Movatterモバイル変換


[0]ホーム

URL:


CN106775701B - Client automatic evidence obtaining method and system - Google Patents

Client automatic evidence obtaining method and system
Download PDF

Info

Publication number
CN106775701B
CN106775701BCN201611130991.0ACN201611130991ACN106775701BCN 106775701 BCN106775701 BCN 106775701BCN 201611130991 ACN201611130991 ACN 201611130991ACN 106775701 BCN106775701 BCN 106775701B
Authority
CN
China
Prior art keywords
client
simulated click
screen image
simulated
current screen
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201611130991.0A
Other languages
Chinese (zh)
Other versions
CN106775701A (en
Inventor
操家庆
桂坤
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
BEIJING WANSHENG HUATONG TECHNOLOGY Co.,Ltd.
Original Assignee
Wuhan Zrtz Information Technology Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Wuhan Zrtz Information Technology Co ltdfiledCriticalWuhan Zrtz Information Technology Co ltd
Priority to CN201611130991.0ApriorityCriticalpatent/CN106775701B/en
Publication of CN106775701ApublicationCriticalpatent/CN106775701A/en
Application grantedgrantedCritical
Publication of CN106775701BpublicationCriticalpatent/CN106775701B/en
Activelegal-statusCriticalCurrent
Anticipated expirationlegal-statusCritical

Links

Images

Classifications

Landscapes

Abstract

The invention relates to a data acquisition method, in particular to a client side automatic evidence obtaining method and a system. The method comprises the following steps: step 1, in the process of evidence obtaining of a client, when an operation prompt box pops up, a simulated click position is obtained; and 2, clicking at the simulated click position by adopting a preset simulated click method so as to continue the evidence obtaining process of the client. The invention provides a client side automatic evidence obtaining method and a client side automatic evidence obtaining system, which can realize automatic clicking at a simulated clicking position when user intervention or clicking is needed through simulated gesture clicking, effectively remove or reduce the times and complexity of manual participation, and greatly improve the evidence obtaining efficiency.

Description

Client automatic evidence obtaining method and system
Technical Field
The invention relates to a data acquisition method, in particular to a client side automatic evidence obtaining method and a system.
Background
In the traditional client-side forensics process, a lot of information needs to be installed and read, for example, data extraction needs to be realized by means of installing an application or using a backup mode. When the application and the backup are installed, a dialog box prompt pops up, the user needs to click and confirm and other operations, and normal extraction of data can be guaranteed after the user operation is finished. In most cases, the time for obtaining the evidence of the client is very long, so that an operator needs to pay attention to the client all the time and perform click operation at any time, the evidence obtaining efficiency of the client is reduced, the freedom of the operator is limited, and a lot of troubles are brought to the operator.
Disclosure of Invention
The invention provides a method and a system for automatically obtaining evidence at a client, which solve the technical problems.
The technical scheme for solving the technical problems is as follows: a client side automatic forensics method comprises the following steps:
step 1, in the process of evidence obtaining of a client, when an operation prompt box pops up, a simulated click position is obtained;
and 2, clicking at the simulated click position by adopting a preset simulated click method so as to continue the evidence obtaining process of the client.
The invention has the beneficial effects that: the invention provides an automatic evidence obtaining method for a client, which can realize automatic clicking at a simulated clicking position when user intervention or clicking is needed by simulating gesture clicking, effectively remove or reduce the times and complexity of manual participation and greatly improve the evidence obtaining efficiency.
On the basis of the technical scheme, the invention can be further improved as follows.
Further, before step 1, a classification step is further included, specifically:
s1, acquiring all scenes needing simulated click in the client evidence obtaining process;
s2, testing clients of different models, judging whether the simulated click positions of the scenes remain unchanged in the clients of all models, if so, identifying the scenes as first-class scenes, and recording the simulated click positions corresponding to each first-class scene; if not, the scene is not identified;
and S3, establishing a corresponding relation table of all the first-class scenes and the corresponding simulated click positions.
The beneficial effect of adopting the further scheme is that: in a further technical scheme of the invention, the scenes needing to be clicked in the evidence obtaining process are classified, for example, in the scenes of application installation, short message reading, call record reading and the like, the simulated click position is changed, so that the simulated click position needs to be respectively obtained for a specific client. In some scenarios, for example, when backup is applied, the simulated click position is fixed and is all at the lower right corner of the screen, so that the simulated click position can be acquired in a simpler manner without repeatedly acquiring the simulated click position each time, and the evidence obtaining efficiency of the client is further improved.
Further, when the simulated click position is arranged at the lower right corner of the screen of the client, the coordinates of the simulated click position are (X-a, Y-b), wherein X is the screen length of the client, Y is the screen width of the client, the value range of a is 20-60 px, and the value range of b is 20-60 px.
The beneficial effect of adopting the further scheme is that: in the further technical scheme, when the simulated click position is arranged at the lower right corner of the screen of the client, the screen resolution of the client is firstly obtained, namely the screen length and the screen width of the client are obtained, and the preset values are respectively subtracted from the screen length and the screen width, so that the accuracy of simulated click is ensured.
Further, the step 1 specifically comprises:
s101, in the process of evidence obtaining of a client, when an operation prompt box pops up, capturing a current screen image containing the operation prompt box;
s102, judging whether the current scene is a first type scene or not according to the current screen image, if so, executing S103, and if not, executing S104;
s103, inquiring the corresponding relation table to obtain a simulated click position corresponding to the current scene;
and S104, identifying the current screen image, acquiring the position of a preset character in the current screen image, and setting the position as a simulated click position.
The beneficial effect of adopting the further scheme is that: in the further technical scheme, the click simulation scene is simulated as required, and the corresponding method is selected to obtain the click simulation position, so that the client evidence obtaining efficiency is further improved, and the client evidence obtaining time is reduced.
Further, the step S104 specifically includes: recognizing the character of the current screen image by adopting a character recognition method, and setting the position of the preset character on the current screen image as a simulated click position when the recognized character comprises the preset character; and if the recognized character does not comprise the preset character, generating and displaying alarm information.
Further, the step S104 specifically includes:
establishing a picture comprising the preset characters, and establishing a picture library;
and respectively matching the pictures in the picture library with the current screen image by adopting a matching algorithm, judging whether the current screen image contains the pictures or not, if not, generating and displaying alarm information, and if so, acquiring the coordinates of the pictures in the current screen image, and setting the coordinates as simulated click positions.
The beneficial effect of adopting the further scheme is that: in the further technical scheme, the simulated click position can be obtained by adopting a character recognition method or an image matching method, and the method is various and flexible.
In order to solve the technical problem of the invention, the invention also provides a client automatic evidence obtaining system, which comprises a position obtaining module and a clicking module,
the position acquisition module is used for acquiring a simulated click position when an operation prompt box pops up in the process of obtaining evidence by the client;
and the clicking module is used for clicking at the simulated clicking position by adopting a preset simulated clicking method so as to enable the evidence obtaining process of the client to be continued.
The invention has the beneficial effects that: the invention provides an automatic evidence obtaining system for a client, which can realize automatic clicking at a simulated clicking position when user intervention or clicking is needed by simulating gesture clicking, effectively remove or reduce the times and complexity of manual participation and greatly improve the evidence obtaining efficiency.
Further, still include the classification module, the classification module includes:
the scene acquisition unit is used for acquiring all scenes needing simulated clicking in the evidence obtaining process of the client;
the testing unit is used for testing the clients of different models, judging whether the simulated click positions of the scenes remain unchanged in all the clients of all the models, if so, identifying the scenes as first-class scenes, and recording the simulated click positions corresponding to each first-class scene; if not, the scene is not identified;
and the table building unit is used for building a corresponding relation table of all the first-class scenes and the corresponding simulated click positions.
Further, the position acquisition module includes:
the screen capture unit is used for capturing a current screen image containing an operation prompt box when the operation prompt box pops up in the process of obtaining evidence by the client;
the judging unit is used for judging whether the current scene is a first type scene or not according to the current screen image, if so, the inquiring unit is driven, and if not, the identifying unit is driven;
the query unit is used for querying the corresponding relation table and acquiring the simulated click position corresponding to the current scene;
and the identification unit is used for identifying the current screen image, acquiring the position of a preset character in the current screen image, and setting the position as a simulated click position.
Further, the recognition unit comprises a character recognition unit and/or an image recognition unit,
the character recognition unit is used for recognizing the character characters of the current screen image by adopting a character recognition method, and when the recognized character characters comprise the preset characters, setting the position of the preset characters on the current screen image as a simulated click position; if the recognized character does not comprise the preset character, generating and displaying alarm information;
the image recognition unit is used for respectively matching pictures in a picture library established in advance with the current screen image by adopting a matching algorithm, judging whether the current screen image contains the pictures or not, if not, generating and displaying alarm information, if so, acquiring the coordinates of the pictures in the current screen image, and setting the coordinates as simulated click positions; the pictures in the picture library comprise the preset characters.
Drawings
Fig. 1 is a schematic flow chart of a method for automatically forensics at a client according to an embodiment of the present invention;
fig. 2 is a schematic structural block diagram of an automatic client forensics system according to an embodiment of the present invention;
fig. 3 is a schematic structural block diagram of an automatic client forensics system according to another embodiment of the present invention.
Detailed Description
The principles and features of this invention are described below in conjunction with the following drawings, which are set forth by way of illustration only and are not intended to limit the scope of the invention.
Fig. 1 is a schematic flowchart of a method for automatically obtaining evidence at a client according to an embodiment of the present invention, as shown in fig. 1, including the following steps:
step 1, in the process of evidence obtaining of a client, when an operation prompt box pops up, a simulated click position is obtained;
and 2, clicking at the simulated click position by adopting a preset simulated click method so as to continue the evidence obtaining process of the client. The embodiment provides an automatic evidence obtaining method for a client, which can realize automatic clicking at a simulated clicking position when user intervention or clicking is needed by simulating gesture clicking when evidence is obtained for the client, such as a mobile phone, so that the times and complexity of manual participation are effectively removed or reduced, and the evidence obtaining efficiency is greatly improved.
In a preferred embodiment, before the step 1, a classification step is further included, specifically:
s1, acquiring all scenes needing simulated click in the client evidence obtaining process;
s2, testing clients of different models, judging whether the simulated click positions of the scenes remain unchanged in the clients of all models, if so, identifying the scenes as first-class scenes, and recording the simulated click positions corresponding to each first-class scene; if not, the scene is not identified;
and S3, establishing a corresponding relation table of all the first-class scenes and the corresponding simulated click positions. In this specific embodiment, after classifying the scenes, the step 1 of obtaining the simulated click position includes the following steps:
s101, in the process of evidence obtaining of a client, when an operation prompt box pops up, capturing a current screen image containing the operation prompt box;
s102, judging whether the current scene is a first type scene or not according to the current screen image, if so, executing S103, and if not, executing S104;
s103, inquiring the corresponding relation table to obtain a simulated click position corresponding to the current scene;
and S104, identifying the current screen image, acquiring the position of a preset character in the current screen image, and setting the position as a simulated click position.
In the embodiment, the corresponding method can be selected to obtain the simulated click position according to the scene of simulated click as required, so that the client-side evidence obtaining efficiency is further improved, and the client-side evidence obtaining time is reduced. Specifically, the scenes that need to be clicked in the forensics process are classified, for example, in the scenes of application installation, short message reading, call record reading, and the like, the simulated click position changes, so that the simulated click position needs to be acquired for a specific client, and the following description is given by using a specific embodiment. In some scenarios, for example, when backup is applied, the simulated click position is fixed and is all at the lower right corner of the screen, so that the simulated click position can be acquired in a simpler manner without repeatedly acquiring the simulated click position each time, and the evidence obtaining efficiency of the client is further improved. For example, in a certain embodiment, it is found through testing that interfaces for popping up backups of substantially all devices are consistent, and in this case, the backup button is fixed at the lower right corner of the screen, so that information such as resolution of the screen can be remotely acquired through an adb dumpsys instruction, in order to ensure the accuracy of clicking, 50px is subtracted from the length and width of the screen, and then the obtained length and width value is the coordinate position of the simulated clicking.
Preferably, when the simulated click position is not fixed, the simulated click position is obtained by a character recognition method, which specifically comprises the following steps: recognizing the character of the current screen image by adopting a character recognition method, and setting the position of the preset character on the current screen image as a simulated click position when the recognized character comprises the preset character; and if the recognized character does not comprise the preset character, generating and displaying alarm information. Specifically, when a dialog box pops up, a screen under the system is called by adb, the current screen image is intercepted, and then the current screen image is saved to a position such as sdcard, and then the current screen image is acquired to the local through adb pull. After the screen image is successfully acquired, preset characters, such as the position of an 'allow' button, are acquired through an OCR character recognition method. An OCR character recognition method comprises a free tesseract version with a google open source and a commercial platform, wherein a character library is established, comprises all Chinese characters or Chinese characters, and may further comprise an English character library in order to adapt to a part of English system. The characters in the word stock are compared with the characters on the pictures, so that the character content of the corresponding position can be obtained, and when the 'allowed' characters are detected, the position of the picture where the current characters are located is obtained. The resolution of the picture is consistent with that of the mobile phone screen, and when the pixel point coordinates of the picture where the permission exists are obtained, the pixel point coordinates are the simulated click position of the current screen.
Preferably, in another embodiment, when the simulated click position is not fixed, the simulated click position is obtained by using an image recognition method, specifically: establishing a picture comprising the preset characters, and establishing a picture library; and respectively matching the pictures in the picture library with the current screen image by adopting a matching algorithm, judging whether the current screen image contains the pictures or not, if not, generating and displaying alarm information, and if so, acquiring the coordinates of the pictures in the current screen image, and setting the coordinates as simulated click positions. Specifically, the image recognition method is to create a picture library locally, and compare pictures in the picture library with captured screen images to determine whether a pop-up dialog box includes preset characters, such as prompt information such as "allow" and the like. If the confirmation is available, the position of the screen image where the 'allow' button is located can be obtained by calculating the matching position. In this embodiment, various algorithms, such as a SIFT algorithm, a deep learning algorithm, and the like, may be employed. After the simulated click position is obtained, the finger click operation can be realized at the simulated click position through a preset instruction, so that the function of simulating click is realized.
The above describes in detail the client automatic forensics method according to the embodiment of the present invention with reference to fig. 1, and the following describes the client automatic forensics system according to the embodiment of the present invention. Fig. 2 is a schematic structural block diagram of an automatic client forensics system according to an embodiment of the present invention, as shown in fig. 2, including a location obtaining module and a click module,
the position acquisition module is used for acquiring a simulated click position when an operation prompt box pops up in the process of obtaining evidence by the client;
and the clicking module is used for clicking at the simulated clicking position by adopting a preset simulated clicking method so as to enable the evidence obtaining process of the client to be continued. The embodiment provides an automatic evidence obtaining system for a client, when obtaining evidence for the client, such as a mobile phone, the system can realize automatic click at a simulated click position when user intervention or click is needed, effectively remove or reduce the number of times and complexity of manual participation, and greatly improve the evidence obtaining efficiency.
In a preferred embodiment, the client-side automatic forensics system further includes a classification module, as shown in fig. 3, the classification module includes:
the scene acquisition unit is used for acquiring all scenes needing simulated clicking in the evidence obtaining process of the client;
the testing unit is used for testing the clients of different models, judging whether the simulated click positions of the scenes remain unchanged in all the clients of all the models, if so, identifying the scenes as first-class scenes, and recording the simulated click positions corresponding to each first-class scene; if not, the scene is not identified;
and the table building unit is used for building a corresponding relation table of all the first-class scenes and the corresponding simulated click positions. In this embodiment, the position obtaining module of the client automatic forensics system includes:
the screen capture unit is used for capturing a current screen image containing an operation prompt box when the operation prompt box pops up in the process of obtaining evidence by the client;
the judging unit is used for judging whether the current scene is a first type scene or not according to the current screen image, if so, the inquiring unit is driven, and if not, the identifying unit is driven;
the query unit is used for querying the corresponding relation table and acquiring the simulated click position corresponding to the current scene;
and the identification unit is used for identifying the current screen image, acquiring the position of a preset character in the current screen image, and setting the position as a simulated click position. In the preferred embodiment, the corresponding method can be selected to obtain the simulated click position according to the scene of simulated click as required, so that the client-side evidence obtaining efficiency is further improved, and the client-side evidence obtaining time is reduced.
In a preferred embodiment, the recognition unit includes a character recognition unit and an image recognition unit, as shown in fig. 3, and in other embodiments, any one of the character recognition unit and the image recognition unit may be adopted. In this preferred embodiment, the text recognition unit is configured to recognize text characters of a current screen image by using a text recognition method, and when the recognized text characters include the preset characters, set the position of the preset characters on the current screen image as a simulated click position; if the recognized character does not comprise the preset character, generating and displaying alarm information; the image recognition unit is used for respectively matching pictures in a picture library established in advance with the current screen image by adopting a matching algorithm, judging whether the current screen image contains the pictures or not, if not, generating and displaying alarm information, if so, acquiring the coordinates of the pictures in the current screen image, and setting the coordinates as simulated click positions; the pictures in the picture library comprise the preset characters. In this embodiment, both the character recognition method and the image matching method are relatively mature technologies, so that the simulated click position can be quickly and accurately acquired, and the automatic evidence obtaining process of the client is completed.
In the description of the present invention, it is to be understood that the terms "first", "second" and the like are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implying any number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of the present invention, "a plurality" means at least two, e.g., two, three, etc., unless specifically limited otherwise.
In the description herein, references to the description of the term "one embodiment," "some embodiments," "an example," "a specific example," or "some examples," etc., mean that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the invention. In this specification, the schematic representations of the terms used above are not necessarily intended to refer to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, various embodiments or examples and features of different embodiments or examples described in this specification can be combined and combined by one skilled in the art without contradiction.
The above description is only for the purpose of illustrating the preferred embodiments of the present invention and is not to be construed as limiting the invention, and any modifications, equivalents, improvements and the like that fall within the spirit and principle of the present invention are intended to be included therein.

Claims (6)

CN201611130991.0A2016-12-092016-12-09Client automatic evidence obtaining method and systemActiveCN106775701B (en)

Priority Applications (1)

Application NumberPriority DateFiling DateTitle
CN201611130991.0ACN106775701B (en)2016-12-092016-12-09Client automatic evidence obtaining method and system

Applications Claiming Priority (1)

Application NumberPriority DateFiling DateTitle
CN201611130991.0ACN106775701B (en)2016-12-092016-12-09Client automatic evidence obtaining method and system

Publications (2)

Publication NumberPublication Date
CN106775701A CN106775701A (en)2017-05-31
CN106775701Btrue CN106775701B (en)2021-02-05

Family

ID=58875749

Family Applications (1)

Application NumberTitlePriority DateFiling Date
CN201611130991.0AActiveCN106775701B (en)2016-12-092016-12-09Client automatic evidence obtaining method and system

Country Status (1)

CountryLink
CN (1)CN106775701B (en)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication numberPriority datePublication dateAssigneeTitle
CN110334139A (en)*2018-12-182019-10-15济南百航信息技术有限公司A method of third party system data are docked by simulated operation
CN117494116B (en)*2023-11-152024-10-11上海弘连网络科技有限公司Auxiliary evidence obtaining method and device, storage medium and electronic equipment

Citations (5)

* Cited by examiner, † Cited by third party
Publication numberPriority datePublication dateAssigneeTitle
US20100114610A1 (en)*1999-11-302010-05-06Avreo, Inc.Electronic Method and System That Improves Efficiencies for Rendering Diagnosis of Radiology Procedures
CN103927198A (en)*2014-03-192014-07-16北京奇虎科技有限公司Software clearing method and software clearing device
CN105094760A (en)*2014-04-282015-11-25小米科技有限责任公司Picture marking method and device
CN105335136A (en)*2014-07-162016-02-17阿里巴巴集团控股有限公司Control method and device of intelligent equipment
CN105513038A (en)*2014-10-202016-04-20网易(杭州)网络有限公司Image matching method and mobile phone application test platform

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication numberPriority datePublication dateAssigneeTitle
US20100114610A1 (en)*1999-11-302010-05-06Avreo, Inc.Electronic Method and System That Improves Efficiencies for Rendering Diagnosis of Radiology Procedures
CN103927198A (en)*2014-03-192014-07-16北京奇虎科技有限公司Software clearing method and software clearing device
CN105094760A (en)*2014-04-282015-11-25小米科技有限责任公司Picture marking method and device
CN105335136A (en)*2014-07-162016-02-17阿里巴巴集团控股有限公司Control method and device of intelligent equipment
CN105513038A (en)*2014-10-202016-04-20网易(杭州)网络有限公司Image matching method and mobile phone application test platform

Also Published As

Publication numberPublication date
CN106775701A (en)2017-05-31

Similar Documents

PublicationPublication DateTitle
CN110705405B (en)Target labeling method and device
CN107223246B (en) Image annotation method, device and electronic device
CN110659397B (en)Behavior detection method and device, electronic equipment and storage medium
US11163835B2 (en)Information processing system, information processing apparatus, information processing program and information processing method
JP2015529354A (en) Method and apparatus for face recognition
CN109656800B (en)Method and device for testing image recognition application, terminal and storage medium
TW201344577A (en)Image guided method for installing application software and electronic device thereof
CN113807342A (en)Method and related device for acquiring equipment information based on image
CN102147684A (en)Screen scanning method for touch screen and system thereof
CN106775701B (en)Client automatic evidence obtaining method and system
CN112711536A (en)Automatic dial testing method and system, and computer readable storage medium
WO2018121414A1 (en)Electronic device, and target image recognition method and apparatus
CN113806208A (en) Test and evidence collection method and device, equipment, storage medium
JP2008217545A (en)Console information acquisition system, console information acquisition method, and console information acquisition program
CN115565000A (en)Image annotation method, system, device and medium based on target detection
CN113554586B (en) Automatically assessing the significance of pixel anomalies
CN114896148A (en)Terminal application automatic testing device, system, method, equipment and storage medium based on image recognition capability
US11657489B2 (en)Segmentation of continuous dynamic scans
CN109272504B (en)Method, device and system for detecting and tracing concave-convex defect of vehicle
CN110516590A (en) Operation Standard Prompt System Based on Scene Recognition
CN105975566A (en)Image-based information searching method and device
CN112770110B (en)Video quality detection method, device and system
JP5846378B2 (en) Information management method and information management system
CN114760460A (en)Video quality detection method, device, storage medium and apparatus
CN112634460B (en)Outdoor panorama generation method and device based on Haar-like features

Legal Events

DateCodeTitleDescription
PB01Publication
PB01Publication
SE01Entry into force of request for substantive examination
SE01Entry into force of request for substantive examination
GR01Patent grant
GR01Patent grant
TR01Transfer of patent right

Effective date of registration:20210805

Address after:100071 1001-17, 10th floor, building 10, yard 88, Liuxiang Road, Fengtai District, Beijing

Patentee after:BEIJING WANSHENG HUATONG TECHNOLOGY Co.,Ltd.

Address before:No. 27, fozuling Third Road, Donghu New Technology Development Zone, Wuhan City, Hubei Province 430200

Patentee before:WUHAN ZRTZ INFORMATION TECHNOLOGY Co.,Ltd.

TR01Transfer of patent right

[8]ページ先頭

©2009-2025 Movatter.jp