Security information retrieval reasoning method, device and equipment and storage medium

Abstract

The invention provides a security information retrieval reasoning method, device and equipment and a storage medium, and the method comprises the steps: carrying out the analysis processing of an input security case document, and extracting the entity and relation information; then, constructing a character relationship graph and carrying out coding processing to obtain a coded graph; performing retrieval and expansion processing on the encoded atlas according to user query to obtain a retrieval sub-graph; and finally, evidence chain reasoning is carried out based on the retrieval sub-graph, and an analysis report containing a relation network graph and an evidence chain view is generated. Through organic combination of case document analysis, map coding, retrieval extension and evidence chain reasoning, effective extraction of entity relationships is realized in a document information processing stage, structural expression of information is enhanced in a map construction stage, complete associated information is obtained in a retrieval stage, and the retrieval efficiency is improved. Reliable evidence support is established in the reasoning stage, and finally more accurate information support is provided for case analysis.

Description

Technical Field

[0001] The present invention relates to the technical field of retrieval augmented generation, and particularly to a security information retrieval and reasoning method, device, equipment, and storage medium. Background Art

[0002] With the rapid development of information technology, the degree of information digitization in the security field has been continuously improving, and the quantity and complexity of case documents have shown an explosive growth. When dealing with a large amount of case information, traditional manual analysis methods are difficult to meet the actual needs. At present, the security field generally adopts retrieval technologies based on keyword matching or simple knowledge graph construction methods to process case information. Among them, the keyword matching-based method mainly relies on the literal similarity of texts for retrieval, while the knowledge graph-based method constructs a structured representation of case information through entity recognition and relationship extraction. The application of these technologies has significantly improved the processing efficiency of case information.

[0003] However, the existing security information retrieval technologies still face many challenges in practical applications. First, due to the lack of in-depth exploration of potential associations between documents, the retrieval results often have incomplete associated information, making it difficult to discover implicit connections between cases. Second, the existing technologies have a relatively simple evaluation of the reliability of evidence and lack a systematic evidence chain verification mechanism, resulting in insufficient evidence support for the retrieval results. In addition, when dealing with complex case situations, the existing technologies are difficult to effectively integrate information from different types of documents and cannot provide comprehensive and reliable decision-making support for case analysis. These problems seriously affect the practical application effect of the security information retrieval system. Summary of the Invention

[0004] The main objective of the present invention is to solve the technical problems in the existing security information retrieval technologies, where the retrieval results lack complete associated information and reliable evidence chain support; In the first aspect of the present invention, a security information retrieval and reasoning method is provided. The security information retrieval and reasoning method includes: Analyze and process the input security case documents to obtain an entity set and a relationship set; Construct a character relationship graph according to the entity set and the relationship set, and perform encoding processing on the character relationship graph to obtain an encoded character relationship graph; Retrieve and expand the encoded character relationship graph according to the user query to obtain a retrieval subgraph; Perform evidence chain reasoning processing according to the retrieval subgraph to obtain an analysis report including a relationship network graph and an evidence chain view.

[0005] Optionally, in the first implementation manner of the first aspect of the present invention, the analyzing and processing the input security case documents to obtain an entity set and a relationship set includes: Classify the security case documents according to the types of the security case documents to obtain different types of document subsets; Perform intelligent segmentation processing on the document subsets according to the document types to obtain a set of text blocks, where the oral confession records are segmented according to the Q&A paragraphs, the on-site investigation records are segmented according to the spatial positions, and the surveillance records are segmented according to the time nodes; Perform entity recognition processing on the set of text blocks according to the security field prompt word template to obtain an initial entity set, and perform disambiguation processing on the initial entity set to obtain an entity set; Perform relationship extraction processing on the set of text blocks according to the entity set to obtain an initial relationship set, and perform credibility verification processing on the initial relationship set to obtain a relationship set.

[0006] Optionally, in the second implementation manner of the first aspect of the present invention, constructing a person relationship graph according to the entity set and the relationship set, and performing encoding processing on the person relationship graph to obtain the encoded person relationship graph includes: Perform attribute annotation processing on the entity set and the relationship set to obtain entity nodes and relationship edges with attributes; Construct an initial person relationship graph according to the entity nodes and relationship edges with attributes, and calculate a starting vector and an ending vector for each entity node in the initial person relationship graph to obtain a bidirectional relationship representation; Perform multi-layer propagation processing on the bidirectional relationship representation, and weight the evidence strength for each layer of propagation result to obtain a multi-layer encoding result; Perform hierarchical splicing processing according to the multi-layer encoding result to obtain the encoded person relationship graph.

[0007] Optionally, in the third implementation manner of the first aspect of the present invention, performing multi-layer propagation processing on the bidirectional relationship representation, and weighting the evidence strength for each layer of propagation result to obtain a multi-layer encoding result includes: Perform one-hot encoding initialization processing on each entity node in the bidirectional relationship representation to obtain an initial node encoding set; Perform relationship direction division processing on each entity node in the initial person relationship graph, divide the relationship path starting from the entity node for which the relationship direction is divided and pointing to other entity nodes into a forward relationship path, and divide the relationship path pointing to the entity node for which the relationship direction is divided into a reverse relationship path to obtain a forward and reverse path set; Perform feature propagation processing based on the initial node encoding set and the forward relationship paths in the forward and reverse path sets, obtain the forward propagation result based on the weighted average of neighbor nodes, perform feature propagation processing based on the initial node encoding set and the reverse relationship paths in the forward and reverse path sets, and obtain the reverse propagation result based on the weighted average of neighbor nodes; Perform evidence strength scoring processing on the forward propagation result and the reverse propagation result, weight the propagation results according to the time attribute of the relationship edge and the supporting evidence, and obtain the weighted propagation result; Perform iterative propagation processing on the weighted propagation result, use the output of each round of iteration as the input of the next round, and obtain the multi-layer encoding result after iterating a preset number of times.

[0008] Optionally, in the fourth implementation manner of the first aspect of the present invention, the retrieving and expanding the encoded character relationship graph according to the user query to obtain the retrieved subgraph includes: Perform semantic parsing processing on the user query to obtain an object keyword set and a relationship keyword set; Perform entity anchoring retrieval processing on the encoded character relationship graph according to the object keyword set to obtain an anchor node set; Perform relationship pattern retrieval processing on the encoded character relationship graph according to the relationship keyword set to obtain a relationship triple set; Perform subgraph dynamic expansion processing according to the anchor node set and the relationship triple set to obtain the retrieved subgraph.

[0009] Optionally, in the fifth implementation manner of the first aspect of the present invention, the performing subgraph dynamic expansion processing according to the anchor node set and the relationship triple set to obtain the retrieved subgraph includes: Perform spatio-temporal correlation calculation processing on the anchor node set and the relationship triple set, calculate the expansion priority score according to the time attribute, location information and association degree, and obtain the initial expansion sequence; Perform selective expansion processing on the neighbor nodes of the anchor nodes according to the initial expansion sequence, determine the expansion range based on a preset expansion threshold, and obtain the first-order expansion subgraph; Perform relationship path analysis processing on the first-order expansion subgraph, identify key paths and cross connections, and trace and verify the relationship edges on each path to obtain a candidate path set; Perform evidence verification processing on each path in the candidate path set based on the corresponding security case document to obtain a path credibility score; Perform iterative expansion processing according to the path credibility score until the termination condition is met to obtain the retrieved subgraph.

[0010] Optionally, in the sixth implementation manner of the first aspect of the present invention, the obtaining of the analysis report including the relationship network diagram and the evidence chain view through evidence chain reasoning processing based on the retrieved sub-graph includes: Performing security reasoning template conversion processing on the retrieved sub-graph to obtain a structured reasoning template; Performing evidence chain reasoning processing according to the structured reasoning template to obtain a preliminary reasoning result; Performing evidence traceability marking and uncertainty quantification processing on the preliminary reasoning result to obtain a marked reasoning result; Generating a relationship network diagram, a timeline view, and an evidence chain view according to the marked reasoning result, and performing integration processing on the relationship network diagram, the timeline view, and the evidence chain view to obtain an analysis report.

[0011] The second aspect of the present invention provides a security information retrieval and reasoning device, which includes: A document analysis module, configured to analyze an input security case document to obtain an entity set and a relationship set; A graph encoding module, configured to construct a person relationship graph according to the entity set and the relationship set, and perform encoding processing on the person relationship graph to obtain an encoded person relationship graph; A retrieval expansion module, configured to perform retrieval and expansion processing on the encoded person relationship graph according to a user query to obtain a retrieved sub-graph; An inference analysis module, configured to perform evidence chain reasoning processing according to the retrieved sub-graph to obtain an analysis report including a relationship network diagram and an evidence chain view.

[0012] The third aspect of the present invention provides a security information retrieval and reasoning device, including: a memory and at least one processor, wherein instructions are stored in the memory, and the memory and the at least one processor are interconnected through a line; the at least one processor invokes the instructions in the memory so that the security information retrieval and reasoning device executes the steps of the above security information retrieval and reasoning method.

[0013] The fourth aspect of the present invention provides a computer-readable storage medium, in which instructions are stored, and when it runs on a computer, it causes the computer to execute the steps of the above security information retrieval and reasoning method.

[0014] The above security information retrieval and reasoning method, device, equipment and storage medium analyze and process the input security case document to extract entity and relationship information; then construct a person relationship graph and perform encoding processing to obtain the encoded graph; then perform retrieval and expansion processing on the encoded graph according to the user query to obtain a retrieval sub-graph; finally, perform evidence chain reasoning based on the retrieval sub-graph to generate an analysis report including a relationship network graph and an evidence chain view. By organically combining case document analysis, graph encoding, retrieval expansion and evidence chain reasoning, this solution effectively extracts entity relationships in the document information processing stage, enhances the structured expression of information in the graph construction stage, obtains complete associated information in the retrieval stage, and establishes reliable evidence support in the reasoning stage, ultimately providing more accurate information support for case analysis.

[0015] Other features and advantages of the present invention will be described in the following specification, and, in part, will be obvious from the specification, or will be understood by implementing the present invention. The objectives and other advantages of the present invention are achieved and obtained by the structures specifically pointed out in the specification, claims and drawings.

[0016] To make the above objectives, features and advantages of the present invention more obvious and understandable, the following specifically enumerates preferred embodiments and, in conjunction with the accompanying drawings, details are described as follows. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a schematic diagram of the first embodiment of the security information retrieval and reasoning method in the embodiment of the present invention; Figure 2 It is a schematic diagram of an embodiment of the security information retrieval and reasoning device in the embodiment of the present invention; Figure 3 It is a schematic diagram of an embodiment of the security information retrieval and reasoning equipment in the embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0018] To make the objectives, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

[0019] As used in the embodiments of the present invention, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device end that includes a series of steps or units is not limited to the listed steps or units, but may optionally further include other unlisted steps or units, or may optionally further include other steps or units inherent to these processes, methods, products or device ends.

[0020] To facilitate the understanding of this embodiment, first, a security information retrieval and reasoning method disclosed in the embodiments of the present invention will be introduced in detail. The multi-agent includes a question rewriting agent, a document selection agent, an answer generation agent, and a retrieval agent. As Figure 1 shown, this method includes the following steps: 101. Analyze and process the input security case document to obtain an entity set and a relationship set; In an embodiment of the present invention, the analyzing and processing the input security case document to obtain an entity set and a relationship set includes: classifying the security case document according to the type of the security case document to obtain different types of document subsets; performing intelligent segmentation processing on the document subsets according to the document type to obtain a text block set, where the confession record is segmented according to the question and answer paragraphs, the on-site investigation record is segmented according to the spatial position, and the surveillance record is segmented according to the time node; performing entity recognition processing on the text block set according to the security field prompt word template to obtain an initial entity set, and performing disambiguation processing on the initial entity set to obtain an entity set; performing relationship extraction processing on the text block set according to the entity set to obtain an initial relationship set, and performing credibility verification processing on the initial relationship set to obtain a relationship set.

[0021] Specifically, in practical applications, the security case document analysis and processing first classifies the input security case document according to the source and content characteristics of the document. The system uses a multi-level classifier to implement document type recognition. The first level uses a rule classifier based on file format and metadata to identify file suffix names (.doc,.pdf), file header information, and document template characteristics; the second level uses a text feature classifier to extract the frequency of professional terms, sentence structure, and style characteristics in the document, such as dialogue markers ("Ask:", "Answer:") in the confession record, location words ("North side", "About 3 meters away") in the on-site investigation report, and time markers ("10:35:42") in the surveillance record. The classifier calculates the probability scores of each type through these features and assigns the type with the highest score to the document. For mixed-type documents, the system performs secondary classification at the content paragraph level, splits the document and reclassifies it. After classification, the system establishes a document index table, records the ID, type label, key content summary, and timestamp of each document, and forms a structured document subset.

[0022] For the different types of document subsets obtained, the system uses targeted intelligent segmentation strategies to split large documents into text blocks that are easy to process. The segmentation of confession records adopts a segmentation algorithm based on dialogue structure. The system first identifies question and answer tags ("question:", "answer:") or speaker identifiers ("investigator Wang:", "witness Li:"), builds a dialogue tree structure, and then sets segmentation points at logically complete question and answer units to ensure that each segmentation block contains complete context. The on-site investigation records adopt a segmentation method based on spatial location. The system uses named entity recognition technology to identify location descriptors ("living room at the crime scene", "southeast corner") and spatial conversion markers ("enter", "move to") in the text, and sets segmentation points at location changes. The surveillance records use a segmentation technology based on time series. The system identifies timestamp formats ("2023-10-15 08:45:32") and behavioral state changes ("enter the screen", "leave the area"), and creates a new text block when the time interval exceeds the preset threshold (such as 5 minutes) or the behavioral state changes significantly. Metadata tags are added to the segmented text blocks, including the original document ID, block number, time information and location tag, to form a structured text block collection.

[0023] Next, the system uses a prompt word template specially customized for the security field to perform entity recognition on the text block collection. The prompt word template consists of eight types of entities: people (including suspects, victims, witnesses, and related persons), places (locations of crimes, locations of suspect activities, and locations of evidence), time (time of crime, time of alibi, and time of key behaviors), objects (tools used in committing crimes, stolen objects, and physical evidence left behind), events (criminal behaviors, escape behaviors, and behaviors of destroying evidence), communications (call records, social media contacts), finance (fund flows, transaction records), and identities (ID numbers, aliases, and pseudonyms). The system encapsulates these types in prompt templates along with typical instances and recognition rules, for example: "Identify all characters in the text, including their names, identities, feature descriptions, and behaviors." For each text block, the system generates targeted prompts and inputs the prompts and text into the large language model for recognition. The model output is in JSON format, containing entity names, types, attributes (such as age, gender, and identity), and locations of occurrence. The system parses the JSON output, extracts entity information, and adds the source text block ID, confidence score, and timestamp to form an initial entity set.

[0024] Disambiguation of the initial entity set is a key step to ensure the accuracy of entity information. The system implements a three-stage disambiguation algorithm: the first stage is to standardize names, unify different expressions (such as "张三", "张某", "老张", "张"), and use transliteration comparison tables, common abbreviation rules and edit distance algorithms to calculate name similarity; the second stage is to compare attributes, vectorize the attributes of the entity (age, occupation, appearance characteristics), and use cosine similarity to calculate attribute matching; the third stage is to analyze the relationship network, build a preliminary relationship network for each entity (such as who it contacts and where it appears), and compare the network structure through the graph structure similarity algorithm. The system weights the similarity of these three dimensions and sets a threshold (usually 0.85) to determine whether the entities point to the same object. For entries identified as the same entity, the system performs an information merging operation, selects the name with the highest confidence as the standard name, merges complementary attribute information, and gives priority to information with a newer time and higher confidence when resolving attribute conflicts. In the merged entity set, each entity is assigned a unique ID and an index relationship with the original text block is established to facilitate subsequent tracking of the information source.

[0025] According to the entity set after disambiguation, the system performs relationship extraction on the text block set. The system adopts a two-stage extraction strategy: first, it performs relationship candidate generation based on entity co-occurrence, identifies co-occurring entity pairs for each text block, and constructs a potential relationship candidate set; then, it applies a relationship classifier to determine the specific relationship type between entities. The relationship classifier is designed based on a deep learning model, receives the context text fragment where the entity pair is located as input, encodes the text into a vector representation, and then maps it to a predefined relationship type space through a fully connected layer. The system predefines 25 common relationship types in the security field, including interpersonal relationships (relatives, accomplices, superiors and subordinates, and contradictory relationships), spatiotemporal relationships (simultaneous appearance, going to a place, living in), behavioral relationships (calls, transactions, contacts, delivery of items), and role relationships (committing crimes, testifying, and providing help). For each identified relationship, the system extracts relationship attributes, such as the time, duration, location, and intensity of the relationship. In addition, the system also records the text fragments that support the relationship judgment as evidence, as well as the confidence score of the relationship recognition, to form an initial relationship set containing relationship triples (entity A-relationship type-entity B) and attributes.

[0026] Performing credibility verification processing on the initial relationship set is the final step to ensure information quality. The system implements a multi-dimensional relationship verification mechanism: First, perform text evidence evaluation, analyze the quantity and quality of text fragments supporting the relationship, and determine whether the text truly supports the relationship assertion through a natural language inference model; Second, perform consistency checking to verify whether the relationship conflicts with other known relationships. For example, "A and B are in an intimate relationship" and "A and B have a deep adversarial relationship" cannot exist simultaneously; Third, perform spatio-temporal logic verification to ensure that the relationship conforms to physical and time constraints. For example, the same person cannot be in two distant locations at the same time; Fourth, implement multi-source evidence cross-verification to check whether the information in different document sources (such as confessions, surveillance) is consistent. The system calculates a comprehensive credibility score based on these verification results. The score uses a normalized value between 0 and 1, and three-level thresholds are set: Relationships with a score below 0.4 are filtered and deleted, relationships between 0.4 and 0.75 are marked as "to be confirmed" and accompanied by an uncertainty description, and relationships with a score above 0.75 are regarded as high-credibility relationships. The finally generated relationship set includes relationship triples, attribute information, credibility scores, evidence sources, and uncertainty markers. This strictly verified relationship set and the entity set together constitute the basic structure of the security case knowledge network.

[0027] 102. Construct a person relationship graph based on the entity set and the relationship set, and perform encoding processing on the person relationship graph to obtain an encoded person relationship graph; In one embodiment of the present invention, the constructing a person relationship graph based on the entity set and the relationship set, and performing encoding processing on the person relationship graph to obtain an encoded person relationship graph includes: performing attribute annotation processing on the entity set and the relationship set to obtain entity nodes and relationship edges with attributes; constructing an initial person relationship graph based on the entity nodes and relationship edges with attributes, calculating a start vector and an end vector for each entity node in the initial person relationship graph to obtain a bidirectional relationship representation; performing multi-layer propagation processing on the bidirectional relationship representation, and weighting the evidence strength for each layer of propagation results to obtain multi-layer encoding results; performing hierarchical splicing processing based on the multi-layer encoding results to obtain the encoded person relationship graph.

[0028] Specifically, when performing attribute annotation processing on entity sets and relationship sets, the system first establishes an attribute annotation framework dedicated to the security field, including an entity attribute system and a relationship attribute system. The entity attribute system includes four categories: basic attributes, identity attributes, behavioral attributes, and spatiotemporal attributes. Basic attributes record basic information such as the entity's name, gender, age, and appearance characteristics; identity attributes annotate the entity's role type in the case (suspect, victim, witness, associated person), danger level (high risk, medium risk, low risk) and criminal record (whether there is a criminal record, type of criminal record, number of criminal records); behavioral attributes describe the entity's key behavioral characteristics (violent tendencies, escaping behavior, destruction of evidence) and behavioral patterns (habitual methods of committing crimes, activity patterns); spatiotemporal attributes record the entity's activity area (frequently appearing places, activity range) and time trajectory (key time points). For the relationship attribute system, the system annotates the relationship type (interpersonal relationship, spatiotemporal relationship, behavioral relationship), relationship strength (close, general, distant), time attributes (relationship establishment time, duration, last contact time), evidence support strength (high, medium, low), and evidence source (document ID list). The system extracts these attribute values ​​from the raw data through a rule engine and feature extraction algorithm, uses default values ​​for missing attributes or marks them as unknown, and ultimately generates entity node and relationship edge data structures with complete attribute labels.

[0029] Specifically, when constructing the initial personal relationship graph based on entity nodes and relationship edges with attributes, the system uses the Neo4j graph database as the storage and management platform. First, the data model of the graph is defined, including a node label system and a relationship type system optimized for the security field. The node label system classifies entities into main categories such as Person, Location, Item, Event, etc. Each main category has multiple sub-categories. For example, under Person, there are sub-categories such as Suspect, Victim, Witness, etc. The relationship type system defines 25 typical relationships such as KNOWS (knows), LOCATED_AT (is located at), PARTICIPATED_IN (participated in the event), CONTACTED (contacted), etc. The system writes the entity node data into Neo4j through batch import. Each node contains a unique identifier, label type, and attribute mapping. At the same time, a name index and an identity type index are established for the person nodes to accelerate querying. Then, the relationship edge data is imported. Each relationship contains the starting node ID, target node ID, relationship type, and attributes. The system performs graph data integrity verification, checks for isolated nodes and circular dependencies, and calculates centrality metrics (degree centrality, betweenness centrality) for each entity node as a preliminary assessment of node importance. After the import is completed, the system calculates the starting vector and ending vector for each person node to form a two-way relationship representation. The starting vector represents the characteristics of the person as the initiator of the relationship, aggregating all relationship types, target node types, and relationship attributes starting from this node; the ending vector represents the characteristics of the person as the recipient of the relationship, aggregating all relationship types, source node types, and relationship attributes pointing to this node.

[0030] Specifically, when performing multi-layer propagation processing on two-way relationship representations, the system implements a graph feature propagation algorithm based on direction distance encoding (DDE). The algorithm first initializes the features of each entity node in the initial person relationship graph, representing the features of each node using a high-dimensional vector (usually 512 dimensions). The first half of the initial vector encodes the attribute information of the node, and the second half is set to a zero vector. Then the system performs relationship direction partitioning, defining the set of edges starting from node v and pointing to other nodes as the positive relationship set E⁺(v), and the set of edges pointing to node v as the negative relationship set E⁻(v). Based on these two sets, the system performs forward propagation and backward propagation respectively. During forward propagation, node v aggregates the features of all target nodes in E⁺(v), and the weights are calculated according to the relationship type and relationship attributes; during backward propagation, node v aggregates the features of all source nodes in E⁻(v), and the weights are also calculated based on the relationship characteristics. For each layer of propagation, the system performs evidence strength weighting, calculating a credibility score based on the quality and quantity of evidence supporting each relationship. The higher the score, the greater the weight of the corresponding relationship in the propagation. Specifically, the evidence strength score consists of three parts: document reliability scoring (official documents have a higher weight than personal testimonies), evidence quantity scoring (the number of independent evidences supporting the same relationship), and evidence consistency scoring (the degree of consistency of evidences from different sources). The propagation process is iterative, starting from layer 0 (only the features of the node itself), expanding layer by layer outward, usually performing 3 layers of propagation to capture the 1-hop, 2-hop, and 3-hop neighbor information of the node. After each layer of propagation is completed, the system saves the propagation results of that layer to form a multi-layer coding result set.

[0031] Specifically, when performing hierarchical splicing processing based on the multi-layer coding results, the system adopts a full-hierarchy retention strategy to save the graph structure information of different ranges captured at different propagation levels. For each entity node, the system separately saves its feature vectors at layer 0 (initial features), layer 1 (one-hop neighbor information), layer 2 (two-hop neighbor information), and layer 3 (three-hop neighbor information). The results of forward propagation and reverse propagation are saved separately without mixing to retain directional information. During the splicing process, the feature vectors of each layer are first subjected to dimension unification processing to ensure that the vector dimensions of each layer are consistent. Then, the system performs weighted splicing on the multi-layer features of the same node. The weight of the layer 0 features is the highest (usually 1.0), and the weight decreases as the layer number increases (e.g., 0.8 for layer 1, 0.6 for layer 2, 0.4 for layer 3). The weight coefficients are optimized and determined through case verification. After splicing, the results of forward propagation and reverse propagation respectively form forward feature vectors and reverse feature vectors, and finally are merged into a complete node representation vector. The system normalizes the splicing results to make the range of the feature vectors of all nodes consistent. In addition, the system also adds an embedding vector of the node identity type to the representation vector to enhance the semantic information of the vector. The finally generated encoded person relationship graph includes two parts: the graph structure data (nodes, edges, attributes) stored in Neo4j and the node encoding vectors stored in the vector database, and the two are associated through the node ID. This dual storage structure not only retains the original structure and attribute information of the graph, but also provides an efficient vectorized representation, providing dual support for subsequent graph retrieval and analysis.

[0032] Furthermore, the multi-layer propagation processing of the bidirectional relationship representation and the evidence strength weighting of the propagation results of each layer to obtain the multi-layer coding results include: performing one-hot encoding initialization processing on each entity node in the bidirectional relationship representation to obtain an initial node coding set; performing relationship direction division processing on each entity node in the initial person relationship graph, dividing the relationship paths starting from the entity node undergoing relationship direction division and pointing to other entity nodes into forward relationship paths, and dividing the relationship paths pointing to the entity node undergoing relationship direction division into reverse relationship paths to obtain a positive and negative path set; performing feature propagation processing based on the initial node coding set and the forward relationship paths in the positive and negative path set, and obtaining the forward propagation result based on the weighted average of neighbor nodes. Performing feature propagation processing based on the initial node coding set and the reverse relationship paths in the positive and negative path set, and obtaining the reverse propagation result based on the weighted average of neighbor nodes; performing evidence strength scoring processing on the forward propagation result and the reverse propagation result, weighting the propagation results according to the time attribute of the relationship edge and the supporting evidence to obtain a weighted propagation result; performing iterative propagation processing on the weighted propagation result, using the output of each iteration as the input of the next round, and obtaining the multi-layer coding result after iterating a preset number of times.

[0033] Specifically, when performing one-hot encoding initialization processing on each entity node in the bidirectional relationship representation, the system first assigns unique digital identifiers to all entity nodes in the person relationship graph, ranging from 0 to N-1 (N is the total number of entities). Based on these identifiers, the system creates an initial feature vector of length N for each entity node. In the vector, only the element corresponding to the index position of the node is set to 1, and the rest of the positions are 0. For example, for the person node "Zhang" with an index of 5, the value of the 5th position in its one-hot encoding vector is 1, and the rest of the positions are 0. In addition to the basic one-hot encoding, the system also incorporates the key attribute information of the entity node into the initial encoding, using the attribute extension vector method. The specific operation is to concatenate an attribute encoding vector on the basis of the one-hot encoding vector, which includes entity identity types (suspect encoded as [1,0,0], victim encoded as [0,1,0], witness encoded as [0,0,1]), danger levels (high-risk encoded as [1,0,0], medium-risk encoded as [0,1,0], low-risk encoded as [0,0,1]), and prior conviction status (with prior conviction encoded as [1], without prior conviction encoded as [0]), etc. Through this encoding method, the system obtains an initial node encoding set containing entity identity information. Each encoding vector not only retains the uniqueness of the node but also includes basic attribute features.

[0034] Specifically, when performing relationship direction division processing on each entity node in the initial person relationship graph, the system accurately models the directional characteristics of the relationships in the security case graph. The system traverses each entity node v in the graph, checks all the relationship edges connected to this node, and divides them into two categories according to the direction of the edges: one category is the relationship edges starting from node v and pointing to other nodes, which are divided into the forward relationship path E⁺(v); the other category is the relationship edges starting from other nodes and pointing to node v, which are divided into the reverse relationship path E⁻(v). For each relationship type in the security case, the system defines a clear semantic direction. For example, in the "instigate" relationship, the instigator is the source node and the instigated is the target node; in the "appear at" relationship, the person is the source node and the location is the target node. The system creates a directional relationship index according to the relationship type and direction, recording the out-edge set and in-edge set of each node. In addition, the system also considers the time series characteristics of the relationships and sorts the same type of relationships in chronological order. For example, multiple call records are arranged in chronological order. For complex multi-hop relationship paths, the system defines a maximum path length limit (usually 3 hops) and assigns a unique identifier to each path. Through this relationship direction division, the system obtains a complete set of forward and reverse paths, clearly distinguishing the active role and passive role of each node in different relationships and capturing the directional characteristics of the relationship network in the security case.

[0035] Specifically, when performing feature propagation processing based on the initial node encoding set and the forward and backward path sets, the system implements a dual-channel feature propagation mechanism. In the forward propagation channel, for each node v, the system collects the target nodes in all its forward relationship paths E⁺(v), obtains the current feature vectors of these target nodes, and calculates the weighting coefficients based on the relationship attributes. The weighting coefficients consist of three parts: the relationship type weight (the importance of different types of relationships varies, e.g., the weight of the "joint crime" relationship is higher than that of the "general acquaintance" relationship), the relationship strength weight (the weight of a close relationship is higher than that of a general relationship), and the relationship timeliness weight (the weight of a recent relationship is higher than that of a long-term relationship). The system uses these weighting coefficients to perform weighted averaging on the target node features to obtain the forward aggregated feature of node v. At the same time, in the backward propagation channel, the system performs a similar operation on the source nodes in all the backward relationship paths E⁻(v) of each node v, also calculates the weighting coefficients based on the relationship attributes, and performs weighted averaging on the source node features to obtain the backward aggregated feature of node v. In the security scenario, forward propagation and backward propagation capture different types of information: forward propagation reflects the influence of an entity node on other nodes, such as a suspect's instigation of their accomplice; backward propagation reflects the influence of other nodes on this node, such as multiple pieces of evidence pointing to a specific suspect. Through this dual-channel propagation, the system obtains the forward propagation result and the backward propagation result respectively, and the two together constitute the comprehensive feature representation of the node.

[0036] Specifically, when performing evidence strength scoring on the forward propagation result and the backward propagation result, the system implements a weight allocation mechanism based on multi-dimensional evidence evaluation. The system first extracts evidence support information from the relationship data, including the evidence source, evidence type, and evidence quantity. For each relationship in the security case, the system assigns a basic weight according to the evidence source: the weight of official documents (such as police records, court records) is 1.0, the weight of electronic data (such as call records, surveillance videos) is 0.9, the weight of witness testimony is 0.8, and the weight of circumstantial evidence is 0.6. Then the system evaluates the time attribute of the relationship, assigns a high weight (coefficient 1.0) to recent relationships (such as contacts on the day of the crime), assigns a medium weight (coefficient 0.8) to medium-term relationships (such as contacts in the week before the crime), and assigns a low weight (coefficient 0.6) to long-term relationships (such as contacts a month before the crime). The system also considers the evidence conflict situation. When the descriptions of the same relationship by multiple evidence sources conflict, the weight of this relationship is reduced (usually reduced by 20%). Based on these scoring rules, the system adjusts the forward propagation and backward propagation results respectively: for each node v, multiply its aggregated feature by the evidence strength score to weaken the influence of relationships with insufficient evidence and strengthen the contribution of relationships with sufficient evidence. Through this evidence strength weighting process, the system obtains the weighted propagation result, and the feature representation more accurately reflects the reliability and importance of relationships in the security case, avoiding interference from false or weak relationships.

[0037] Specifically, when performing iterative propagation processing on the weighted propagation results, the system adopts a multi-round progressive feature diffusion strategy. In the first round of iteration, the system uses the initial node encoding set as the input, performs forward propagation and backward propagation, and weights the evidence strength to obtain the first-order propagation results. The first-order propagation results of each node contain the information of its direct neighbors (one-hop relationship). In the second round of iteration, the system uses the weighted propagation results of the first round as the new input, performs forward and backward propagation and evidence strength weighting again to obtain the second-order propagation results. At this time, the feature representation of each node has incorporated the information of two-hop neighbors. The system continues in this way, performs the third round of iteration to obtain the third-order propagation results, which contain the information of three-hop neighbors. For security case analysis, the system usually sets the number of iterations to 3, and this depth is sufficient to cover the key relationship paths in most cases. In each round of iteration, the system performs normalization processing on the feature vectors to prevent numerical explosion or disappearance. In addition, the system also implements a feature attenuation mechanism, making the influence of nodes at greater distances weaken as the distance increases, and the attenuation coefficient is usually set to 0.8. After the iteration process is completed, the system saves the feature representations (first-order, second-order, third-order) obtained in each round of iteration respectively to form a multi-layer encoding result. This hierarchical encoding result retains the information of different propagation depths, including both the details of the local community structure of the nodes and the features of a wider range of relationship networks, providing a rich structured representation for the analysis of the relationships between people in security cases.

[0038] 103. Retrieve and expand the encoded person relationship graph according to the user query to obtain a retrieval subgraph; In an embodiment of the present invention, the retrieving and expanding the encoded person relationship graph according to the user query to obtain a retrieval subgraph includes: performing semantic parsing processing on the user query to obtain an object keyword set and a relationship keyword set; performing entity anchoring retrieval processing on the encoded person relationship graph according to the object keyword set to obtain an anchor node set; performing relationship pattern retrieval processing on the encoded person relationship graph according to the relationship keyword set to obtain a relationship triple set; and performing subgraph dynamic expansion processing according to the anchor node set and the relationship triple set to obtain the retrieval subgraph.

[0039] Specifically, when performing semantic parsing on user queries, the system has implemented a multi-stage query parsing engine specifically for the security field. In the first stage, query preprocessing is carried out, including text cleaning (removing extra spaces, normalizing punctuation), word segmentation, and stop word filtering, converting the original query into a standardized sequence of words. In the second stage, named entity recognition is performed, using a security-specific entity recognition model to extract personal names, place names, organization names, time expressions, and case-related professional terms in the query. This model is optimized for common expressions in the security field and can identify code-named personal names (such as "A certain person", "Suspect A"), abbreviated place names (such as "Crime scene", "West District Station"), and jargon expressions (such as "Disposal of stolen goods", "Handover"). In the third stage, semantic role labeling is implemented to determine the subject, object, and predicate relationships in the query, distinguishing the logical structure of "who did what to whom". Finally, the system classifies the recognized entities into two categories: the set of object keywords and the set of relationship keywords. The set of object keywords contains specific entity references, such as specific persons ("Li Mou", "Store Manager Wang"), specific locations ("No. 42, Hechuan Road"), specific times ("October 15, 2023, evening"), etc.; the set of relationship keywords contains descriptions of interactions between entities, such as interpersonal relationships ("Accomplice relationship", "Superior-subordinate"), behavioral relationships ("Multiple calls", "Fund transfers"), spatial relationships ("Appeared at the same time"), etc. The system also extracts constraint conditions such as time ranges and relationship strength qualifiers in the query to form a structured query representation.

[0040] When performing entity anchoring retrieval processing on the encoded person relationship graph according to the object keyword set, the system uses a multi-strategy matching algorithm to find the nodes corresponding to the query entity in the graph. First, exact matching is performed, and the entity node that exactly matches is directly found through the name index or ID attribute of the node. For cases where the naming is ambiguous or incomplete (such as only the surname "Zhang" or the code name "Suspect A"), the system enables the fuzzy matching mechanism, calculates the similarity between the query term and the entity name in the graph through character similarity algorithms (such as edit distance, character overlap rate), and sets a threshold (usually 0.75) to filter candidate nodes. For cases of multiple candidate matches, the system uses attribute constraints for filtering, comparing whether attributes such as the identity type, age range, and activity area of the entity are consistent with the limiting conditions in the query. In addition to attribute constraints, the system also applies semantic vector matching, converts the entity description in the query into a semantic vector, calculates the cosine similarity with the feature vector of the node in the graph, and selects the node with the highest similarity as the matching result. For the query entity that fails to find a directly corresponding node in the graph, the system records it as an "entity to be parsed" and attempts to infer its identity through the relationship network in the subsequent retrieval process. Through this series of matching strategies, the system finally obtains a set of anchor nodes. Each anchor node contains the node ID, matching type (exact / fuzzy / semantic), matching confidence, and the original query term. These anchor nodes serve as the starting points for graph retrieval and locate the core entities of interest to the user in the graph.

[0041] When performing relationship pattern retrieval processing on the encoded person relationship graph based on the relationship keyword set, the system implements a relationship retrieval mechanism based on pattern matching. First, the system maps the relationship keywords in the query to a predefined relationship type system, which includes 25 common relationships in security cases (such as "acquaintance relationship", "call connection", "financial transaction", "same industry", etc.). For relationship descriptions expressed in natural language (such as "multiple phone connections"), the system converts them into standard relationship types (such as "CONTACTED") and attribute limitations (such as "frequency: multiple", "method: phone") through a relationship mapping dictionary. Then the system constructs a relationship query template, defining the relationship patterns that need to be matched, including relationship types, directions, time ranges, and intensity requirements. For relationship queries containing specific entities (such as "Who has call records with Li"), the system starts from the identified anchor node and searches for edges that meet the relationship type constraints in the graph. For relationship queries that do not specify specific entities (such as "Find all people who committed crimes together"), the system retrieves eligible relationship edges within the entire graph. The system supports compound relationship queries and can handle multi-step relationship paths (such as "People who have call records with Li and appear at the same crime scene"), and finds paths that meet multiple relationship constraints in the graph through a path matching algorithm. During the query execution process, the Cypher query language of Neo4j is used to convert the relationship pattern into a structured query statement to efficiently execute complex graph pattern matching. The retrieval results are organized in the form of triples (source node - relationship - target node), and each triple is accompanied by relationship attributes and matching degree scores, forming a set of relationship triples. These triples represent the connections between entities that meet the user's relationship query conditions.

[0042] When performing subgraph dynamic expansion processing based on the anchor node set and the relationship triple set, the system adopts an iterative expansion strategy to construct a retrieval subgraph containing key information. The expansion process starts with the initialization of the core subgraph, merging all the nodes and their relationship edges in the anchor node and relationship triple sets into the initial subgraph structure. To avoid information overload caused by excessive subgraph expansion, the system implements an intelligent boundary control mechanism to determine the expansion priority order and termination conditions through importance evaluation. The importance evaluation considers multiple dimensions: node importance (nodes with higher centrality are given priority for expansion based on centrality metrics), relationship significance (important relationships are given priority for expansion based on relationship type and strength), evidence sufficiency (relationships with sufficient evidence support are given priority for expansion), and query relevance (the higher the relevance to the original query topic, the higher the priority). The system assigns a comprehensive weight to the candidate expansion edges according to these evaluation metrics, and adds them to the subgraph one by one after sorting by weight. After each round of expansion, the system evaluates the information volume and coherence of the current subgraph to determine whether the expansion termination conditions are met. The termination conditions include: reaching the preset maximum number of nodes (usually limited to within 50 nodes to ensure visualization effects), the key path has been completely discovered (the relationship paths between all major suspects have been included in the subgraph), and the information gain is lower than the threshold (the information gain brought by the newly added edges is not sufficient to justify continued expansion). Through this control mechanism, the system avoids subgraph inflation and noise increase caused by unrestricted expansion, ensuring the accuracy and interpretability of the retrieval subgraph. After the expansion is completed, the system performs post-processing on the subgraph, including arranging the layout, calculating node clustering, and marking the key path, finally forming a structured retrieval subgraph.

[0043] Further, the obtaining of the retrieval subgraph by performing subgraph dynamic expansion processing according to the anchor node set and the relationship triple set includes: performing spatio-temporal correlation calculation processing on the anchor node set and the relationship triple set, calculating the expansion priority score according to the time attribute, location information, and association degree, and obtaining the initial expansion sequence; performing selective expansion processing on the neighbor nodes of the anchor nodes according to the initial expansion sequence, determining the expansion range based on a preset expansion threshold, and obtaining the first-order expansion subgraph; performing relationship path analysis processing on the first-order expansion subgraph, identifying the key path and cross connections, and tracing and verifying the relationship edges on each path to obtain the candidate path set; performing evidence verification processing on each path in the candidate path set based on the corresponding security case document to obtain the path credibility score; and performing iterative expansion processing according to the path credibility score until the termination condition is met to obtain the retrieval subgraph.

[0044] Specifically, when performing spatio-temporal correlation calculation and processing on the anchor node set and the relationship triple set, the system first constructs a spatio-temporal scoring framework to comprehensively evaluate the degree of association between nodes and relationships with the core elements of the case in the time dimension and the space dimension. In the time dimension, the system extracts the time attribute tags of each node and relationship, including the event occurrence time, relationship establishment time, and duration period, and then calculates the time distance from the key time points of the case (such as the crime time, crime preparation time, and time of selling stolen goods). The time distance is quantified through a weighted time window function, with the events on the day of the crime assigned the highest weight of 1.0, the events one day before and after the crime with a weight of 0.9, the events within one week before and after the crime with a weight of 0.7, the events within one month before and after the crime with a weight of 0.5, and the weights of events at more distant times decreasing. In the space dimension, the system analyzes the geographical location information of the nodes and the spatial attributes of the relationships, calculates the physical distance from the crime scene, and also quantifies it through a distance attenuation function, with the weight of the crime scene being 1.0, the weight within the same block being 0.9, the weight within the same area being 0.7, the weight within the same city being 0.5, and the weight of different cities being even lower. In addition to spatio-temporal factors, the system also evaluates the degree of association between nodes and relationships, considering the entity identity type (the weight of a suspect is higher than that of a general associated person), the importance of relationship types (the weight of a criminal relationship is higher than that of an ordinary social relationship), and the relationship strength (the weight of frequent and close interactions is higher than that of casual contacts). The system synthesizes the scores of these three dimensions through weighted averaging to form the final extended priority score, creating an initial extended sequence that arranges all the nodes and relationships to be extended in descending order of priority, providing a decision-making basis for subsequent selective extension.

[0045] Specifically, when performing selective expansion processing on the neighbor nodes of the anchor nodes according to the initial expansion sequence, the system implements an intelligent expansion algorithm based on threshold control. The system first sets multiple expansion thresholds, including the core expansion threshold (usually 0.8), the important expansion threshold (usually 0.6), and the general expansion threshold (usually 0.4), and these thresholds are dynamically adjusted according to the case complexity and resource constraints. The system starts from each anchor node according to the priority order of the initial expansion sequence, retrieves all its one-hop neighbor nodes, and filters them according to the priority score of the edges: the edges and nodes with a priority higher than the core threshold are unconditionally included in the expansion subgraph; for the edges and nodes with a priority between the core threshold and the important threshold, the system further evaluates their information gain value (the additional information brought by the new nodes), and only when the information gain exceeds the set threshold are they included in the subgraph; for the edges and nodes with a priority lower than the important threshold but higher than the general threshold, the system includes them in the subgraph only when the scale of the subgraph does not reach the upper limit and the nodes have special attributes (such as unique identity types or key behavioral characteristics); the edges and nodes with a priority lower than the general threshold are excluded and not expanded. During the expansion process, the system also implements a diversity control strategy to ensure a balanced representation of different types of nodes and relationships and prevent the subgraph from being dominated by a single type of node or relationship. For example, when the number of a certain type of node (such as call records) is too large, the system will increase the expansion threshold of this type and tend to include other types of nodes. After the expansion is completed, the system recalculates the centrality index and community membership of the newly added nodes to obtain the first-order expansion subgraph, which contains all the anchor nodes and their selected important neighbor nodes, forming the core skeleton of the case relationship network.

[0046] Specifically, when performing relationship path analysis on the first-order extended subgraph, the system applies graph theory algorithms and path mining techniques to deeply explore the complex connection patterns between entities. The system first clearly defines the analysis objective and determines the key entity pairs (such as between the main suspects, between the suspect and the victim) according to the case type and query intention. These entity pairs form the starting and ending points of the path analysis. Then the system executes the multi-source shortest path algorithm to calculate the shortest connection paths between each pair of key entities. These paths represent the direct associations between entities. However, in security cases, the shortest path is not always the most important. Therefore, the system also implements the weighted k-shortest path algorithm to find the top k paths with the highest total weight (k is usually set to 3-5). In addition to explicit paths, the system also applies relationship pattern mining techniques to identify specific relationship patterns in the first-order extended subgraph, such as triangular relationship patterns (three entities are interconnected to form a closed loop), star relationship patterns (a core entity is connected to multiple peripheral entities), bridging relationship patterns (two tight communities are connected by a few nodes), etc. For each discovered path and relationship pattern, the system performs retrospective verification to check the source and evidence support of each relationship edge that constitutes the path and verify the integrity and consistency of the path. Path verification includes temporal consistency checking (ensuring that the chronological order of events on the path is reasonable), spatial consistency checking (ensuring that geographical location conversions are physically possible), and logical consistency checking (ensuring that the sequence of actions conforms to the logic of the case development). Through this series of analyses and verifications, the system obtains a set of candidate paths. Each path contains a complete sequence of nodes, a sequence of relationship types, path weights, and verification marks. These paths reveal the potential connection network between entities in the case.

[0047] Specifically, when verifying evidence for each path in the candidate path set based on the corresponding security case document, the system implements a strict multi-level evidence evaluation mechanism. For each candidate path, the system first collects the original evidence supporting each relationship edge on the path, including text evidence (document fragments, testimony records), structured evidence (call records, transaction data), and multimedia evidence (surveillance videos, photos). The system constructs an evidence index, maps each relationship edge to a list of its supporting evidence, and records the type, source, and timestamp of the evidence. Subsequently, the system conducts a reliability assessment of each piece of supporting evidence, scoring it based on three dimensions: evidence type (physical evidence is more reliable than testimony), evidence source (official documents are more reliable than non-official sources), and evidence integrity (direct and clear evidence is more reliable than indirect implications), generating an evidence reliability score. Next, the system evaluates the evidence coverage of the path, calculating the proportion of relationship edges supported by evidence on the path. The higher the coverage, the higher the reliability of the path. For relationship edges with missing or weak evidence, the system marks them as "weak links", and these weak links will affect the credibility score of the entire path. The system also analyzes the consistency between evidence, checking whether evidence from different sources supports each other or conflicts. An evidence set with high consistency enhances the path credibility, while conflicting evidence reduces it. Based on these multi-dimensional evaluations, the system calculates the comprehensive credibility score for each path and adds a detailed description of the evaluation basis, including strong evidence points, weak link positions, and potential conflicts. These path credibility scores provide an accurate quality control basis for subsequent iterative expansion, ensuring that the expansion process prioritizes highly credible paths with sufficient evidence.

[0048] Specifically, when performing iterative expansion processing based on path credibility scores, the system implements an adaptive multi-round expansion strategy to ensure that the retrieved subgraph focuses on high-quality paths while moderately exploring potential important connections. The system first sorts the candidate paths in descending order of credibility scores and establishes an expansion priority queue. In the first round of iterative expansion, the path with the highest credibility score is selected from the top of the queue (usually requiring a score ≥ 0.8), and all nodes and relationships on this path are fully incorporated into the subgraph. Then, starting from these newly added nodes, the system explores the nodes in their one-hop neighbors that have not been incorporated into the subgraph and calculates the expansion value of these nodes. The expansion value is evaluated based on three factors: the connection strength with the existing subgraph (new nodes connected to multiple existing nodes have higher value), the information complementarity of node attributes (nodes providing new types of information have higher value), and the case relevance (nodes closely related to the core elements of the case have higher value). The system sets a dynamic expansion threshold, and only nodes with an expansion value exceeding the threshold will be considered for the next round of expansion. As the number of iterative rounds increases, the system gradually raises the expansion threshold, making the expansion range increasingly strict. At the same time, the system evaluates the termination conditions after each round of expansion: the subgraph size reaches the preset upper limit (the number of nodes is usually controlled within 100), all important paths between key entities have been incorporated, the information gain brought by two consecutive rounds of expansion is lower than the set threshold, or the number of iterative rounds reaches the maximum value (usually 5 rounds). After reaching any termination condition, the system performs final subgraph optimization, including pruning low-value branch nodes, supplementing key entity attribute information, and calculating subgraph statistical features (such as density, diameter, community structure), and finally forms the retrieved subgraph.

[0049] 104. Perform evidence chain reasoning processing based on the retrieved subgraph to obtain an analysis report including a relationship network diagram and an evidence chain view.

[0050] In an embodiment of the present invention, the performing evidence chain reasoning processing based on the retrieved subgraph to obtain an analysis report including a relationship network diagram and an evidence chain view includes: performing security reasoning template conversion processing on the retrieved subgraph to obtain a structured reasoning template; performing evidence chain reasoning processing according to the structured reasoning template to obtain a preliminary reasoning result; performing evidence traceability marking and uncertainty quantification processing on the preliminary reasoning result to obtain a marked reasoning result; generating a relationship network diagram, a timeline view, and an evidence chain view according to the marked reasoning result, and performing integration processing on the relationship network diagram, the timeline view, and the evidence chain view to obtain an analysis report.

[0051] Specifically, when performing security inference template conversion on the retrieved subgraph, the system first selects an appropriate inference template type based on the case type and query target. Security case inference templates are mainly divided into five categories: identity confirmation templates (used to determine the identity of suspects), behavior determination templates (used to prove the occurrence of specific behaviors), relationship proof templates (used to prove the association between entities), motive analysis templates (used to infer criminal motives), and case reconstruction templates (used to reconstruct the complete case process). The system selects the most matching basic template from the template library and then instantiates and customizes it. The template instantiation process includes filling in case-specific information, such as basic elements like case number, case type, time and location, and mapping the key entities in the retrieved subgraph to the parameter positions of the template. For example, in the relationship proof template, the system fills in the core person nodes in the retrieved subgraph into the positions of "Subject A" and "Subject B", and fills in the key relationship type into the "Relationship Type" position. The template customization process adjusts the inference framework according to the specific structure of the subgraph, including setting the inference depth (usually 3 - 5 layers), determining the key evidence types (physical evidence, witness evidence, electronic evidence, etc.), and defining the acceptance criteria (the threshold for evidence sufficiency). For complex cases, the system constructs multi-layer nested templates, such as first establishing relationship proof sub-templates between multiple entities and then integrating the results of these sub-templates into the main case reconstruction template. After the template conversion is completed, a structured inference template is formed, which includes formal inference goals, a list of evidence requirements, a framework for inference steps, and the form of conclusions, providing a strict methodological guidance for subsequent evidence chain reasoning and ensuring that the inference process is rigorous, standardized, and compliant with law enforcement and judicial standards.

[0052] When performing evidence chain reasoning processing according to the structured reasoning template, the system implements a multi-stage reasoning process based on logical rules and evidence support. First, the system extracts all relevant evidence elements from the retrieval subgraph, including document fragments, communication records, location data, physical evidence information, and witness testimonies. Each evidence element is marked with the source, time, and associated entity. Then, according to the step framework defined by the reasoning template, the system constructs an initial reasoning chain. This process adopts a bottom-up approach, starting from the basic evidence to establish basic facts, and then deriving intermediate conclusions from the basic facts, and finally reaching the top-level judgment. In the identity confirmation template, the system first summarizes all direct evidence pointing to a specific identity (such as ID card records, facial feature descriptions), then integrates indirect evidence (such as common items, unique behavioral characteristics), and finally comprehensively evaluates the identity consistency. In the relationship proof template, the system collects all evidence indicating the existence of a connection between two entities (such as call records, co-occurrence records, financial transactions), analyzes the frequency, duration, and intensity of the interaction, and evaluates the nature of the relationship. The system applies formal logical rules in the reasoning process to ensure the rigor of the reasoning, such as the law of excluded middle (for identity A, either it is suspect A or it is not), causal relationship reasoning (if the evidence shows that A is in scene X, and scene X can only be reached through behavior Y, then it is inferred that A has performed behavior Y), and relevance reasoning (if A has a close connection with B, and B is related to the case, then A has an indirect connection with the case). The system also implements evidence strength evaluation, rating the reasoning strength according to the type, quantity, and quality of the evidence. Only the reasoning that reaches the set threshold forms a valid conclusion. Through this series of standardized reasoning, the system generates a preliminary reasoning result, including the core conclusion, the supporting evidence chain, and the reasoning strength score.

[0053] When conducting evidence tracing marking and uncertainty quantification on the preliminary reasoning results, the system implements a strict result verification and transparency enhancement mechanism. The evidence tracing marking process first adds complete evidence source information to each key conclusion in the reasoning results, including directly citing the original document ID, text location, and extraction time, creating a complete tracing chain from the conclusion to the original evidence. For different types of evidence, the system uses different marking methods: text evidence is marked with exact quotes from the original text and context summaries, physical evidence records are marked with physical evidence numbers and physical evidence feature descriptions, and electronic data is marked with the data source system and recording method. The system establishes a hierarchical relationship in the tracing chain, differentiates between direct supporting evidence and indirect supporting evidence, and marks the logical relationships (support, supplementation, or partial conflict) between the evidence. Uncertainty quantification processing systematically evaluates various uncertain factors in the reasoning process, including evidence incompleteness (the degree of missing key evidence), evidence contradiction (the degree of conflict between different pieces of evidence), and reasoning leap (the logical span from known facts to conclusions). The system uses probability intervals to represent uncertainty, such as "identity matching degree 75%-85%", rather than a single definite value. For highly uncertain conclusions, the system clearly marks them as "to be confirmed" and lists the necessary supplementary evidence list. In addition, the system also conducts sensitivity analysis to evaluate the impact on the overall conclusion if certain key evidence is overturned, in order to identify the weak links in the reasoning chain. Through these processes, the system generates the marked reasoning results, which not only contain the conclusion content but also come with a complete evidence tracing path, uncertainty quantification indicators, and possible alternative explanations, making the analysis results more transparent, credible, and easy to verify.

[0054] When generating the relationship network diagram, timeline view, and evidence chain view based on the labeled reasoning results, the system applies specialized information visualization techniques to transform the abstract reasoning results into intuitive visual expressions. The relationship network diagram is constructed based on the force-directed layout algorithm, with the core entities located at the center and the associated entities distributed according to the relationship strength. Nodes use differentiated visual encodings: different types of entities use different shapes (circles for people, squares for locations, triangles for items, diamonds for events), identity roles are distinguished by different colors (suspects are red, victims are blue, witnesses are green, associated persons are gray), and the node size reflects importance. The representation of edges is also information-rich: relationship types are represented by different line styles (solid lines indicate direct relationships, dashed lines indicate inferred relationships), the line thickness represents the relationship strength, and the edge color represents the relationship type (red indicates adversarial relationships, blue indicates cooperative relationships, green indicates kinship relationships). The timeline view unfolds the sequence of case events along the horizontal time axis, arranges the key events according to the occurrence time, uses icons and colors to mark the event types, and the time precision is automatically adjusted according to the case span (from hours to months). The view supports time zooming and event filtering functions, allowing focusing on activities within a specific time period. The evidence chain view adopts a tree structure, with the core conclusion at the top and the supporting evidence at the lower levels, and the hierarchical relationship clearly represents the reasoning process. Each evidence node contains a brief description, a credibility score, and a source marker, and the color coding represents the evidence strength, and the connection lines represent the logical relationships. For links with high uncertainty, the system uses visual warnings (such as dashed borders or yellow markings) to alert analysts. All views have implemented interactive functions, supporting node expansion, detail viewing, and evidence tracing. Analysts can click on any element to obtain complete information, including references to the original documents.

[0055] When integrating and processing the relationship network diagram, timeline view, and evidence chain view, the system constructs a multi-dimensional linkage comprehensive analysis interface, realizing information association and interactive collaboration among the views. The integration process first designs a four-region layout framework: the top is the case summary area, which displays the basic case information and core conclusions; the left is the relationship network diagram area, presenting the panoramic view of entity relationships; the upper right is the timeline view area, showing the chronological context of events; the lower right is the evidence chain view area, demonstrating the reasoning logical structure. The system implements a view linkage mechanism to ensure information consistency: selecting a node in the relationship network will automatically highlight the activity events of relevant entities on the timeline, and at the same time highlight the evidence supporting the identity or behavior of the entity in the evidence chain; selecting a specific period on the timeline will filter the relationship network and only display the relationships active during that period; clicking on a specific evidence in the evidence chain will mark the relevant entities and events in other views. The system also adds composite analysis tools, including a pattern filter (quickly identifying specific relationship patterns such as triangular relationships or intermediary roles), a spatio-temporal correlation analyzer (displaying activity trajectories on a map), and an evidence intensity heat map (the depth of color indicates the sufficiency of evidence in different regions). The report generation module integrates all view contents into a structured document, including six major parts: case summary, introduction of key entities, analysis of important relationships, event timeline, evidence chain analysis, and doubt analysis. Each part contains a textual description and corresponding visualization charts.

[0056] In this embodiment, the original query problem is processed by a question rewriting agent for sub-question decomposition to obtain a set of sub-query problem sets; the retrieval agent selects a retrieval method for each sub-query problem according to the entity type included in each sub-query problem in the sub-query problem set to obtain the corresponding retrieval method; the knowledge base is retrieved using the retrieval method to obtain a set of candidate documents, and the candidate documents are screened for relevance by a document selection agent to obtain relevant target documents; the target documents and the original query problem are input into an answer generation agent for answer generation processing to obtain the answer result. This method adopts a multi-agent collaboration framework and realizes the joint optimization of each agent through end-to-end reinforcement learning training, effectively improving the retrieval and answer quality of complex problems.

[0057] The above describes the security information retrieval and reasoning method in the embodiment of the present invention. Next, the security information retrieval and reasoning device in the embodiment of the present invention will be described. The security information retrieval and reasoning device please refer to Figure 2 In an embodiment, the security information retrieval and reasoning device in the embodiment of the present invention includes: A document analysis module 201, configured to analyze and process the input security case document to obtain an entity set and a relationship set; A graph encoding module 202, configured to construct a person relationship graph according to the entity set and the relationship set, and perform encoding processing on the person relationship graph to obtain an encoded person relationship graph; A retrieval and expansion module 203, configured to perform retrieval and expansion processing on the encoded person relationship graph according to a user query to obtain a retrieval sub-graph; An inference and analysis module 204, configured to perform evidence chain inference processing according to the retrieval sub-graph to obtain an analysis report including a relationship network graph and an evidence chain view.

[0058] In an embodiment of the present invention, the security information retrieval and inference device runs the above security information retrieval and inference method. The security information retrieval and inference device analyzes and processes an input security case document to extract entity and relationship information; then constructs a person relationship graph and performs encoding processing to obtain an encoded graph; then performs retrieval and expansion processing on the encoded graph according to a user query to obtain a retrieval sub-graph; and finally performs evidence chain inference based on the retrieval sub-graph to generate an analysis report including a relationship network graph and an evidence chain view. By organically combining case document analysis, graph encoding, retrieval expansion, and evidence chain inference, this solution effectively extracts entity relationships in the document information processing stage, enhances the structured expression of information in the graph construction stage, obtains complete association information in the retrieval stage, establishes reliable evidence support in the inference stage, and ultimately provides more accurate information support for case analysis.

[0059] Above Figure 2 The security information retrieval and inference device in the embodiment of the present invention is described in detail from the perspective of modular functional entities. Next, the security information retrieval and inference device in the embodiment of the present invention is described in detail from the perspective of hardware processing.

[0060] Figure 3FIG. 0 is a schematic structural diagram of a security information retrieval and reasoning device provided by an embodiment of the present invention. The security information retrieval and reasoning device 300 may vary greatly due to configuration or performance differences, and may include one or more processors (central processing units, CPUs) 310 (for example, one or more processors) and a memory 320, and one or more storage media 330 (for example, one or more mass storage device terminals) for storing application programs 333 or data 332. Among them, the memory 320 and the storage media 330 may be transient storage or persistent storage. The program stored in the storage media 330 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the security information retrieval and reasoning device 300. Further, the processor 310 may be configured to communicate with the storage media 330 and execute a series of instruction operations in the storage media 330 on the security information retrieval and reasoning device 300 to implement the steps of the above security information retrieval and reasoning method.

[0061] The security information retrieval and reasoning device 300 may further include one or more power supplies 340, one or more wired or wireless network interfaces 350, one or more input / output interfaces 360, and / or one or more operating systems 331, such as Windows Serve, Mac OS X, Unix, Linux, FreeBSD, and so on. Those skilled in the art can understand that Figure 3 the shown structural diagram of the security information retrieval and reasoning device does not limit the security information retrieval and reasoning device provided by the present invention, and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0062] The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. Instructions are stored in the computer-readable storage medium, and when the instructions run on a computer, the computer is caused to execute the steps of the security information retrieval and reasoning method.

[0063] Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working processes of the above-described system or device and unit can refer to the corresponding processes in the foregoing method embodiments, and will not be described herein again.

[0064] When the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical discs that can store program codes.

[0065] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A security information retrieval and reasoning method, characterized in that The security information retrieval and reasoning method includes: Analyze and process the input security case document to obtain an entity set and a relationship set; Construct a person relationship graph based on the entity set and the relationship set, and perform encoding processing on the person relationship graph to obtain an encoded person relationship graph; Retrieve and expand the encoded person relationship graph according to the user query to obtain a retrieval sub-graph; Perform evidence chain reasoning processing based on the retrieval sub-graph to obtain an analysis report including a relationship network graph and an evidence chain view.

2. The security information retrieval and reasoning method according to claim 1, wherein The analyzing and processing the input security case document to obtain an entity set and a relationship set includes: Classify the security case document according to the type of the security case document to obtain different types of document subsets; Intelligently segment the document subsets according to the document type to obtain a text block set, where the oral confession record is segmented according to the Q&A paragraphs, the on-site investigation record is segmented according to the spatial position, and the surveillance record is segmented according to the time nodes; Perform entity recognition processing on the text block set according to the security domain prompt word template to obtain an initial entity set, and perform disambiguation processing on the initial entity set to obtain an entity set; Perform relationship extraction processing on the text block set according to the entity set to obtain an initial relationship set, and perform credibility verification processing on the initial relationship set to obtain a relationship set.

3. The security information retrieval and reasoning method according to claim 1, wherein The constructing a person relationship graph based on the entity set and the relationship set, and performing encoding processing on the person relationship graph to obtain an encoded person relationship graph includes: Perform attribute annotation processing on the entity set and the relationship set to obtain entity nodes with attributes and relationship edges; Construct an initial person relationship graph based on the entity nodes with attributes and the relationship edges, calculate a start vector and an end vector for each entity node in the initial person relationship graph to obtain a two-way relationship representation; Perform multi-layer propagation processing on the two-way relationship representation, and weight the evidence strength for each layer of propagation result to obtain a multi-layer encoding result; Perform hierarchical splicing processing according to the multi-layer encoding result to obtain the encoded person relationship graph.

4. The security information retrieval and reasoning method according to claim 3, wherein The performing multi-layer propagation processing on the two-way relationship representation, and weighting the evidence strength for each layer of propagation result to obtain a multi-layer encoding result includes: Perform one-hot encoding initialization processing on each entity node in the two-way relationship representation to obtain an initial node encoding set; Perform relationship direction division processing on each entity node in the initial person relationship graph, divide the relationship path starting from the entity node undergoing relationship direction division and pointing to other entity nodes into a forward relationship path, and divide the relationship path pointing to the entity node undergoing relationship direction division into a reverse relationship path to obtain a forward and reverse path set; Perform feature propagation processing according to the initial node encoding set and the forward relationship path in the forward and reverse path set, and obtain a forward propagation result based on the weighted average of neighbor nodes. Perform feature propagation processing according to the initial node encoding set and the reverse relationship path in the forward and reverse path set, and obtain a reverse propagation result based on the weighted average of neighbor nodes; Perform evidence strength scoring on the forward propagation result and the backward propagation result, and weight the propagation result according to the time attribute of the relationship edge and the supporting evidence to obtain a weighted propagation result; Perform iterative propagation on the weighted propagation result, use the output of each iteration as the input of the next iteration, and obtain the multi-layer coding result after iterating a preset number of times.

5. The security information retrieval and reasoning method according to claim 1, wherein The retrieval and expansion processing of the encoded character relationship graph according to the user query to obtain the retrieval subgraph includes: Perform semantic parsing on the user query to obtain an object keyword set and a relationship keyword set; Perform entity anchoring retrieval on the encoded character relationship graph according to the object keyword set to obtain an anchor node set; Perform relationship pattern retrieval on the encoded character relationship graph according to the relationship keyword set to obtain a relationship triple set; Perform subgraph dynamic expansion according to the anchor node set and the relationship triple set to obtain the retrieval subgraph.

6. The security information retrieval and reasoning method according to claim 5, characterized in that The subgraph dynamic expansion according to the anchor node set and the relationship triple set to obtain the retrieval subgraph includes: Perform spatio-temporal correlation calculation on the anchor node set and the relationship triple set, calculate the expansion priority score according to the time attribute, location information and association degree, and obtain the initial expansion sequence; Perform selective expansion on the neighbor nodes of the anchor nodes according to the initial expansion sequence, and determine the expansion range based on a preset expansion threshold to obtain a first-order expansion subgraph; Perform relationship path analysis on the first-order expansion subgraph, identify the key path and cross connections, and trace and verify the relationship edges on each path to obtain a candidate path set; Perform evidence verification on each path in the candidate path set based on the corresponding security case document to obtain a path credibility score; Perform iterative expansion according to the path credibility score until the termination condition is met to obtain the retrieval subgraph.

7. The security information retrieval and reasoning method according to claim 1, characterized in that The evidence chain reasoning processing according to the retrieval subgraph to obtain an analysis report including a relationship network diagram and an evidence chain view includes: Perform security reasoning template conversion on the retrieval subgraph to obtain a structured reasoning template; Perform evidence chain reasoning according to the structured reasoning template to obtain a preliminary reasoning result; Perform evidence traceability marking and uncertainty quantification on the preliminary reasoning result to obtain a marked reasoning result; Generate a relationship network diagram, a timeline view and an evidence chain view according to the marked reasoning result, and perform integration processing on the relationship network diagram, the timeline view and the evidence chain view to obtain an analysis report.

8. An anti-theft information retrieval and inference device, characterized in that The security information retrieval and reasoning device includes: A document analysis module for analyzing the input security case document to obtain an entity set and a relationship set; A graph encoding module for constructing a character relationship graph according to the entity set and the relationship set, and encoding the character relationship graph to obtain an encoded character relationship graph; A retrieval and expansion module for retrieving and expanding the encoded character relationship graph according to the user query to obtain a retrieval subgraph; The inference analysis module is used to perform evidence chain inference processing based on the retrieved sub-graph, and obtain an analysis report including a relationship network diagram and an evidence chain view.

9. A security information retrieval and reasoning device, characterized in that, The security information retrieval and inference device includes: a memory and at least one processor, and instructions are stored in the memory; The at least one processor calls the instructions in the memory, so that the security information retrieval and inference device executes the steps of the security information retrieval and inference method according to any one of claims 1-7.

10. A computer-readable storage medium having instructions stored thereon, characterized in that, When the instructions are executed by the processor, the steps of the security information retrieval and inference method according to any one of claims 1-7 are implemented.

Images