43 results about "Digital forensics" patented technology

The invention provides an image tampering detection method and device based on a cross-modal ViT architecture. The method and device are particularly suitable for positioning digital image tampering operations such as copying-moving, splicing and erasing. The method comprises the following steps: acquiring a to-be-detected image, and inputting the to-be-detected image into a pre-established cross-modal double-flow ViT architecture; the cross-modal double-flow ViT architecture comprises a space domain ViT encoder layer, a frequency domain ViT encoder layer and a deformable cross attention fusion layer; extracting spatial domain feature data corresponding to the to-be-detected image through the spatial domain ViT encoder layer; extracting frequency domain feature data corresponding to the to-be-detected image through a frequency domain ViT encoder layer; and performing dynamic gating fusion on the spatial domain feature data and the frequency domain feature data through a deformable cross attention fusion layer to obtain fusion features, and performing image tampering detection based on the fusion features. According to the method, the problem of long-distance dependence is solved based on a self-attention mechanism of Vision Transform, and picture tampering detection is realized through spatial domain and frequency domain cross-modal conjoint analysis. Technical capability is provided for application scenes such as digital forensics and content auditing, and the material authenticity detection level is improved.

The invention discloses a generalizable deep forgery detection method based on multi-classification guidance, and belongs to the technical field of image processing. According to the technical scheme, data enhancement is carried out on an image, and then the image is input into a binary classification network and a multi-classification network of a double-flow neural network; combining the features of the two branches through a fusion module; the fused features are input into a binary classifier to determine whether the input is authentic or counterfeited. The method has the beneficial effects that the generalizable deep counterfeiting detection method based on multi-classification guidance shows remarkable beneficial effects in the aspects of improving the model generalization ability, enhancing the feature expression ability, optimizing the loss function design, preventing over-fitting, improving the calculation efficiency, enhancing the label consistency and the like; the method is beneficial to suppressing the propagation of false information, maintaining the right to know and security of the public, enhancing the vigilance of people to the authenticity of information, laying a solid foundation for the applications of identity authentication, digital forensics and the like in multiple fields, and making an important contribution to the construction of a safer and more credible information society.

The embodiment of the invention provides a network threat evidence obtaining method, a program product, electronic equipment and a storage medium, and relates to the technical field of artificial intelligence. The method comprises the steps of obtaining original data; preprocessing the original data to obtain an initial digital forensics report; performing abnormal event detection on the initial digital forensics report, and generating a text forensics file based on an abnormal event; performing event blocking and vector embedding on the text evidence obtaining file to obtain a vector file; and receiving query information input by the user, and generating an evidence obtaining report based on the query information and the vector file. According to the method, abnormal events can be automatically detected, event blocking and vector embedding can be carried out, key information of the events can be extracted, the threat evidence obtaining efficiency and accuracy are improved, and the problem that an existing method is low in threat evidence obtaining efficiency is solved.

The invention provides a graphical user interface forensic analysis method based on a multi-mode large language model, and belongs to the technical field of man-machine interaction, artificial intelligence safety and digital forensic. The method comprises the steps of evidence capture and distillation, semantic analysis and record generation, storage and indexing, and retrieval and inquiry. Through evidence capture and distillation, on the premise that evidence integrity is guaranteed, the visual data volume needing to be analyzed is greatly reduced, and long-term and efficient evidence obtaining analysis on a mobile terminal becomes possible; by introducing the analysis capability of a multi-modal large language model, original and structurality-free visual evidence is converted into a structuralization intelligent evidence which can be understood and deeply excavated; a designed two-stage natural language evidence obtaining query engine supports a complete analysis process from macroscopic semantic retrieval to microscopic detail inquiry; the problems that a traditional evidence obtaining method depends on manual troubleshooting and is low in efficiency are solved, and unprecedented high efficiency and convenience are provided for backtracking and auditing of mass interaction records.

Systems and methods for conducting a cloud-based forensic investigation of electronically-stored information are provided. The system includes an investigation requestor device configured to request a forensic investigation including selecting search criteria for the investigation, at least one remote system of the target, wherein the at least one remote system comprises electronically-stored information; a cloud server for storing forensic artifacts collected from the at least one remote system, wherein the forensic artifacts are collected based on the search criteria; and a cloud-based evidence-processing service configured to analyze the forensic artifacts and generate an initial report.

The embodiment of the application provides a network threat forensics method, a program product, an electronic device and a storage medium, and relates to the technical field of artificial intelligence. The method comprises the following steps: obtaining original data; preprocessing the original data to obtain an initial digital forensics report; detecting an abnormal event on the initial digital forensics report, and generating a text forensics file based on the abnormal event; performing event blocking and vector embedding on the text forensics file to obtain a vector file; receiving query information input by a user, and generating a forensics report based on the query information and the vector file. The method can automatically detect abnormal events and perform event blocking and vector embedding, can extract key information of the events, improves the efficiency and accuracy of threat forensics, and solves the problem of low efficiency of threat forensics in the prior art.

A system and method for initiating cybersecurity remediation based on a digital forensic finding is presented. The method includes detecting a forensic artifact on a disk of a resource in a computing environment; generating an inspectable disk based on the disk of the resource; inspecting the inspectable disk for a cybersecurity object based on the forensic artifact; and initiating a remediation action on the disk based on the cybersecurity object detected on the inspectable disk.

The application discloses a deep image inpainting tampering detection method based on adaptive tampering trace learning, and belongs to the technical field of digital image forensics. The method first processes the input image by using an adaptive differential convolution module to suppress image content and enhance tampering traces; then, multi-scale and fine-grained features are extracted in parallel by a multi-scale hollow convolution module and a dense connection network; next, a neural network structure search module is used to automatically optimize the feature extraction path to adapt to diversified tampering types; then, a global and local double-branch attention enhancement module is used to fuse multi-level features and simultaneously improve the internal consistency and boundary accuracy of the tampering area; finally, a decoder module is used to output a pixel-level tampering area mask. The application can adaptively learn tampering features and maintain high precision and strong robustness under post-processing conditions such as JPEG compression, scaling, noise addition and the like, and is suitable for fields such as digital forensics and media content security.

An operation method of an electronic device is disclosed. This operation method comprises the steps of: extracting text related to at least one evidence item in a report file including a forensic analysis result; on the basis of attributes of respective entities included in the extracted text, acquiring a knowledge graph defining a relationship between the entities; and, according to the acquired knowledge graph, generating and providing a sentence containing the relationship between the entities.

The invention discloses an application key extraction method and device, equipment, a medium and a program product, and relates to the technical field of digital forensics, and the method comprises the steps: obtaining database feature information of a target application and a key type of the target application, and reading target memory data of a process corresponding to the target application and attribute information of the process; determining a target memory block comprising the database feature information in the target memory data according to the attribute information of the process; and extracting the key of the target application according to the initial address of the database feature information in the target memory block and the key type of the target application. According to the embodiment of the invention, the application key extraction success rate is improved.

This invention relates to the fields of video processing, copyright protection, and digital forensics, specifically a pirated video tracing system based on video decoding. The system includes a data acquisition module, a status assessment module, a strategy decision-making module, and a tracing execution module. It acquires video stream data and decoding pipeline status data, calculates the computing power overdraft rate, and predicts the decoding failure probability. The system compares the decoding failure probability with a preset failure probability threshold to generate a downgraded tracing instruction or a regular tracing instruction. Based on this, it performs low-computing-power tracing feature extraction or deep tracing feature extraction on the video stream data, and sends the obtained target tracing features to a tracing comparison terminal for comparison, outputting the tracing location result. This invention achieves a balance between tracing tasks and decoding stability, and reduces the risk of playback failure caused by continuous tracing operation.

A system and method for iterative cybersecurity remediation based on a digital forensic finding is disclosed. In an embodiment, the method includes detecting a forensic finding, the forensic finding based on a forensic artifact detected on a disk of a resource in a computing environment; generating an inspectable disk based on the disk of the resource; inspecting the inspectable disk for a cybersecurity object based on the forensic artifact; and initiating a remediation action on the disk based on the cybersecurity object detected on the inspectable disk.

Comprehensive systems and methods for conducting digital forensics and incident response in containerized computing environments. The system converts stateless containers into persistent containers to prevent automatic termination during forensic investigations. It quarantines the containers using virtual switches and firewalls, captures detailed forensic data including snapshots of all filesystem layers, kernel syscalls, and process data, and mirrors network traffic for secure analysis. The system retrieves logs and artifacts from current and previous nodes, correlates and compares this data using machine learning algorithms, and securely duplicates all artifacts to immutable storage. Automated orchestration ensures consistent execution of forensic processes, and the system reverts containers to their original stateless state post-investigation. A detailed audit log and secure archival of all forensic data are maintained for future reference or legal compliance. The invention addresses the unique challenges of securing and analyzing data in dynamic, distributed containerized environments.

The invention discloses a depth image restoration tampering detection method based on adaptive tampering trace learning, and belongs to the technical field of digital image forensics. The method comprises the following steps: firstly, processing an input image by using a self-adaptive differential convolution module so as to inhibit image contents and enhance tampering traces; then, multi-scale and fine-grained features are extracted in parallel through a multi-scale cavity convolution module and a dense connection network; then, automatically optimizing a feature extraction path by using a neural network structure search module to adapt to diversified tampering types; then, through an attention enhancement module containing global and local double branches, fusing multi-level features and simultaneously improving internal consistency and boundary precision of a tampered region; finally, a pixel-level tampered region mask is output by the decoder module. According to the method, tampering features can be adaptively learned, high precision and high robustness are kept under post-processing conditions such as JPEG compression, zooming and noise adding, and the method is suitable for the fields of digital forensics, media content security and the like.

A digital forensics tool and associated method are disclosed for extracting digital data from a user computing device, transforming and analyzing the digital data, and generating an interactive user interface that facilitates the identification of important digital data, such as for a criminal investigation.

A device and a method for collecting, analyzing and integrating log data of an in-vehicle infotainment (IVI) system are disclosed. The method for collecting, analyzing and integrating log data of an IVI system includes identifying model information of a vehicle to be a target of digital forensics, hardware information and software information related to the IVI system of the vehicle, collecting target data for the digital forensics based on the model information, the hardware information and the software information, and storing the collected target data in an integrated database.

Computer systems and methods for detecting first generation illicit material on a target device are provided. The system includes a processor configured to execute a user interface module and an investigation module. The user interface module generates a user interface for interaction with a user. The investigation module: generates an investigation interface including input fields for prioritized folder data representing an ordered list of prioritized folders to scan for image files; searches the prioritized folders to locate image files; filters the image files using a plurality of filters each having filter criteria and rejects image files not meeting the filter criteria; scans, using an AI model, image files not rejected by the plurality of filters, wherein the AI model is trained to identify illicit material; flags possible first generation illicit material by the AI model; and displays the flagged possible first generation illicit material on the investigation interface.

The invention relates to a document tampering detection method based on dynamic kernel fusion and adaptive gradient modulation, and belongs to the technical field of digital forensics and computer vision. The method comprises the following steps: obtaining an RGB image of a to-be-detected document, constructing a feature encoder containing a double-branch feature extraction and feature updating module, taking ConvNeXt V2-Base as a backbone, combining visual and frequency domain features with a cross-domain feature calibration module, and obtaining optimized multi-scale features through learnable wavelet decomposition; a frequency domain adaptive feature decoder is constructed, dynamic kernel fusion is completed through Fourier frequency band grouping weight, kernel element precise modulation and space-frequency band dynamic matching, and a tampering prediction map is output; and during training, joint optimization of adaptive gradient cosine loss, cross entropy loss and LoWitz loss is adopted. According to the method, the frequency abnormity and tiny traces of document tampering can be accurately captured, the problem of class imbalance is effectively relieved, and the method has high detection precision and robustness in different compression scenes.

The invention discloses a face change defense method and device for a black-box face operation model, and belongs to the technical field of digital forensics active defens.The face change defense method for the black-box face operation model comprises the steps that adversarial disturbance is added to a source face image of a target object through a pre-trained proxy operation model, and the target object is obtained; the adversarial image with adversarial disturbance is actively generated, so that the black box face operation model generates a generated image with different identity contents from the source face image of the target object according to the adversarial image, the generation process of the black box face operation model is interfered, malicious operation is prevented, and the user experience is improved. The problem that the face changing operation defense generalization performance of the current black box face operation model is poor is solved.

The invention discloses a cryptographic algorithm-mode classification method and system based on a BCAM-LGST model, and belongs to the technical field of information security and cryptographic analysis. Comprising the following steps: converting an original ciphertext into a fixed-length sequence and a grayscale image in parallel, and constructing complementary bimodal data representation; the method comprises the following steps: extracting high-level probability features of a sequence by adopting a LightGBM model as semantic priori, and carrying out cross-modal depth fusion on a priori-guided hierarchical dual-channel gating modulation mechanism and image structure features extracted by Swin Transform; and introducing spatial position association of a spatial perception enhancement matrix enhancement feature, and carrying out multi-scale feature modeling on a fusion feature under prior guidance by using layered window attention, so as to finally realize end-to-end joint classification. The block cipher algorithm-mode joint identification method can quickly, accurately and robustly realize block cipher algorithm-mode joint identification, and is suitable for practical engineering scenes such as network security level protection, cipher application security evaluation, digital forensics, encrypted traffic analysis and compliance auditing.

An apparatus for analyzing and handling heterogeneous navigation data includes an evidence collection unit that collects evidence material relating to an accident; an evidence data analysis unit that verifies the integrity of the collected evidence material, and if the collected evidence material is collected from a plurality of manufacturers' equipment models, restores navigation data by analyzing evidence data relating to the collected evidence material; an integrated navigation data handling unit that generates an evidence-based integrated navigation pattern for different forms of navigation data, including original information, information on relevance to the original information, and an evidential material for extraction to be used as evidence, and stores the integrated navigation pattern in a standard format; and an accident reconstruction analysis management unit that simultaneously presents multiple pieces of heterogeneous data by layering the integrated navigation pattern, and reconstructs and analyzes the accident for each time slot of each track.

The invention discloses an image tampering positioning method and system based on edge guidance and multi-scale feature fusion. The method comprises the following steps: firstly, constructing a deep learning framework based on a Vision Transformer (ViT) backbone network, and realizing efficient modeling of local and global tampering features in an image in combination with a content awareness residual module; in order to improve the accuracy and robustness of tampering region detection, an edge guiding strategy is designed, and the strategy combines a Sobel operator, morphological operation and an edge segmentation loss function to reinforce tampering boundary feature expression, so that the sensitivity to an unnaturally fused region is improved. The invention further provides a multi-scale supervision mechanism, a coordinate attention module is combined, the model is guided to fuse semantic features under different scales, and the adaptive detection capability of the model on tampering regions with different scales is enhanced. In the implementation process, in the training stage, the detection performance of the model on image tampering is gradually improved by optimizing all modules of the deep learning network; and then, inputting an image to be detected by using the trained network, and automatically identifying and positioning a tampering region in the image. The method can effectively detect and position the tampering area of the image, has a wide application prospect, and can provide a more reliable and efficient image tampering detection solution especially in the fields of digital forensics, image content security and the like.

The present application relates to a kind of based on dynamic nuclear fusion and adaptive gradient modulation document tampering detection method, belong to digital forensics and computer vision technical field.It includes the following steps: obtaining the RGB image of the document to be detected, constructs the feature encoder containing double-branch feature extraction and feature update module, with ConvNeXt V2-Base as backbone, fusion visual and frequency domain features are combined with cross-domain feature calibration module, and optimized multi-scale feature is obtained by learnable wavelet decomposition;Frequency domain adaptive feature decoder is then constructed, dynamic nuclear fusion is completed by Fourier band grouping weight, kernel element accurate modulation and space-band dynamic matching, and tampering prediction map is output;Adaptive gradient cosine loss, cross-entropy loss and lovasz loss are used during training Joint optimization.The present application can accurately capture the frequency anomaly and subtle traces of document tampering, effectively alleviate the class imbalance problem, and has high detection accuracy and robustness under different compression scenarios.

The electronic device for performing digital forensics on an in-vehicle infotainment environment according to an exemplary embodiment of the present invention includes a processor which identifies each specification information of an in-vehicle infotainment (IVI) system installed in a vehicle and a user terminal communicating with the IVI system, collects communication section data generated in a communication section between the IVI system and the user terminal, first device data of the IVI system and second device data of the user terminal through collection methods prepared in response to the specification information, extracts artifacts associated with the in-vehicle infotainment environment by analyzing the communication section data, the first device data and the second device data through analysis methods prepared in response to the specification information, and verifies the artifacts through mutual comparison between the communication section data, the first device data and the second device data.

The discovery process in criminal and civil litigation frequently produces a large body of digital data. The digital data may come from computers, smartphones and other electronic devices (sources) of one or more people related to the litigation. Each source may have digital data from one or more applications and / or programs (platforms). The digital data may include, as non-limiting examples, contact lists, messages (possibly with emojis), photos, videos, audio and / or location data as non-limiting examples. The digital data from the various sources and platforms may be normalized and combined into a corpus of digital data. Digital forensic tools, possibly even an artificial intelligence (AI) may then be used to analyze the corpus of digital data.

The invention belongs to the technical field of digital forensics, and discloses a mobile video and audio evidence collection management system, which comprises an evidence capture module used for collecting video and audio comprehensive data and environment monitoring data; the data processing module is used for performing primary processing on the comprehensive data to obtain a video and audio feature data set after time synchronization; the video and audio evidence matching module is used for fusing the video and audio feature data set after time synchronization and the environment monitoring data to obtain a comprehensive feature data set; the content matching degree analysis module is used for training according to the comprehensive feature data set to obtain a video and audio evidence matching model, and predicting to obtain a comprehensive content matching degree based on the video and audio evidence matching model; the abnormity evaluation module is used for judging whether the audio and video comprehensive data is abnormal or not based on the comprehensive content matching degree, and sending alarm information to the management terminal if the audio and video comprehensive data is abnormal; the convenience and efficiency of evidence use are improved, and powerful support is provided for subsequent investigation and processing.

This invention discloses a method and system for detecting social media rumors based on the BLRQ-BV model, belonging to the technical field of social media content security and information authenticity identification. It includes: encoding each rumor event as a whole into a text modality and a grayscale image modality, constructing a bimodal data representation that maintains semantic integrity; using a BiLSTM network to extract sequence features from the text, employing a specially designed low-discrimination-information-loss quantum hybrid network LIL-QHN to extract quantum features from the text, and using a ResNet-18 network to extract visual structural features from the grayscale image; losslessly fusing the three modal features through an innovative spherical spatial vector synthesis method VC-BS, preserving the feature strength and directional relationships; and introducing a joint loss function to collaboratively optimize each branch, ultimately achieving end-to-end rumor detection. This invention can robustly achieve automatic identification of social media rumors and is applicable to scenarios such as network content security management, public opinion monitoring and early warning, and digital forensics.

The present application relates to a kind of audio and video counterfeit segment timing positioning method and system, facing audio and video depth counterfeit content analysis scene, video modal feature and audio modal feature are jointly modeled, and through hierarchical timing coding, multiscale feature fusion, candidate quality evaluation and boundary positioning processing, the automatic positioning of the start time of counterfeit segment is realized.The present application is deployed in general electronic equipment by program mode, for audio and video content review, media authenticity verification, digital forensics analysis and related content security scene, the present application can improve candidate sorting reliability and boundary positioning precision, improve the positioning precision of counterfeit segment in short time local scene and candidate sorting quality.

The invention belongs to the technical field of information security and digital forensics, and particularly relates to a multi-party cooperation-based model copyright forensics and authority control method, which comprises the steps of binary copyright information generation, share segmentation and image mapping, trigger distribution, trigger mechanism embedding, forensics image output and copyright information reconstruction. By introducing a share management and threshold control mechanism of multi-party cooperation, single-party abuse and single-point leakage are effectively prevented, the safety and credibility of the copyright verification process are improved, and the method is suitable for complex scenes such as joint development, cross-organization cooperation and judicial evidence collection.