WO2021143489A1

WO2021143489A1 - Evidence collection environment verification method and apparatus, and electronic device

Info

Publication number: WO2021143489A1
Application number: PCT/CN2020/139410
Authority: WO
Inventors: 黄凯明; 蔡鸿博; 曾晓东; 杨磊; 林锋
Original assignee: 支付宝(杭州)信息技术有限公司
Priority date: 2020-01-15
Filing date: 2020-12-25
Publication date: 2021-07-22
Also published as: CN110852427A; CN110852427B

Abstract

An evidence collection environment verification method and apparatus, and an electronic device, the evidence collection environment verification method and apparatus being applied to an evidence collection terminal. The method comprises: acquiring sensing data collected, within a verification time period, by a sensor carried by an evidence collection terminal, and on the basis of the sensing data, generating sensing sequence data sorted according to collection moments; inputting the sensing sequence data into a time sequence model, which is trained on the basis of several sensing sequence data samples marked with user behaviors, for calculation, so as to obtain user behaviors of evidence collection personnel within the verification time period, and on the basis of the user behaviors, generating a first sequence sorted according to occurrence moments; and sending the first sequence to a server end, then the server end matching the first sequence with a second sequence of the evidence collection personnel that is obtained by means of performing data analysis on evidence collection environment record information, which is acquired by the evidence collection terminal, of the evidence collection personnel within the verification time period, and when the first sequence matches with the second sequence, determining that evidence collection environment verification of the evidence collection personnel is passed.

Description

Forensic environment verification method and device, and electronic equipment

Technical field

One or more embodiments of this specification relate to the field of computer application technology, and in particular to a method and device for forensic environment verification, and electronic equipment.

Background technique

In judicial forensics work, there are often situations where forensics personnel need to go to the forensic environment for on-site evidence collection. For example, for criminal cases, forensics personnel need to go to the crime scene as the forensic environment for on-site evidence collection. In this case, how to verify the forensic environment to ensure that the forensic personnel go to the correct forensic environment, thereby ensuring the authenticity and reliability of the judicial forensic work, has become an urgent problem to be solved.

Summary of the invention

This specification proposes a forensic environment verification method, which is applied to a forensic terminal; the method includes: acquiring sensor data collected by a sensor mounted on the forensic terminal within a verification time period, and based on the sensor The data generates the sensor sequence data sorted according to the collection time; the sensor sequence data is input into the time sequence model for calculation to obtain the user behavior of the forensic personnel during the verification time period, and the user behavior is generated based on the user behavior. A first user behavior sequence sorted at the time of occurrence; wherein the time series model is a machine learning model trained based on a number of sensor sequence data samples marked with user behavior; the first user behavior sequence is sent to the server , Using the server to compare the first user behavior sequence with the forensic personnel obtained by data analysis on the forensic environment record information of the forensic personnel acquired by the forensic terminal during the verification time period The second user behavior sequence of the user is matched, and when the first user behavior sequence matches the second user behavior sequence, it is determined that the forensic environment of the forensic personnel passes the verification.

Optionally, the verification time period includes a preset time period when the forensic personnel goes to the forensic environment.

Optionally, the preset time period includes a time period between the time when the evidence collection starts and the time when the collected evidence is uploaded.

Optionally, the sensor includes an acceleration sensor, a gyroscope, and a barometer.

Optionally, the machine learning model is a long and short-term memory LSTM model or a gated recurrent unit GRU model.

Optionally, the inputting the sensor sequence data into a time sequence model for calculation includes: inputting the sensor sequence data into a locally deployed time sequence model for calculation; or, adding the sensor sequence data Input to the time series model deployed on the server for calculation.

Optionally, the forensic environment record is any one of video data, picture data, audio data, and text data collected by the forensic terminal.

Optionally, when the first user behavior sequence matches the second user behavior sequence, determining that the forensic environment of the forensic personnel has passed verification includes: 2. When the user behavior sequence matches, it is determined that the forensic environment of the forensic personnel is verified, and the evidence collected in the forensic environment sent by the forensic terminal is released to the blockchain for storage.

This specification also proposes a forensic environment verification device, which is applied to a forensic terminal; the device includes: an acquisition module, which acquires sensor data collected by a sensor mounted on the forensic terminal during the verification period, and is based on The sensor data generates the sensor sequence data sorted according to the collection time; the generating module inputs the sensor sequence data into the time sequence model for calculation to obtain the user behavior of the forensic personnel during the verification time period, and Based on the user behavior, a first user behavior sequence sorted according to the time of occurrence is generated; wherein, the time series model is a machine learning model trained based on a number of sensor sequence data samples labeled with user behavior; The first user behavior sequence is sent to the server, so that the server combines the first user behavior sequence with the forensic environment record of the forensic personnel acquired by the forensic terminal during the verification time period. The second user behavior sequence of the forensic personnel obtained by data analysis of the information is matched, and when the first user behavior sequence matches the second user behavior sequence, it is determined that the forensic environment of the forensic personnel passes the verification.

Optionally, the generating module: inputs the sensor sequence data into a locally deployed time sequence model for calculation; or, inputs the sensor sequence data into a time sequence model deployed on the server for calculation.

This specification also proposes an electronic device including: a processor; a memory for storing executable instructions of the processor; wherein the processor executes the executable instructions to implement the steps of the above method.

This specification also proposes a computer-readable storage medium on which computer instructions are stored, and when the instructions are executed by a processor, the steps of the above-mentioned method are realized.

In the above technical solution, the first user behavior of the forensic personnel can be determined through the sensor data collected by the sensors on the forensic terminal held by the forensic personnel, and the first user behavior can be compared with those obtained through the forensic terminal. The second user behavior of the forensic person determined by the record information of the forensic environment in the forensic environment is matched to determine that the forensic environment of the forensic person is verified when the first user behavior matches the second user behavior. That is, the verification of the forensic environment can be realized to ensure that the forensic personnel go to the correct forensic environment, thereby ensuring the authenticity and reliability of the judicial forensic work.

Description of the drawings

Fig. 1 is a schematic diagram of a forensic environment verification system shown in an exemplary embodiment of this specification;

Fig. 2 is a flowchart of a verification method for a forensic environment shown in an exemplary embodiment of this specification;

Fig. 3 is a schematic diagram of a forensics interface shown in an exemplary embodiment of this specification;

Fig. 4 is a schematic diagram of a verification interface shown in an exemplary embodiment of the present specification;

Fig. 5 is a hardware structure diagram of an electronic device where a verification device for a forensic environment is shown in an exemplary embodiment of this specification;

Fig. 6 is a block diagram of a verification device for a forensic environment shown in an exemplary embodiment of this specification.

Detailed ways

The exemplary embodiments will be described in detail here, and examples thereof are shown in the accompanying drawings. When the following description refers to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementation manners described in the following exemplary embodiments do not represent all implementation manners consistent with one or more embodiments of this specification. On the contrary, they are merely examples of devices and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

The terms used in this specification are only for the purpose of describing specific embodiments, and are not intended to limit the specification. The singular forms of "a", "said" and "the" used in this specification and appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and/or" as used herein refers to and includes any or all possible combinations of one or more associated listed items.

It should be understood that although the terms first, second, third, etc. may be used in this specification to describe various information, the information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of this specification, the first information may also be referred to as second information, and similarly, the second information may also be referred to as first information. Depending on the context, the word "if" as used herein can be interpreted as "when" or "when" or "in response to determination".

The purpose of this application is to provide a way to determine the first user behavior of the forensic personnel through the sensor data collected by the sensors on the forensic terminal held by the forensic personnel, and to compare the first user behavior with those obtained through the forensic terminal A technical solution for matching the second user behavior of the forensic personnel determined by the record information of the forensic environment of the forensic personnel to verify the forensic environment of the forensic personnel.

In specific implementation, the forensic terminal can obtain the sensor data collected by the sensor mounted on the forensic terminal during the verification period, and sort the sensor data according to the collection time, so as to obtain the sensor data sorted by the collection time. Sequence data.

Subsequently, the forensic terminal can input the sensor sequence data into a time series model that is deployed in the forensic terminal and is trained based on a number of sensor sequence data samples marked with user behaviors for calculation, so as to obtain the forensic personnel’s presence in the forensic terminal. Verify the user behavior within the time period, and sort the user behaviors according to the time of occurrence to obtain the first user behavior sequence sorted according to the time of occurrence, and then send the first user behavior sequence to the server. The server may perform data analysis on the forensic environment record information of the forensic personnel during the verification time period obtained by the forensic terminal to obtain the second user behavior sequence of the forensic personnel in order of occurrence time. The server may further match the first user behavior sequence with the second user behavior sequence to determine that the forensic environment of the forensic personnel passes the verification when the first user behavior matches the second user behavior.

Alternatively, the time series model can be deployed on the server. In this case, the forensic terminal can send the sensing sequence data to the server, and the server inputs the sensing sequence data to the time series model deployed on the server for calculation, so as to obtain the forensic personnel The user behaviors in the verification time period are sorted according to the time of occurrence, so as to obtain the first user behavior sequence sorted according to the time of occurrence. The server may perform data analysis on the forensic environment record information of the forensic personnel during the verification time period obtained by the forensic terminal to obtain the second user behavior sequence of the forensic personnel in the order of occurrence time. The server may further match the first user behavior sequence with the second user behavior sequence to determine that the forensic environment of the forensic personnel passes the verification when the first user behavior matches the second user behavior.

Please refer to FIG. 1, which is a schematic diagram of a forensic environment verification system shown in an exemplary embodiment of this specification.

In judicial forensics work, there are often situations where forensics personnel need to go to the forensic environment for on-site evidence collection. For example, for criminal cases, forensics personnel need to go to the crime scene as the forensic environment for on-site evidence collection. In practical applications, forensics personnel usually hold electronic devices such as cameras, mobile phones, tablet devices, or PDAs (Personal Digital Assistants) to go to the forensic environment in order to record the evidence collected in the forensic environment.

In the forensic environment verification system shown in FIG. 1, the forensic terminal may be an electronic device held by the forensic personnel when they go to the forensic environment. The forensic terminal can obtain the data used for forensic environment verification when the forensic personnel goes to the forensic environment, and cooperate with the server to complete the verification of the forensic environment based on the acquired data; wherein, the server can Run in electronic equipment such as servers or computers other than the forensic terminal.

Please refer to FIG. 2, which is a flowchart of a verification method for a forensic environment according to an exemplary embodiment of this specification.

This forensic environment verification method can be applied to the forensic terminal shown in FIG. 1, and includes the following steps 202 to 206.

Step 202: Acquire sensor data collected by the sensor mounted on the forensic terminal during the verification time period, and generate sensor sequence data sorted according to the collection time based on the sensor data.

Step 204: Input the sensor sequence data into a time series model for calculation to obtain the user behavior of the forensic personnel during the verification time period, and generate a first user behavior sequence sorted according to the time of occurrence based on the user behavior ; Wherein, the time series model is a machine learning model trained based on a number of sensor sequence data samples marked with user behavior.

Step 206: Send the first user behavior sequence to the server, so that the server will compare the first user behavior sequence with the forensic personnel acquired by the forensic terminal during the verification time period. The second user behavior sequence of the forensic personnel obtained by data analysis of the forensic environment record information in the forensic environment is matched, and when the first user behavior sequence matches the second user behavior sequence, the forensic personnel’s behavior is determined Forensic environment verification passed.

In this embodiment, the sensor mounted on the forensic terminal can collect sensor data in real time, and upload the collected sensor data to the CPU (Central Processing Unit) of the forensic terminal, so that the forensic terminal can The sensor data collected by the sensor mounted on the forensic terminal is recorded. In this case, the forensic terminal can obtain the sensor data collected by the sensor mounted on the forensic terminal during the verification time period.

In the illustrated embodiment, the above-mentioned sensors may include: an acceleration sensor, a gyroscope, and a barometer. That is, the forensic terminal can obtain the acceleration data collected by the acceleration sensor mounted on the forensic terminal, the angular motion data collected by the gyroscope mounted on the forensic terminal, and the acceleration data collected by the forensic terminal during the verification time period. The barometric pressure data collected by the barometer.

In practical applications, the user's movement speed can be determined based on acceleration data, the user's movement direction can be determined based on angular movement data, and the user's movement height can be determined based on air pressure data (for example, the poster or floor where the user is located). That is, according to the sensor data collected by the acceleration sensor, gyroscope, and barometer mounted on the forensic terminal, the user behavior of the forensic personnel when going to the forensic environment can be determined; wherein, the user behavior can be walking, riding, or driving. Walk upstairs, take the elevator, etc.

It should be noted that the forensic terminal can also obtain sensor data collected by sensors other than the acceleration sensor, gyroscope, and barometer carried by the forensic terminal during the verification period according to actual business needs. This manual does not restrict this.

In the illustrated embodiment, the verification time period may include a preset time period in the process of the forensic personnel going to the forensic environment; wherein the preset time period may be a time period preset by a technician.

Specifically, the above-mentioned preset time period may include a complete time period between the time when the forensics starts and the time when the collected evidence is uploaded, or may include a time period intercepted from the complete time period; wherein, the start of the forensics The time can be the time when the forensic personnel opens the forensic terminal (in practical applications, the forensic personnel usually opens the forensic terminal when they set off to go to the forensic environment), and the time when the collected evidence is uploaded can be the time when the forensic personnel completes the forensics and The time when the collected evidence is uploaded through the forensic terminal.

For example, the forensic terminal may display the forensic interface as shown in FIG. 3 to the forensic personnel. The forensic officer can add or delete collected evidence (such as video data, picture data, audio data, or text data as evidence) through the forensic interface, and when completing the input of the evidence, the information in the forensic interface can be added or deleted. The "Upload" button performs a click operation. When the forensic terminal detects the click operation, the evidence input by the forensic personnel can be uploaded to the server, so that the server performs subsequent business processing based on the evidence. In this case, the forensic terminal can obtain information from the moment the forensic terminal is turned on (that is, the moment when the forensic starts) to the moment when the forensic terminal detects the click operation (that is, the moment when the collected evidence is uploaded). During this complete time period, the sensor data collected by the sensor mounted on the forensic terminal.

In another example, a suitable time length may be preset by the technician as the time length of the preset time period. The forensic terminal can obtain the sensor data collected by the sensor mounted on the forensic terminal before the time when the collected evidence is uploaded and the time period is the time period preset by the technician. For example, suppose that the time length set by the technician in advance is 30 minutes, and the time of uploading the collected evidence is 18:40, then the forensic terminal can obtain it in the time period from 18:10 to 18:40, The sensor data collected by the sensor mounted on the forensic terminal.

In another example, when the technician receives the collected evidence uploaded by the forensic personnel through the forensic terminal at the server, a suitable time period can be preset through the server as the preset time period, And the server sends the time period preset by the technician to the forensic terminal. The forensic terminal can obtain the sensor data collected by the sensor mounted on the forensic terminal within the time period preset by the technician. For example, assuming that the time of uploading the collected evidence is 18:40, the technician can set the time period from 18:10 to 18:40 as the preset time period, so that the forensic terminal can Obtain the sensor data collected by the sensor mounted on the forensic terminal during the time period from 18:10 to 18:40.

In this embodiment, when the forensic terminal obtains the sensor data collected by the sensor mounted on the forensic terminal during the verification time period, the sensor sequence data may be generated based on the sensor data.

In practical applications, when the forensic terminal records a certain sensor data collected by the sensor mounted on the forensic terminal, it usually records the collection time of the sensor data at the same time (the CPU of the forensic terminal can receive the The time of sensing data is regarded as the time of collecting the sensing data). That is, the forensic terminal can have a corresponding relationship between the sensor data collected by the sensor mounted on the forensic terminal and the collection time.

In the above case, the forensic terminal can sort the acquired sensor data collected by the sensor mounted on the forensic terminal during the above verification period according to the collection time, and use the sorted sensor data as the transmission Sense sequence data.

For example, suppose the verification time period is from 18:10 to 18:40, and further suppose that the forensic terminal obtains the information collected by the acceleration sensor carried by the forensic terminal during the verification time period. The acceleration data is shown in Table 1 below, and the angular motion data collected by the gyroscope on the forensic terminal is shown in Table 2 below.

采集时刻(时：分：秒)Collection time (hour: minute: second)	加速度数据Acceleration data
18:10:0018:10:00	加速度数据1 Acceleration data 1
18:10:1018:10:10	加速度数据2 Acceleration data 2
18:10:2018:10:20	加速度数据3 Acceleration data 3
……...	……...

Table 1

采集时刻(时：分：秒)Collection time (hour: minute: second)	角运动数据Angular motion data
18:10:0018:10:00	角运动数据1 Angular movement data 1
18:10:0518:10:05	角运动数据2 Angular movement data 2
18:10:1018:10:10	角运动数据3 Angular movement data 3
18:10:1518:10:15	角运动数据4 Angular movement data 4
18:10:2018:10:20	角运动数据5Angular movement data 5
……...	……...

Table 2

In this case, the sensor sequence data sorted by collection time and generated by the forensic terminal based on the acceleration data and the angular motion data can be as shown in Table 3 below:

18:10:0018:10:00	加速度数据1 Acceleration data 1
18:10:0018:10:00	角运动数据1 Angular movement data 1
18:10:0518:10:05	角运动数据2 Angular movement data 2
18:10:1018:10:10	加速度数据2 Acceleration data 2
18:10:1018:10:10	角运动数据3 Angular movement data 3
18:10:1518:10:15	角运动数据4 Angular movement data 4
18:10:2018:10:20	加速度数据3 Acceleration data 3
18:10:2018:10:20	角运动数据5Angular movement data 5
……...	……...

table 3

In this embodiment, when the aforementioned forensic terminal generates the aforementioned sensor sequence data sorted according to the collection time, the sensor sequence data can be input into a pre-trained time series model for calculation, so that the time series model can be used for calculation. The user behavior of the forensic personnel during the verification time period is calculated, and a first user behavior sequence sorted according to the time of occurrence is generated based on the obtained user behavior.

It should be noted that the time series model may be a machine learning model trained based on a number of sensor sequence data samples marked with user behaviors.

In practical applications, on the one hand, the time series model can be an LSTM (Long Short-Term Memory) model or a GRU (Gated Recurrent Unit) model; on the other hand, the user Behaviors can be user behaviors of forensic personnel when they go to the forensic environment, such as walking, riding in a car, walking upstairs, or taking an elevator upstairs.

For example, the time series model can divide the sensor data in the sensor sequence data into multiple groups according to a certain time granularity, and calculate based on each group of sensor data respectively, and obtain the corresponding sensor data for each group. The user behavior; where the value of the time granularity can be a value set by a technician for the time series model, or can be a default value defaulted by the time series model, which is not limited in this specification. Subsequently, the forensic terminal may integrate the obtained user behaviors corresponding to each set of sensor data to generate a first user behavior sequence sorted according to the time of occurrence.

Assume that the verification time period is from 18:10 to 18:40, and further assume that the time granularity is 1 minute. In this case, the time series model can be calculated based on the sensor data in the time period from 18:10 to 18:11 in the sensor sequence data to obtain the user behavior in this time period (assuming Is walking); based on the sensor data in the time period from 18:11 to 18:12 in the sensor sequence data, the user behavior in this time period (assumed to be walking) is obtained; based on the transmission The sensor data in the time period from 18:12 to 18:13 in the sensor sequence data is calculated to obtain the user behavior (assumed to be a car ride) in this time period; based on the 18: The sensor data in the time period from hour 13 to 18: 14 is calculated to obtain the user behavior in this time period (assumed to be riding in a car); and so on. That is, the user behavior calculated by the time series model is shown in Table 4 below.

发生时刻When it happened	用户行为user behavior
18:10:0018:10:00	步行walk
18:11:0018:11:00	步行walk
18:12:0018:12:00	乘车Ride
18:13:0018:13:00	乘车Ride
……...	……...

Table 4

Subsequently, the forensic terminal may integrate the user behaviors calculated by the time series model to generate a first user behavior sequence sorted according to the time of occurrence. The first user behavior sequence may be shown in Table 5 below.

发生时刻When it happened	用户行为user behavior
18:10:0018:10:00	步行walk
18:12:0018:12:00	乘车Ride
……...	……...

table 5

In this embodiment, when the forensic terminal generates the first user behavior sequence sorted by the time of occurrence, the first user behavior sequence may be sent to the server, so that the server can base the first user behavior on the server. The behavior sequence performs forensic environment verification.

It should be noted that the above-mentioned time series model can be deployed locally on the above-mentioned forensic terminal, that is, the forensic terminal directly inputs the above-mentioned sensing sequence data into the time series model for calculation, and is based on the user behavior calculated by the time series model. The first user behavior sequence is generated, and the first user behavior sequence is sent to the server, so that the server performs forensic environment verification based on the first user behavior sequence.

Alternatively, the above-mentioned time series model may be deployed on the above-mentioned server, that is, the above-mentioned forensic terminal may send the above-mentioned sensor sequence data to the server, so that the server can input the sensor sequence data into the time series model for calculation, The first user behavior sequence is generated based on the user behavior calculated by the time sequence model, and then the forensic environment verification is performed based on the first user behavior sequence.

In this embodiment, the server may specifically compare the first user behavior sequence with the forensic personnel obtained by data analysis of the forensic environment record information of the forensic personnel obtained by the forensic terminal during the verification period. The second user behavior sequence is matched.

In the illustrated embodiment, the aforementioned forensic environment record may be any one of video data, picture data, audio data, and text data collected by the forensic terminal.

In practical applications, the server can display the forensic environment record to the verifier, so that the verifier can analyze the forensic environment record by himself to determine the behavior of each user of the forensic person during the verification period, and The time when each user's behavior occurs, and through the verification interface provided by the server, enter the determined user behavior of the forensic personnel and the time when the user behavior occurs. The server may further generate a user behavior sequence based on the user behavior input by the verifier and the time when the user behavior occurs, as the second user behavior sequence of the forensic personnel.

For example, the server can display the verification interface as shown in FIG. 4 to the verification personnel. The verifier can input the user behavior and the time of the user behavior determined by analyzing the forensic environment record through the verification interface, and when the input is completed, click the "confirm" button in the verification interface. When the server detects the click operation, it can generate a second user behavior sequence as shown in Table 6 below based on the user behavior input by the verifier and the time when the user behavior occurs.

Table 6

Alternatively, the server can perform data analysis on the forensic environment record, for example: perform data analysis on the forensic environment record based on a machine learning algorithm to obtain the user behavior of the forensic personnel during the verification period, and based on the obtained The user behavior generates a second user behavior sequence sorted according to the time of occurrence.

For example, assuming that the forensic environment record is picture sequence data, a time series model trained based on a number of picture sequence data samples marked with user behaviors can be used, and the time series model is calculated based on the forensic environment record to obtain Based on the user behavior of the forensic personnel during the verification time period, a second user behavior sequence sorted according to the time of occurrence is generated based on the obtained user behavior.

In this embodiment, if the above-mentioned first user behavior matches the above-mentioned second user behavior sequence, it can be determined that the forensic environment of the forensic personnel has passed the verification.

Taking the first user behavior sequence shown in Table 5 above and the second user behavior sequence shown in Table 6 above as an example, since the first user behavior sequence and the second user behavior sequence are both: 18:10:00 , Walk; 18:12:00, ride;..., so in this case, it can be determined that the first user's behavior matches the second user's behavior, so that it can be determined that the forensic environment of the forensic personnel has passed the verification.

In the illustrated embodiment, the server terminal may send the evidence (for example: video data) collected in the forensic environment sent by the forensic terminal after the verification of the forensic environment of the forensic personnel is passed. , Picture data, audio data, or text data, etc. as evidence) is released to the blockchain for storage to avoid tampering of the evidence and ensure the data security of the evidence.

Corresponding to the foregoing embodiment of the forensic environment verification method, this specification also provides an embodiment of the forensic environment verification device.

The embodiments of the forensic environment verification device in this specification can be applied to electronic equipment. The device embodiments can be implemented by software, or can be implemented by hardware or a combination of software and hardware. Taking software implementation as an example, as a logical device, it is formed by reading the corresponding computer program instructions in the non-volatile memory into the memory through the processor of the electronic device where it is located. From a hardware perspective, as shown in Figure 5, a hardware structure diagram of the electronic equipment where the forensic environment verification device is located in this manual, except for the processor, memory, network interface, and nonvolatile memory shown in Figure 5 In addition, the electronic device where the device is located in the embodiment is usually verified according to the actual function of the forensic environment, and may also include other hardware, which will not be repeated here.

Please refer to FIG. 6, which is a block diagram of a verification device for a forensic environment according to an exemplary embodiment of this specification. The forensic environment verification device 60 can be applied to the electronic equipment as the forensic terminal shown in FIG. The sensor data generates the sensor sequence data sorted according to the collection time; the generating module 602 inputs the sensor sequence data into the time sequence model for calculation to obtain the user behavior of the forensic personnel during the verification time period, And based on the user behavior, a first user behavior sequence sorted according to the time of occurrence is generated; wherein, the time series model is a machine learning model trained based on a number of sensor sequence data samples labeled with user behavior; a verification module 603, The first user behavior sequence is sent to the server, so that the server will compare the first user behavior sequence with the forensics obtained by the forensic personnel during the verification time period obtained by the forensic terminal. The second user behavior sequence of the forensic personnel obtained by data analysis of the environmental record information is matched, and when the first user behavior sequence matches the second user behavior sequence, the forensic environment verification of the forensic personnel is determined pass.

In this embodiment, the verification time period includes a preset time period when the forensic personnel goes to the forensic environment.

In this embodiment, the preset time period includes the time period between the time when the evidence collection starts and the time when the collected evidence is uploaded.

In this embodiment, the sensors include: an acceleration sensor, a gyroscope, and a barometer.

In this embodiment, the machine learning model is a long and short-term memory LSTM model or a gated recurrent unit GRU model.

In this embodiment, the generation module 602: inputs the sensor sequence data into a locally deployed time sequence model for calculation; or, inputs the sensor sequence data into a time sequence model deployed on the server Calculation.

In this embodiment, the forensic environment record is any one of video data, picture data, audio data, and text data collected by the forensic terminal.

In this embodiment, when the first user behavior sequence matches the second user behavior sequence, determining that the forensic environment of the forensic personnel is verified includes:

When the first user behavior sequence matches the second user behavior sequence, it is determined that the forensic environment of the forensic personnel has passed the verification, and the evidence collected in the forensic environment sent by the forensic terminal is released to The blockchain is used for deposit certification.

For the implementation process of the functions and roles of each module in the above-mentioned device, please refer to the implementation process of the corresponding steps in the above-mentioned method for details, which will not be repeated here.

For the device embodiment, since it basically corresponds to the method embodiment, the relevant part can refer to the part of the description of the method embodiment. The device embodiments described above are merely illustrative, and the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in One place, or it can be distributed to multiple network modules. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution in this specification. Those of ordinary skill in the art can understand and implement without creative work.

The systems, devices, modules, or units illustrated in the above embodiments may be specifically implemented by computer chips or entities, or implemented by products with certain functions. A typical implementation device is a computer. The specific form of the computer can be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email receiving and sending device, and a game control A console, a tablet computer, a wearable device, or a combination of any of these devices.

In a typical configuration, the computer includes one or more processors (CPU), input/output interfaces, network interfaces, and memory.

The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). Memory is an example of computer readable media.

Computer-readable media include permanent and non-permanent, removable and non-removable media, and information storage can be realized by any method or technology. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical storage, Magnetic cassettes, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices, or any other non-transmission media, can be used to store information that can be accessed by computing devices. According to the definition in this article, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.

It should also be noted that the terms "include", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or equipment including a series of elements not only includes those elements, but also includes Other elements that are not explicitly listed, or also include elements inherent to such processes, methods, commodities, or equipment. If there are no more restrictions, the element defined by the sentence "including a..." does not exclude the existence of other identical elements in the process, method, commodity, or equipment that includes the element.

The foregoing describes specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims can be performed in a different order than in the embodiments and still achieve desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or sequential order shown in order to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and/or" as used herein refers to and includes any or all possible combinations of one or more associated listed items.

It should be understood that although the terms first, second, third, etc. may be used to describe various information in one or more embodiments of this specification, the information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first information may also be referred to as second information, and similarly, the second information may also be referred to as first information. Depending on the context, the word "if" as used herein can be interpreted as "when" or "when" or "in response to determination".

The above descriptions are only preferred embodiments of one or more embodiments of this specification, and are not intended to limit one or more embodiments of this specification. All within the spirit and principle of one or more embodiments of this specification, Any modification, equivalent replacement, improvement, etc. made should be included in the protection scope of one or more embodiments of this specification.

Claims

A verification method for a forensic environment, the method is applied to a forensic terminal; the method includes:

Acquiring sensor data collected by the sensor mounted on the forensic terminal during the verification time period, and generating sensor sequence data sorted according to the collection time based on the sensor data;

The sensor sequence data is input into a time series model for calculation to obtain the user behavior of the forensic personnel during the verification time period, and based on the user behavior, a first user behavior sequence sorted according to the time of occurrence is generated; wherein, The time series model is a machine learning model trained based on a number of sensor sequence data samples marked with user behaviors;

The first user behavior sequence is sent to the server, so that the server will compare the first user behavior sequence with the forensics obtained by the forensic personnel during the verification time period obtained by the forensic terminal. The second user behavior sequence of the forensic personnel obtained by data analysis of the environmental record information is matched, and when the first user behavior sequence matches the second user behavior sequence, the forensic environment verification of the forensic personnel is determined pass.
The method according to claim 1, wherein the verification time period includes a preset time period in the process of the forensic personnel going to the forensic environment.
The method according to claim 2, wherein the preset time period includes a time period between the time when the evidence collection starts and the time when the collected evidence is uploaded.
The method according to claim 1, wherein the sensors include: an acceleration sensor, a gyroscope, and a barometer.
The method according to claim 1, wherein the machine learning model is a long and short-term memory LSTM model or a gated recurrent unit GRU model.
The method according to claim 1, wherein said inputting said sensor sequence data into a time sequence model for calculation comprises:

Input the sensor sequence data into a locally deployed time sequence model for calculation; or,

The sensor sequence data is input into a time sequence model deployed on the server for calculation.
The method according to claim 1, wherein the forensic environment record is any one of video data, picture data, audio data, and text data collected by the forensic terminal.
The method according to claim 1, wherein when the first user behavior sequence matches the second user behavior sequence, determining that the forensic environment of the forensic personnel has passed verification includes:

When the first user behavior sequence matches the second user behavior sequence, it is determined that the forensic environment of the forensic personnel has passed the verification, and the evidence collected in the forensic environment sent by the forensic terminal is released to The blockchain is used for deposit certification.
A verification device for a forensic environment, the device is applied to a forensic terminal; the device includes:

An acquisition module, which acquires sensor data collected by the sensor mounted on the forensic terminal during the verification time period, and generates sensor sequence data sorted according to the collection time based on the sensor data;

The generation module inputs the sensor sequence data into a time series model for calculation to obtain the user behavior of the forensic personnel during the verification time period, and based on the user behavior, generates a first user behavior sequence sorted according to the time of occurrence ; Wherein, the time series model is a machine learning model trained based on a number of sensor sequence data samples marked with user behavior;

The verification module sends the first user behavior sequence to the server, so that the server will compare the first user behavior sequence with the forensic personnel acquired by the forensic terminal during the verification time period. The second user behavior sequence of the forensic personnel obtained by data analysis of the forensic environment record information in the forensics is matched, and when the first user behavior sequence matches the second user behavior sequence, the forensic personnel’s behavior is determined Forensic environment verification passed.
The device according to claim 9, wherein the verification time period includes a preset time period in the process of the forensic personnel going to the forensic environment.
The device according to claim 10, wherein the preset time period includes a time period between the time when the evidence collection starts and the time when the collected evidence is uploaded.
The device according to claim 9, wherein the sensor comprises: an acceleration sensor, a gyroscope, and a barometer.
The device according to claim 9, wherein the machine learning model is a long short-term memory LSTM model or a gated recurrent unit GRU model.
The device according to claim 9, wherein the generating module:

Input the sensor sequence data into a locally deployed time sequence model for calculation; or,

The sensor sequence data is input into a time sequence model deployed on the server for calculation.
The device according to claim 9, wherein the forensic environment record is any one of video data, picture data, audio data, and text data collected by the forensic terminal.
The device according to claim 9, wherein when the first user behavior sequence matches the second user behavior sequence, determining that the forensic environment of the forensic personnel is verified, comprises:

When the first user behavior sequence matches the second user behavior sequence, it is determined that the forensic environment of the forensic personnel has passed the verification, and the evidence collected in the forensic environment sent by the forensic terminal is released to The blockchain is used for deposit certification.
An electronic device including:

processor;

A memory for storing processor executable instructions;

Wherein, the processor implements the method according to any one of claims 1 to 8 by running the executable instruction.
A computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 8.