The external tampering source terminator is to be adaptively iteratively solved.

[0099] The proportion of each image m's contribution to each source constitutes an abundance vector. ,in This represents the contribution ratio of the k-th source to the feature spectrum of the m-th image, satisfying the constraint that the sum of abundances is 1. and nonnegativity constraints .

[0100] All abundance vectors constitute the abundance matrix. The dimension is M×(K+1). The objective function for constrained positive definite matrix factorization is defined as follows:

[0101] ;

[0102] in F denotes the Frobenius norm of a matrix, which is defined as the square root of the sum of the squares of all its elements. ; The penalty coefficient is the sum of abundances constrained to 1, which controls the penalty intensity when the sum of abundance vectors deviates from 1; The penalty coefficient for non-negativity constraints controls the intensity of the penalty for negative values ​​in abundance. For the nonnegative penalty term of ReLU function form, when A penalty is incurred when the value is negative, and the penalty is zero when the value is non-negative.

[0103] The first term of the objective function is the data fitting term, which measures the relationship between the multidimensional feature spectrum matrix X and the reconstructed matrix. The difference between them; the second and third terms are abundance and constraint terms and non-negative constraint terms, respectively.

[0104] The system iteratively solves the objective function using the alternating least squares method. In each iteration, the solution process is divided into two alternating phases. The first phase fixes the current external tampering source terminator. to Solve for the abundance matrix F. The objective function is convex with respect to F, and a closed-form solution can be obtained using the nonnegative least squares method. Specifically, for each image m, solving for its abundance vector f_m is transformed into the following constrained least squares problem:

[0105] ;

[0106] in The L2 norm of a vector is denoted as . ; Let X be the m-th row vector of the multidimensional feature spectrum matrix X, which is the feature spectrum of the m-th image.

[0107] The aforementioned constrained least squares problem is solved using the projective gradient descent method. After each gradient update, the abundance vector is projected onto the standard simplex to satisfy the dual constraints of an abundance sum of 1 and non-negativity. In the second stage, the abundance matrix F obtained in the first stage is fixed, and the externally modified source endmembers are updated. to Due to the native device source element Keeping the source fixed, only the externally modified source part needs to be updated. The corresponding unconstrained least squares solution is:

[0108] ;

[0109] in The source-end-member matrix is ​​an externally modified source matrix with dimensions P×K; The abundance submatrix corresponding to the externally modified source has dimensions M×K, where Represents the k-th column vector of the abundance matrix F; This is the abundance column vector corresponding to the native device source; the superscript T indicates matrix transpose operation, and the superscript -1 indicates matrix inversion operation.

[0110] In seeking Then, an element-wise nonnegative projection operation is performed, which sets all negative elements to zero to ensure the physical nonnegativity of the source endmember. These two phases are executed alternately to constitute a complete iteration. After each iteration, the system calculates the objective function value. When the rate of change of the objective function value between two adjacent iterations is lower than a preset convergence threshold... Stop iteration when, i.e. ,in Let represent the objective function value in the t-th iteration.

[0111] After iterative convergence, the system separates the native device source contribution spectrum and the external tampering source contribution spectrum for each image from the final abundance matrix F. Specifically, the native device source contribution spectrum of the m-th image... Defined as the portion of the image feature spectrum attributed to the native device source, its mathematical expression is: ;External tampering source contribution spectrum of the m-th image Defined as the portion of the image feature spectrum attributed to an external tampering source, its mathematical expression is: .

[0112] because and to The process maintains orthogonal convergence throughout the iteration, and the sum of the two parts mentioned above... Approximately equal to the original feature spectrum This achieves quantitative decoupling between the device's native noise and external tampering traces.

[0113] The tampering clustering module receives the external tampering source contribution spectra of all the electronic evidence images to be verified from the constraint source parsing module, constructs the tampering source feature spectrum, and performs homology typing. The system first collects the external tampering source contribution spectra of all M images. These contribution spectra are used as sample points to construct a tampering source feature spectrum.

[0114] The system calculates the contribution spectra of any two external tampering sources. and Euclidean distance between To construct the fully connected distance matrix D, the Euclidean distance is calculated using the following formula:

[0115] ;

[0116] in Let represent the p-th dimension of the external tampering source contribution spectrum of the i-th image, where P is the dimension of the feature spectrum. The fully connected distance matrix D is M×M in dimension, is a symmetric matrix, and has zero diagonal elements. Using the fully connected distance matrix D as input, the system executes the minimum spanning tree algorithm. The minimum spanning tree is constructed using either Prim's algorithm or Kruskal's algorithm, with the goal of finding a tree structure connecting all M sample points such that the sum of the distances of all edges in the tree is minimized.

[0117] After generating the minimum spanning tree, the system prunes the edges with the largest weights in descending order of edge weight. Each pruning splits the tree into two subtrees. The pruning process continues until the number of subtrees reaches the preset number of tampering tool types. Or, the weight of the current pruned edge is less than the preset inter-cluster distance threshold. The sample points in each subtree constitute a tampering cluster. , where C is the final number of tampered clusters generated. For each tampered cluster... The system calculates the mean vector of the contribution spectra of all external tampering sources within the cluster as the cluster center spectrum of the tampered cluster. The calculation formula is:

[0118] ;

[0119] in Indicates tampering cluster The number of samples included. For continuously added images in on-site law enforcement streaming evidence collection scenarios, the tampering clustering module adopts an incremental clustering mechanism to avoid full recalculation. When a new image arrives, the system calls the converged constraint source analysis model to perform feature decomposition on the new image, obtaining its external tampering source contribution spectrum. .

[0120] The system calculates the contribution spectrum of the newly added exogenous tampering source and the cluster center spectrum of each existing tampering cluster. phylogenetic distance between ,Right now The newly added image is assigned to the tampered cluster with the smallest phylogenetic distance, where The cluster center spectrum of the tampered cluster is updated using the incremental mean formula, and the update formula is as follows: .

[0121] If all lineages are far All are greater than the preset fractal threshold. This indicates that the tampering traces of the newly added image are significantly different from all existing tampering clusters. The system then uses the contribution spectrum of this new exogenous tampering source as the initial center to create a new tampering cluster. This incremental processing mechanism reduces the computational complexity of the new sample to only [missing information]. , and full recalculation Compared to previous models, this represents a significant reduction, fully meeting the low-latency operation requirements of edge terminals such as law enforcement tablets.

[0122] The verification and judgment module performs a three-level judgment on each image of electronic evidence to be verified, based on the original device source contribution spectrum and external tampering source contribution spectrum output by the constraint source analysis module, and the tampering clustering results output by the tampering clustering module. The first level is the device homology judgment, in which the system calculates the original device source contribution spectrum of the m-th image. With native device source element Cosine similarity between them is used as the degree of device homology. The formula for calculating cosine similarity is:

[0123] ;

[0124] in This represents the inner product operation of two vectors, i.e. Equipment homogeneity The value range is [-1, 1]. Under actual physical constraints, it is usually a non-negative value. The closer it is to 1, the better the device native features of the image match the reliable benchmark.

[0125] like Greater than the preset homogeneous threshold If the image is found to be from the same forensic device as the trusted baseline original image set, then the system determines that the image and the original image set are from the same forensic device. The second level is the tampering existence judgment; the system calculates the external tampering source contribution spectrum of the m-th image. The L2 norm accounts for a portion of the original feature spectrum of the image. The ratio of the total characteristic energy norm is used as the proportion of the tampering contribution. The formula for calculating the percentage of altered contributions is as follows:

[0126] ;

[0127] Tampering with contribution percentage The value range is [0,1]. The closer to 0, the weaker the external tampering traces; the closer to 1, the more external tampering features the image contains. If Exceeding the preset tampering threshold If the image shows signs of external tampering, then it is determined that the image has been altered. The third level is for batch alteration detection, which is only performed on images that have been determined to have been altered by the second level.

[0128] The system calculates the external tampering source contribution spectrum of the image. and its tampered cluster Cluster center spectrum The Euclidean distance between them is used as the phylogenetic distance. ,Right now , where c(m) represents the tampered cluster index to which the m-th image belongs.

[0129] like Less than the preset same-source tool threshold If the image is found to be altered in batches by the same tampering tool as other images within the same tampering cluster, then the system determines that the image and other images within the same tampering cluster were altered in batches. After the three-level judgment is completed, the system will determine the device homogeneity. , falsifying contribution percentage The cluster affiliation c(m) and the tampered cluster affiliation are summarized into a structured verification result, which is then passed to the evidence storage interaction module to generate a verification report.

[0130] The evidence storage interaction module receives the structured verification results output by the verification and judgment module, generates a three-dimensional label verification report for each electronic evidence image to be verified, which includes the device homology, the proportion of tampering contribution, and the attribution of the tampering cluster, and constructs a Merkle tree indexed evidence storage structure with the tampering cluster as the unit.

[0131] The verification report includes a legally friendly interpretation section, which transforms quantitative indicators such as device homology and tamper contribution ratio into legal conclusions. Specifically, it includes: based on the preset numerical range of device homology, it provides qualitative conclusions such as "highly probable from the same device," "highly probable from the same device," or "cannot be determined from the same device." The basis for setting the preset numerical range and judgment threshold is attached to the report as an appendix, which records statistical false positive and false negative rate data or industry standard references to prove its scientific validity and reliability. The verification report also includes a visual tamper location map, which marks the specific areas judged as tampered and the reasons for the judgment (such as "the texture statistical characteristics of this area are significantly different from the original pattern of the device") to enhance the verifiability of the verification conclusions.

[0132] For each tampered cluster For all images within the system, the device homology of each image is determined. , falsifying contribution percentage and tampering with cluster ownership The three data items are serialized into leaf node data blocks in a fixed order. .

[0133] The SHA-256 hash algorithm is used to hash each leaf node data block. Calculate the leaf hashes by calculating the hashes separately. Merkle trees are constructed using a bottom-up, layer-by-layer hash pairing strategy. At each layer, adjacent nodes are hashed together, and the hash value is recalculated to obtain the parent node's hash. ,in This indicates a string concatenation operation.

[0134] If the number of nodes at a certain level is odd, then copy the hash of the last node and pair it with itself. Recursively calculate upwards level by level until a unique root hash value is generated. This is used to construct a complete Merkle tree, and the root hash value is... Serves as the on-chain digest index for this tampered cluster.

[0135] In the data encryption stage, the system uses the SM4 block cipher algorithm to encrypt the complete verification report file containing the 3D label verification report, the tampered area mask, and the tampered area ratio. The SM4 algorithm encrypts the data in blocks with a 128-bit block length and a 128-bit key length.

[0136] The system will encrypt the complete verification report file along with the root hash value of the Merkle tree. Number of leaf nodes Tree depth As evidence storage data packets, they are submitted in batches to the evidence storage platform via the HTTPS protocol. Upon receiving the evidence storage data packets, the platform writes them into the blockchain and returns a response containing the block height. and transaction hash The receipt for evidence storage completes the on-chaining of an immutable chain of judicial evidence.

[0137] The system also includes an auditing and version control module to ensure its reliability. This module assigns a unique task number to each verification task and records the system version number, algorithm model version number, and key threshold parameter configurations used for that verification, creating a task version snapshot. It also records modification logs of the system's core algorithms and threshold parameters, including the modifier's identity information, modification time, reason for modification, and parameter values ​​before and after the modification. These task version snapshots and modification logs are stored on the blockchain via the evidence storage and interaction module to ensure the system's reliability and the traceability of the identification conclusions, meeting the requirement for judicial identification that testing and inspection tools must be verified and controlled.

[0138] To accommodate the temporal drift of sensor noise caused by aging and temperature drift during long-term operation, the system can be equipped with a dynamic update module for the reference library.

[0139] This module operates according to a preset cycle. From the judgment results output by the verification and judgment module, devices with a homology higher than the preset high confidence threshold are selected. Furthermore, the percentage of contributions to the tampering was lower than the preset low tampering threshold. Images are used as trusted samples, and these trusted samples are included in the baseline update candidate set after being manually sampled and confirmed to be tamper-proof.

[0140] For each reliable sample in the candidate set, the system extracts the native device source contribution spectrum obtained by the constraint source resolution module. Divide the time window according to the evidence collection timestamp of the credible sample. ,in This represents the index of the time window. For each time window... The time-series reference component is obtained by calculating a weighted average of the contribution spectra of all native devices within the system using an exponential decay function. The formula for calculating the exponentially decaying weighted average is:

[0141] ;

[0142] in The attenuation coefficient controls the rate at which the contribution of historical samples to the current benchmark decays. This is the time difference between the timestamp of the sample collection and the center of the current time window.

[0143] The system acquires the timing reference components of the most recent time window. Then, according to the preset fusion ratio Integrate it into the current native device source code. The updated formula is as follows ,in Control the incorporation rate of the new reference component. This sliding update method, instead of direct overlay, enables native device source components to smoothly track the temporal drift of device sensor noise.

[0144] After each update, the system calculates the relative rate of change of the native device source endpoints before and after the update. If the relative rate of change Exceeding the drift alarm threshold If this occurs, it indicates that the characteristics of the device's sensors may have changed significantly, and the system will generate a reference drift alarm, suggesting that the administrator recalibrate the device.

[0145] The system can be optionally equipped with a local tampering location module to provide judicial personnel with intuitive information on the location of tampering. This module reads the external tampering source contribution spectrum output by the constraint source analysis module. The one-dimensional vector form is inversely transformed into a two-dimensional spatial distribution matrix corresponding to the original image size. This resulted in a tampered energy distribution map.

[0146] An adaptive thresholding method based on the Otsu method is applied to the altered energy distribution map. The Otsu method automatically determines the optimal threshold by maximizing the inter-class variance. , pixel value greater than The region is marked as a suspected tampering region, and a binary tampering region mask is generated. .

[0147] Morphological opening is performed on the tampered region mask to remove isolated noise points, followed by connected component analysis to preserve valid tampered blocks. The total number of pixels marked as tampered in the denoised tampered region mask is calculated. Percentage of total image pixels The proportion as the percentage of the area to be altered ,Right now The system overlays the tampered area mask onto the original image as a heatmap to generate a visual tampering location map, and displays the percentage of tampered area. The visualization of the tampered location map is attached to the 3D label verification report, providing judicial personnel with an intuitive view of the location and extent of the alteration.

[0148] For the operating environment of low-computing-power edge terminals such as law enforcement tablets, the system can optionally be equipped with an edge computing power scheduling module to achieve adaptive degradation and recovery of computing power. This module operates on a preset monitoring cycle. Read the system resource interface of the law enforcement terminal to obtain the CPU utilization rate. and remaining memory Two real-time resource metrics.

[0149] When CPU utilization Higher than the preset high load threshold or remaining memory Below the preset low memory threshold At this time, the system triggers an adaptive degradation mechanism for computing power. This mechanism includes parameter adjustments on two levels. First, it reduces the number of decomposition layers in the multi-scale wavelet packet decomposition from the default three layers to two layers, and simultaneously reduces the number of channels in the edge residual extraction filter and texture perturbation extraction filter to match the number of subbands after the layer reduction. Second, it relaxes the inter-cluster distance threshold and fractal threshold in the tampering clustering module to reduce the accuracy requirements of clustering calculation.

[0150] CPU utilization during multiple consecutive monitoring cycles Below the preset recovery threshold And remaining memory Higher than the preset sufficient threshold In this case, the system gradually restores the number of decomposition layers and clustering accuracy thresholds to the default configuration, ensuring optimal detection accuracy when computing power is sufficient. This adaptive scheduling strategy enables the system to maintain the continuous availability of core tamper detection tasks under different computing power environments.

[0151] Based on the preferred embodiments of the present invention described above, those skilled in the art can make various changes and modifications without departing from the inventive concept. The technical scope of this invention is not limited to the contents of the specification, but must be determined according to the scope of the claims.

Claims

1. A system for verifying the authenticity of electronic evidence and storing communication evidence based on visual feature matching, including: The module comprises a data acquisition module, a feature spectrum construction module, a constraint source analysis module, a tampering clustering module, a verification and judgment module, and an evidence storage interaction module; its features are: The data acquisition module is used to receive batches of electronic evidence images to be verified via streaming, and retrieve the trusted benchmark native image set from the evidence storage platform through a secure channel. The feature spectrum construction module is used to perform multi-scale wavelet packet decomposition on the electronic evidence image to be verified, extract sensor noise, edge residuals and texture perturbations, and then standardize and splice them to generate a multi-dimensional feature spectrum matrix. The same processing is performed on the original image set of the credible benchmark to obtain the credible benchmark feature spectrum matrix. The constraint source parsing module takes the multidimensional feature spectrum matrix as input, the mean of the reliable benchmark feature spectrum matrix as a fixed native device source end-member, sets the external tampering source end-member as an adaptive iterative variable, applies non-negative constraints and abundance sum to 1 constraints, and solves the problem by alternating least squares method, outputting the native device source contribution spectrum and the external tampering source contribution spectrum. The tampering clustering module is used to collect the contribution spectrum of the external tampering sources to construct the tampering source feature spectrum, and to use minimum spanning tree spectrum clustering to perform homology classification to generate tampering clusters corresponding to different tampering tools; The verification and judgment module calculates the similarity between the original device source contribution spectrum and the original device source endmember to obtain the device homology. It judges whether there is tampering based on the energy proportion of the external tampering source contribution spectrum, and measures the phylogenetic distance between the tampered image and the cluster center spectrum of its tampering cluster to determine the batch alteration. The evidence storage interaction module generates a three-dimensional label verification report with the homology of the attached devices, the proportion of tampering contribution, and the attribution of the tampered clusters. It constructs a Merkle tree indexed evidence storage structure with the tampered clusters as units, and uploads it to the evidence storage platform in batches after being encrypted by the national cryptographic algorithm.

2. The electronic evidence authenticity verification and communication evidence storage system based on visual feature matching according to claim 1, characterized in that: The data acquisition module continuously receives batches of electronic evidence images to be verified uploaded by on-site law enforcement terminals through a streaming data interface, and adds a timestamp of evidence collection, a unique device identifier, and a case number to each batch of electronic evidence images to form evidence metadata; The data acquisition module establishes a secure channel with two-way identity authentication with the evidence storage platform based on a preset certificate system, and sends a reference retrieval request carrying the device's unique identifier to the evidence storage platform through the secure channel. The evidence storage platform retrieves and returns a set of trusted baseline raw images collected during the device's registration and without any post-processing, based on the device's unique identifier. After receiving the trusted benchmark native image set, the data acquisition module performs format unification and resolution normalization processing on the trusted benchmark native image set and the electronic evidence image to be verified.

3. The electronic evidence authenticity verification and communication evidence storage system based on visual feature matching according to claim 1, characterized in that: The feature spectrum construction module performs three-level wavelet packet decomposition on each of the electronic evidence images to be verified to obtain low-frequency approximate subbands and high-frequency detail subbands in the horizontal, vertical and diagonal directions; The low-frequency approximate subband input sensor noise extraction filter separates the inherent noise mode of the device to obtain sensor noise; the high-frequency detail subband input edge residual extraction filter captures boundary inconsistencies to obtain edge residual; and the all subband input texture perturbation extraction filter detects local statistical anomalies to obtain texture perturbation. Z-score normalization is applied to the sensor noise, the edge residual, and the texture perturbation to eliminate the dimensional differences between different feature components. The standardized three types of feature components are concatenated into a one-dimensional feature vector according to the frequency dimension, and then all one-dimensional feature vectors are stacked according to the spatial dimension to form the multi-dimensional feature spectrum matrix. The same process is performed on the original image set of the trusted benchmark to obtain the trusted benchmark feature spectrum matrix.

4. The electronic evidence authenticity verification and communication evidence storage system based on visual feature matching according to claim 1, characterized in that: The column mean vector of the reliable benchmark feature spectrum matrix is ​​calculated by the constraint source parsing module and used as the source endmember of the native device, and remains fixed during the iteration; A non-negative matrix is ​​randomly initialized as the starting value of the externally tampered source end-member; Construct an objective function that includes a data fitting term and a constraint penalty term. The data fitting term is the square of the Frobenius norm of the sum of the abundance matrix and the sum of the two endmembers of the multidimensional feature spectrum matrix. The constraint penalty term includes Lagrange multipliers with an abundance sum of 1 constraint and a non-negativity constraint. The process is divided into two stages: first, solving for the abundance matrix by fixing the externally tampered source endmembers; and second, updating the externally tampered source endmembers by fixing the abundance matrix. The two stages are executed alternately until the rate of change of the objective function is lower than a preset convergence threshold. The native device source contribution spectrum and the external tampering source contribution spectrum are separated from the final abundance matrix.

5. The electronic evidence authenticity verification and communication evidence storage system based on visual feature matching according to claim 1, characterized in that: The tampering clustering module collects the contribution spectra of all external tampering sources and calculates the Euclidean distance between any two to construct a fully connected distance matrix. Using the fully connected distance matrix as input, the minimum spanning tree algorithm is executed. Edges with the largest weights are cut off in descending order of edge weight until the number of subtrees reaches the preset number of tampering tool types or the weight of the cut edges is less than the preset inter-cluster distance threshold. Each subtree corresponds to one tampering cluster. The mean vector of all external tampering source contribution spectra within each tampering cluster is calculated as the cluster center spectrum. When a new image is added, the converged constrained source analysis model is called to perform eigenvalue decomposition to obtain the contribution spectrum of the new external tampering source. The phylogenetic distance between the new image and each cluster center spectrum is calculated, and the image is assigned to the tampering cluster with the smallest phylogenetic distance. The cluster center spectrum is updated using the incremental mean formula. If the phylogenetic distances are all greater than the preset classification threshold, a new tampering cluster is created with the newly added external tampering source contribution spectrum as the initial center.

6. The electronic evidence authenticity verification and communication evidence storage system based on visual feature matching according to claim 1, characterized in that: The verification and judgment module performs a three-level judgment on each of the electronic evidence images to be verified; The first level is device homology judgment, which calculates the cosine similarity between the source contribution spectrum of the native device and the source endmember of the native device as the device homology. If it is greater than the preset homology threshold, it is determined that the native image set of the trusted benchmark comes from the same device. The second level is the determination of tampering existence. The ratio of the L2 norm of the contribution spectrum of the external tampering source to the norm of the total feature energy of the corresponding image is calculated as the tampering contribution ratio. If it exceeds the preset tampering threshold, it is determined that there is external tampering. The third level is batch alteration judgment. For images that are determined to have been tampered with, the Euclidean distance between the contribution spectrum of the external tampering source and the cluster center spectrum of the tampering cluster to which the image belongs is calculated as the phylogenetic distance. If it is less than the preset same-source tool threshold, it is determined that the image and other images in the cluster were batch altered by the same tampering tool. The summation of the device homology, the percentage of tampering contribution, and the attribution of the tampered clusters constitutes the structured verification results.

7. The electronic evidence authenticity verification and communication evidence storage system based on visual feature matching according to claim 1, characterized in that: The evidence storage interaction module serializes the device homology, tampering contribution ratio, and tampering cluster affiliation of each image into leaf node data blocks in a fixed order for all images within each tampered cluster. The SHA-256 hash algorithm is used to calculate the hash value of each leaf node data block to obtain the leaf hash. The hash value of the parent node is calculated again after pairing two adjacent leaf hashes. The calculation is recursively performed layer by layer until a unique root hash value is generated. In this way, a Merkle tree is constructed and the root hash value is used as the on-chain digest index of the tampered cluster. The SM4 block cipher algorithm is used to encrypt the complete verification report file containing the three-dimensional label verification report, the tampered area mask, and the tampered area percentage. The encrypted complete verification report file, along with the root hash value, number of leaf nodes, and tree depth of the Merkle tree, is submitted in batches to the evidence storage platform via the HTTPS protocol as an evidence storage data packet. The evidence storage platform returns an evidence storage receipt containing the block height and transaction hash, completing the on-chain storage of immutable judicial evidence.

8. The electronic evidence authenticity verification and communication evidence storage system based on visual feature matching according to claim 1, characterized in that: The benchmark library dynamic update module selects images with a device homology higher than a preset high confidence threshold and a tampering contribution ratio lower than a preset low tampering threshold from the judgment results output by the verification judgment module at a preset period as reliable samples. Extract the native device source contribution spectrum obtained by decomposing each of the trusted samples through the constraint source parsing module, divide the time window according to the evidence collection timestamp of the trusted sample, and calculate the weighted average of all the native device source contribution spectra in each time window with the exponential decay function as the weight to obtain the time series reference component; The timing reference component of the most recent time window is integrated into the current native device source element with a preset fusion ratio. The sliding update method is used instead of direct overlay, so that the native device source element can smoothly track the timing drift of device sensor noise caused by aging and temperature drift factors. After each update, the relative change rate of the native device source terminal before and after the update is calculated. If the relative change rate exceeds the drift alarm threshold, a baseline drift alarm is generated.

9. The electronic evidence authenticity verification and communication evidence storage system based on visual feature matching according to claim 1, characterized in that: The local tampering location module reads the external tampering source contribution spectrum output by the constraint source parsing module, and transforms the external tampering source contribution spectrum from a one-dimensional vector form into a two-dimensional spatial distribution matrix corresponding to the original image size to obtain the tampering energy distribution map; An adaptive threshold segmentation based on the Otsu method is applied to the tampered energy distribution map, and regions with pixel values ​​greater than the automatically calculated optimal threshold are marked as suspected tampering regions, generating a binarized tampering region mask; Morphological opening and connected component analysis are performed on the tampered region mask to remove isolated noise points and retain valid tampered blocks. The proportion of the total number of pixels marked as tampered in the denoised tampered region mask to the total number of pixels in the image is calculated as the tampered area percentage. The tampered area mask is overlaid on the original image in the form of a heat map to generate a visual tampered location map, and the tampered area ratio and the visual tampered location map are attached to the 3D label verification report.

10. The electronic evidence authenticity verification and communication evidence storage system based on visual feature matching according to claim 1, characterized in that: The edge computing power scheduling module reads the system resource interface of the law enforcement terminal at a preset monitoring cycle to obtain two real-time resource indicators: CPU utilization and memory remaining. When the CPU utilization rate is higher than the preset high load threshold or the remaining memory is lower than the preset low memory threshold, the computing power adaptive degradation mechanism is triggered. The adaptive degradation mechanism for computing power includes: reducing the number of decomposition layers of the multi-scale wavelet packet decomposition from the default three layers to two layers, and simultaneously reducing the number of channels of the edge residual extraction filter and the texture perturbation extraction filter; while relaxing the inter-cluster distance threshold and the fractal threshold in the tampered clustering module. When the CPU utilization rate is lower than the preset recovery threshold and the remaining memory is higher than the preset sufficient threshold for multiple consecutive monitoring cycles, the number of decomposition layers and the clustering accuracy threshold are restored to the default configuration level by level.

Images