Intelligent agent-based automatic verification and rule matching system for insurance-waiting evaluation report

Abstract

The invention provides an intelligent agent-based automatic verification and rule matching system for insurance-waiting evaluation reports. The intelligent agent-based automatic verification and rule matching system comprises a report acquisition module which pulls to-be-verified and historical insurance-waiting reports; the auditing processing module calls an attention Bi-LSTM model which is subjected to reinforcement learning fine adjustment and is fused with knowledge graph embedding, and scores the report sentence by sentence; the rule management module is used for storing and analyzing an equal-guarantee 2.0 structured machine rule and carrying out secondary accurate matching on low-confidence sentences; the knowledge graph module is used for maintaining a multi-dimensional association graph of a standard family, a control measure and an evaluation item and providing graph reasoning; the agent decision-making module generates actions of passing, returning, manual rechecking or automatic correction according to the auditing state; the feedback learning module collects artificial recheck differences, an incremental training model, a strategy network and atlas vectors; and the storage module stores reports, models, rules, maps and logs in a multi-modal manner through a relation library, a map library and a vector library, and implements data governance and access control. According to the invention, the audit efficiency, accuracy and standard consistency of the evaluation report can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security and information processing, and more particularly, to an agent-based evaluation report automatic verification and rule matching system. BACKGROUND

[0002] In the field of information security, the evaluation of the protection level (evaluation of the protection level) is an important link to ensure that the information system meets the national information security standards. The traditional evaluation of the protection level report audit mainly relies on manual operation, and the auditors need to check the report content item by item according to the protection level standard to judge its compliance. This process not only consumes time and effort, but also is prone to inconsistency and accuracy problems in the audit results due to human factors. With the rapid development of information technology, the scale and complexity of information systems are increasing, and the number and content of the evaluation of the protection level report are also growing, so the traditional manual audit method has been difficult to meet the efficient and accurate audit demand.

[0003] In recent years, artificial intelligence technology has been widely applied in many fields, and the development of natural language processing (NLP) technology has made it possible to automate text auditing. Some research attempts to use machine learning algorithms to preliminarily audit the evaluation of the protection level report, but these methods mostly stay at the level of simple text matching and rule application, and cannot effectively handle the complex semantics and multi-dimensional correlation in the report. In addition, the existing technology also has deficiencies in the training and optimization of the audit model, lacks effective feedback learning mechanism, and is difficult to dynamically adjust and optimize according to the actual audit results.

[0004] In the implementation of the embodiments of the present application, there are at least the following problems or defects in the prior art: first, the audit efficiency is low, and the traditional manual audit method is difficult to deal with a large number of complex evaluation of the protection level reports; second, the audit accuracy is insufficient, and the manual audit is easily affected by subjective factors, leading to inconsistency of the audit results; third, the existing automatic audit technology cannot effectively handle the complex semantics and multi-dimensional correlation in the report, and the audit precision is limited; fourth, there is a lack of effective feedback learning mechanism, and the audit model is difficult to dynamically optimize and adjust according to the actual audit results. SUMMARY

[0005] The present application provides an agent-based evaluation report automatic verification and rule matching system, comprising: The report acquisition module is configured to acquire the to-be-audited evaluation report and the historical evaluation report with the labeled compliance from the evaluation management platform through a secure file transfer protocol; the audit processing module is configured to load the trained audit model and automatically audit the compliance of the to-be-audited evaluation report; the rule management module is configured to store, analyze and match machine-readable audit rules structured according to the clauses of the evaluation 2.0 standard; the knowledge graph module is configured to construct and store a domain knowledge graph based on the multi-dimensional association relationship among the evaluation 2.0 standard family, the security control measures and the evaluation items; the intelligent agent decision module is configured to generate and execute an audit decision action according to the output result of the audit processing module in combination with a reinforcement learning strategy; the feedback learning module is configured to collect the difference between the artificial review result and the system decision result, and generate an incremental training sample; and the storage module is configured to vectorize all report data, model parameters, rule sets, knowledge graph entity relationships and decision logs.

[0006] Further, the trained audit model is obtained by the following steps: the report acquisition module acquires a set of training samples of the historical evaluation report with the labeled compliance; the rule management module provides a basic rule set as prior knowledge; multi-granularity text preprocessing is performed on each report in the training sample set, including document structure analysis and sentence segmentation, to generate corresponding word vector sequences and sentence vector sequences; a bidirectional long short-term memory network model with a fusion attention mechanism is constructed, the word vector sequences and the sentence vector sequences, and relevant entity embedding vectors obtained from the knowledge graph module are fused as model inputs for joint training, and model parameters are optimized until convergence; the feedback learning module is used to continuously obtain incremental samples to fine-tune the model, and the final deployed trained audit model is obtained.

[0007] Further, the multi-granularity text preprocessing includes: using a domain adaptive Chinese word segmentation tool to perform word segmentation processing on the input evaluation report to obtain a Chinese word sequence; performing part-of-speech tagging and named entity recognition on the Chinese word sequence to identify key entities such as security control points, evaluation items, device models and configuration parameters in the report; removing general stop words and domain stop words from the part-of-speech tagged sequence; applying a TF-IDF statistical method to remove low-frequency words with a frequency lower than a preset threshold or to retain a set number of words with the highest word frequency; applying a word2vec extension model trained in combination with the domain knowledge graph to perform word vectorization on the processed word sequence to generate word vector representations with domain semantic features; and simultaneously performing structural analysis on table data in the report, converting the analysis result into a standardized key-value pair sequence and performing vectorization representation.

[0008] Furthermore, the review processing module uses the trained review model to review the information security compliance assessment report to be reviewed, specifically including: receiving the information security compliance assessment report to be reviewed; performing the same multi-granularity text preprocessing on the report as in the training phase to obtain its word vectors and sentence vector representations; inputting the vector representations into the trained review model, which calls the knowledge graph module to perform real-time semantic association queries and outputs the compliance score and confidence level of each sentence in the information security compliance assessment report relative to a specific information security compliance clause; aggregating sentence-level scores to generate chapter-level compliance conclusions and overall report compliance conclusions; and establishing a review context vector to record the decision-making path and key judgment criteria during the review process, providing a reference for subsequent reviews.

[0009] Furthermore, the review processing module is also used to: mark a sentence as a high-uncertainty abnormal sentence when the compliance score of a sentence is lower than a preset threshold or the confidence level is lower than another preset threshold; submit the high-uncertainty abnormal sentence, its context vector, and the associated information security clause ID to the rule management module for precise rule matching; update the review result of the sentence based on the result of precise rule matching, and send this case to the feedback learning module; and simultaneously perform root cause analysis on the abnormal sentence to identify the problem type and potential correction scheme that led to the compliance issue.

[0010] Furthermore, the rule management module includes a rule base unit, a rule parsing engine, and a rule update unit. The rule base unit stores specific security control measures and clauses from each level of the Cybersecurity Classified Protection 2.0 (CCP 2.0) requirements in a structured format. The rule parsing engine performs semantic similarity calculations and logical condition matching between the submitted sentence content and vector features and the clauses in the rule base, outputting the matching results and compliance judgments. The rule update unit receives manual revision instructions from the system administrator for the rule base or automatically generates new rule logic based on the output of the feedback learning module. The rule management module also includes a rule conflict detection and resolution mechanism to ensure the consistency and consistency of rules in the rule base.

[0011] Furthermore, the knowledge graph module includes an entity recognition and linking unit, a relation extraction unit, and a graph reasoning unit. The entity recognition and linking unit is used to extract security domain entities from the audit report and link them to standard nodes in the knowledge graph. The relation extraction unit identifies and stores the membership, dependency, mutual exclusion, and satisfaction relationships between entities based on a predefined ontology schema. The graph reasoning unit is used to provide subgraph query and relation reasoning services based on graph neural networks for the audit processing module and the rule management module. The knowledge graph module also supports dynamic graph updates and version management to ensure that the graph data is consistent with the latest security compliance standards.

[0012] Furthermore, the intelligent agent decision-making module includes a strategy network unit and an action execution unit. The strategy network unit is a neural network based on deep Q-learning, which generates the optimal processing strategy based on the current review status, including compliance score distribution, the number of high-uncertainty abnormal sentences, knowledge graph query results, and historical decision-making efficiency. The action execution unit is used to execute the strategy actions output by the strategy network unit. The actions include marking the report as automatically approved, returning it to a specified modification stage, triggering a human expert review process, or calling the automatic correction submodule to make suggested modifications to the report text.

[0013] Furthermore, the storage module employs an intelligent multimodal database system, including a relational database, a graph database, and a vector database. The relational database stores structured report metadata and system logs. The graph database stores the knowledge graph data. The vector database stores high-dimensional vector representations of all reports and sentences, as well as the parameters of the trained auditing model, and provides a fast retrieval function based on similarity. The storage module also includes a data governance unit responsible for data lifecycle management, quality checks, and access control to ensure data consistency and security.

[0014] Furthermore, the feedback learning module includes a difference comparison unit, a sample generation unit, and a model optimization unit. The difference comparison unit monitors and collects the differences between the final manual review results and the initial system review results. The sample generation unit converts the difference cases into labeled samples and calculates the sample weights. The model optimization unit uses weighted incremental samples to periodically fine-tune and optimize the trained review model, the policy network of the agent decision-making module, and the entity vector representation of the knowledge graph. The feedback learning module also includes an effect evaluation unit, which evaluates the performance of the optimized system through A / B testing to ensure the stability and effectiveness of system iteration.

[0015] The embodiments of the present invention have at least the following beneficial effects: 1. The report acquisition module securely retrieves the compliance assessment reports to be reviewed and those marked as compliant from the compliance assessment management platform, providing the system with an accurate and reliable data source for review. This ensures that the review processing module can be trained and reviewed based on high-quality samples, thereby improving the accuracy and credibility of the review results and solving the review deviation problem caused by inaccurate data acquisition in traditional manual review.

[0016] 2. The review and processing module combines multi-granular text preprocessing, a bidirectional long short-term memory network model with an attention mechanism, and real-time semantic association query of the knowledge graph module. It can perform deep semantic understanding and accurate compliance scoring on the information security level assessment report. This not only improves the review efficiency but also enhances the ability to handle complex semantics and multi-dimensional relationships, solving the problems of limited review accuracy and inability to effectively handle complex semantics in existing technologies.

[0017] 3. The feedback learning module generates incremental training samples by collecting the differences between the manual review results and the system decision results. It also performs periodic fine-tuning and optimization on the policy network of the review model and the agent decision module, as well as the entity vector representation of the knowledge graph. This enables the dynamic updating and continuous improvement of the review model, ensuring that the system can be dynamically adjusted and optimized according to the actual review results. This solves the problem in the existing technology of lacking an effective feedback learning mechanism and the difficulty in dynamically optimizing and adjusting the review model according to the actual review results. Attached Figure Description

[0018] The above and other objects, features, and advantages of exemplary embodiments of the present invention will become readily apparent from the following detailed description taken in conjunction with the accompanying drawings. Several embodiments of the invention are illustrated in the drawings by way of example and not limitation, wherein: Figure 1 This is a schematic diagram of the structure of an automated verification and rule matching system for information security compliance assessment reports based on intelligent agents, provided in an embodiment of the present invention. Detailed Implementation

[0019] The technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.

[0020] In the traditional review process of information security compliance (ICT) assessment reports, manual review requires comparing each clause of the ICT 2.0 standard item by item, with an average review time exceeding 4 hours per report. Review efficiency is limited by human reading speed and cognitive load. Existing automated review systems use regular expression-based rule engines, which can only recognize explicit keyword matching scenarios and lack semantic understanding capabilities for complex security control measures involving multi-clause correlation reasoning, resulting in a false positive rate exceeding 25% in complex scenarios. Static rule bases cannot dynamically adapt to standard version updates; when new security control points are added or assessment items are adjusted, the system needs to rebuild the rule logic, with a maintenance cycle of up to two weeks.

[0021] For example, in a Level 3 security compliance assessment scenario for a large cloud service platform, the system needs to process assessment reports containing 12 security categories and 156 control points. Existing methods use a bag-of-words model-based classifier for clause matching, which cannot identify cross-layer architecture descriptions such as "access control policies must cover both the virtualization layer and physical network devices," resulting in 32% of related control measures not being correctly classified. When the audit involves the dependency relationship between "secure communication network" and "regional boundary protection" in the knowledge graph, traditional systems, lacking entity relationship reasoning capabilities, mistakenly determine compliant defense-in-depth architectures as non-compliant.

[0022] like Figure 1 As shown, this application proposes an automated verification and rule matching system for information security compliance assessment reports based on intelligent agents, including: The report acquisition module 101 is used to acquire the pending information security assessment report and historical information security assessment reports marked with compliance from the information security assessment management platform via a secure file transfer protocol; the review processing module 102 is used to load the trained review model and perform automated compliance review on the pending information security assessment report; the rule management module 103 is used to store, parse, and match machine-readable review rules structured from the information security 2.0 standard clauses; the knowledge graph module 104 is used to construct and store a domain knowledge graph based on the multi-dimensional relationships between the information security 2.0 standard family, security control measures, and assessment items; the intelligent agent decision-making module 105 is used to generate and execute review decision actions based on the output results of the review processing module and in combination with reinforcement learning strategies; the feedback learning module 106 is used to collect the differences between the manual review results and the system decision results and generate incremental training samples; and the storage module 107 is used to vectorize and store all report data, model parameters, rule sets, knowledge graph entity relationships, and decision logs.

[0023] The system comprises several components: a report acquisition module for retrieving pending and historical reports from the compliance assessment management platform, utilizing SFTP for secure file transfer to address the inefficiency of traditional manual acquisition; an audit processing module for automating compliance audits, employing pre-trained deep learning models for semantic understanding and rule matching to overcome the subjectivity of manual audits; a rule management module for storing and parsing structured data related to the compliance 2.0 standard, using a rule engine to make clauses machine-readable and address inaccurate rule application; a knowledge graph module for storing domain relationships, using graph databases for multi-dimensional entity relationship modeling to resolve the lack of complex semantic relationships; an agent decision-making module for generating audit decisions, using reinforcement learning algorithms for dynamic policy optimization to address the poor adaptability of static rules; and a feedback learning module for iterative system optimization, using an incremental learning framework to update model parameters and address the inability of traditional models to dynamically adjust. The storage module refers to the component used for multimodal data management. Specifically, it can adopt a hybrid architecture of relational databases, graph databases, and vector databases to solve the problem of low efficiency in heterogeneous data storage.

[0024] This application utilizes an intelligent agent decision-making mechanism to coordinate knowledge graphs and dynamic rule bases, combined with incremental feedback learning to achieve continuous optimization of the automated review system. At the same time, it leverages a multimodal storage architecture to improve data retrieval and processing efficiency, forming a closed-loop optimized information security compliance report review system.

[0025] Specifically, the report acquisition module retrieves the pending compliance assessment reports and historical compliance assessment reports marked with compliance from the compliance assessment management platform via a secure file transfer protocol. The review processing module loads the trained review model and performs automated compliance review on the pending compliance assessment reports. The rule management module stores, parses, and matches machine-readable review rules structured from the compliance 2.0 standard clauses. The knowledge graph module constructs and stores a domain knowledge graph based on the multi-dimensional relationships between the compliance 2.0 standard family, security control measures, and assessment items. The agent decision-making module generates and executes review decision actions based on the output of the review processing module, combined with reinforcement learning strategies. The feedback learning module collects the differences between manual review results and system decision results, generating incremental training samples. The storage module vectorizes and stores all report data, model parameters, rule sets, knowledge graph entity relationships, and decision logs.

[0026] The modules work collaboratively to automate the verification and rule matching of compliance assessment reports. The report acquisition module first obtains reports to be reviewed and historical reports, providing a data foundation for subsequent processing. The review processing module uses a trained model to conduct a preliminary review of the reports and generate compliance assessment results. The rule management module and knowledge graph module provide rule matching and semantic understanding support for the review process, improving review accuracy. The intelligent agent decision-making module dynamically generates decisions based on the review results, enabling flexible review strategies. The feedback learning module continuously optimizes the review model by comparing system decisions with manual review results. The storage module manages system data in a unified manner, supporting efficient retrieval and analysis.

[0027] This technical solution employs an agent-based architecture, combining machine learning and knowledge graph technologies to effectively handle complex semantics and multi-dimensional relationships in compliance assessment reports, thereby improving review efficiency and accuracy. The reinforcement learning strategy enables the system to dynamically adjust its decisions based on actual review conditions, adapting to different types of reports and review requirements. A feedback learning mechanism ensures continuous system optimization, enhancing long-term performance.

[0028] As a preferred embodiment, the solution of this application is specifically implemented as follows: The report acquisition module uses the SFTP protocol to retrieve pending and historical reports from the compliance assessment management platform. The review processing module uses a BERT-based pre-trained language model, combined with domain-specific fine-tuning, to perform semantic understanding and compliance assessment of the reports. The rule management module stores structured review rules in JSON format and uses the Rete algorithm for efficient rule matching. The knowledge graph module is built on the Neo4j graph database, storing compliance standard entities and relationships, and supports graph traversal and reasoning queries. The agent decision-making module uses the Deep Q-Network (DQN) algorithm to select the optimal decision action based on the current review status. The feedback learning module uses incremental learning algorithms, such as Online Gradient Descent, to continuously update the review model. The storage module adopts a hybrid storage architecture, combining the relational database MySQL and the vector database Milvus to achieve efficient storage and retrieval of structured data and high-dimensional vectors.

[0029] During system operation, the system first acquires the report to be reviewed, preprocesses it, and then inputs it into the review model. The model outputs preliminary review results, simultaneously triggering knowledge graph queries and rule matching. The intelligent agent decision-making module integrates this information to determine whether manual intervention is needed or automatic approval is required. The review results are stored in the database and periodically compared with the results of manual review, generating feedback data for model optimization. The entire process is highly automated, significantly improving the efficiency and accuracy of the review of information security compliance assessment reports.

[0030] This application further proposes that the trained review model is trained through the following steps: The report acquisition module obtains a training sample set of labeled historical information security assessment reports; the rule management module provides a basic rule set as prior knowledge; each report in the training sample set undergoes multi-granularity text preprocessing, including document structure parsing, sentence segmentation, and multi-granularity text preprocessing, generating corresponding word vector sequences and sentence vector sequences; a bidirectional long short-term memory network model with an attention mechanism is constructed, fusing the word vector sequences, sentence vector sequences, and relevant entity embedding vectors obtained from the knowledge graph module as input for joint training, optimizing model parameters until convergence; and the feedback learning module continuously acquires incremental samples to fine-tune the model, resulting in the final deployed trained review model.

[0031] The multi-granular text preprocessing includes document structure parsing and sentence segmentation to ensure hierarchical text processing. Word vector sequences and sentence vector sequences are generated using a domain-adaptive word segmentation tool and a word vectorization model, preserving semantic features of the security domain. Entity embedding vectors provided by the knowledge graph module are extracted through graph neural networks to reflect multidimensional relationships between entities. A bidirectional long short-term memory network model with an attention mechanism captures cross-modal semantic relationships by jointly training word vectors, sentence vectors, and entity embedding vectors. Incremental sample fine-tuning employs an online learning strategy, dynamically adjusting model parameters based on differential data collected by the feedback learning module. For example, in the word vectorization stage, a word2vec extended model trained with a domain knowledge graph maps professional terms such as access control and identity authentication to adjacent regions in a high-dimensional vector space, enhancing the model's ability to recognize domain concepts.

[0032] Specifically, after the training sample set is obtained through the report acquisition module, the document structure is first parsed, splitting the report into chapters, paragraphs, and sentence levels, preserving the original document's logical structure. After sentence segmentation, the text is processed using a domain-adaptive word segmentation tool to identify key entities such as security control points and evaluation items, while removing common stop words and low-frequency words. The word vector sequence and sentence vector sequence are generated by the extended word2vec model and sentence encoder, respectively, while the knowledge graph module queries relevant entity embedding vectors. The three are then weighted and fused through an attention mechanism before being input into a bidirectional long short-term memory network. During training, the model optimizes parameters through backpropagation to ensure that the compliance prediction results are consistent with the labeled tags. After deployment, the feedback learning module continuously collects cases of discrepancies from manual review, transforms them into incremental samples, and injects them into the model for fine-tuning, ensuring that the model parameters are dynamically optimized as the review scenario changes. For example, when a new compliance clause is added, the incremental samples contain the labeled report corresponding to the new clause. The model quickly learns the new rules and semantic patterns through fine-tuning, avoiding the resource consumption caused by retraining.

[0033] As a preferred embodiment, the trained auditing model is trained through the following steps: the report acquisition module obtains a training sample set of labeled historical compliance assessment reports; the rule management module provides a basic rule set as prior knowledge; each report in the training sample set undergoes multi-granularity text preprocessing, including document structure parsing, sentence segmentation, and multi-granularity text preprocessing, generating corresponding word vector sequences and sentence vector sequences; a bidirectional long short-term memory network model with an attention mechanism is constructed, fusing the word vector sequences, sentence vector sequences, and relevant entity embedding vectors obtained from the knowledge graph module, and using them as model input for joint training to optimize model parameters until convergence; the feedback learning module continuously acquires incremental samples to fine-tune the model, resulting in the final deployed trained auditing model.

[0034] Specifically, the report acquisition module first obtains a batch of historical compliance assessment reports that have been manually reviewed and marked as compliant from the compliance assessment management platform. These reports constitute the initial training sample set. The rule management module provides machine-readable review rules structured from the compliance 2.0 standard clauses as prior knowledge for model training.

[0035] Furthermore, multi-granular text preprocessing is performed on each report. First, document structure parsing is conducted to identify the report's chapter and paragraph structure. Then, sentence segmentation is performed to divide continuous text into independent sentence units. Next, a multi-granular text preprocessing workflow is executed, including Chinese word segmentation, part-of-speech tagging, named entity recognition, stop word filtering, TF-IDF feature extraction, and other steps, ultimately generating word vector sequences and sentence vector sequences.

[0036] Therefore, a bidirectional long short-term memory network model incorporating an attention mechanism is constructed. This model takes word vector sequences and sentence vector sequences as input, and simultaneously queries relevant entity embedding vectors from a knowledge graph module for fusion. The model's parameters are optimized using a backpropagation algorithm until the loss function converges.

[0037] For example, the Adam optimizer can be used with a learning rate of 0.001, a batch size of 64, and 100 training epochs. After each training epoch, the model performance is evaluated using a validation set. Training is terminated early when the performance on the validation set no longer improves after 5 consecutive epochs.

[0038] Finally, the feedback learning module continuously acquires new review cases as incremental samples, and the model is fine-tuned periodically. New review cases can be collected weekly, and when the cumulative number of samples reaches 1000, incremental training is performed, using a small learning rate such as 0.0001 for fine-tuning to maintain the stability of the model.

[0039] The present application further proposes a multi-granularity text preprocessing method, including: using a domain-adaptive Chinese word segmentation tool to segment the input equal protection evaluation report to obtain a Chinese word sequence; performing词性标注 and named entity recognition on the Chinese word sequence to identify key entities such as security control points, evaluation items, device models, and configuration parameters in the report; removing general stop words and domain stop words from the sequence after词性标注; applying the TF-IDF statistical method to remove low-frequency words with a frequency lower than a preset threshold or retain a set number of words with the highest frequency; applying a word2vec extended model trained in combination with a domain knowledge graph to vectorize the processed word sequence to generate a word vector representation with domain semantic features; at the same time, performing structured parsing on the table data in the report, converting the parsing result into a standardized key-value pair sequence and performing vectorization representation.

[0040] Among them, the domain-adaptive Chinese word segmentation tool optimizes the word segmentation boundary by loading a network security domain dictionary to ensure the complete segmentation of compound terms such as firewall policies.词性标注 uses a sequence annotation model based on bidirectional LSTM, and the named entity recognition module outputs security control point entity tags through the CRF layer. The stop word filtering stage sets two-level word lists. The general word list contains function words such as "的", "是", etc., and the domain word list contains high-frequency but non-discriminative nouns such as "系统", "设备", etc. The TF-IDF threshold is set to 0.03, and 500 words with the highest frequency are retained. The word2vec extended model injects the co-occurrence relationship of knowledge graph entities for incremental training based on the training of general corpus. The table parsing uses a rule-based regular matching method to convert the configuration item: value format data into a JSON structure.

[0041] Specifically, in the Chinese word segmentation stage, through domain dictionary matching, the three-level equal protection requirements are correctly segmented into complete phrases instead of single characters.词性标注 identifies that "访问控制" is a verb-object structure phrase and marks it as a verb phrase, and the named entity recognition module classifies it as a security control point entity. In the stop word filtering stage, high-frequency function words in legal texts such as "应当", "必须" are removed. The TF-IDF processing retains highly discriminative terms such as "双因素认证", "日志审计", and filters out generalized words such as "计算机", "服务器". In the word vectorization stage, through the knowledge graph-enhanced embedding model, "入侵检测" and "IDS" obtain similar vector representations. In the table parsing stage, the scattered firewall configuration parameter table in the original report is converted into a standard key-value sequence of {"协议类型": "TCP", "端口范围": "80-443"}. These processing steps jointly construct an input representation containing precise semantic features and structured data, providing high-quality vectorized features for the subsequent review model, and effectively improving the accuracy and interpretability of compliance judgment.

[0042] As a preferred embodiment, the solution of the present application is specifically implemented as follows: The multi-granularity text preprocessing includes the following steps: First, use a domain-adaptive Chinese word segmentation tool to segment the input equal protection evaluation report to obtain a Chinese word sequence. Specifically, adopt a word segmentation algorithm based on conditional random fields and perform adaptive word segmentation in combination with an equal protection domain dictionary.

[0043] Secondly, perform词性标注与命名实体识别on the Chinese word sequence to identify key entities such as security control points, evaluation items, device models, and configuration parameters in the report.词性标注uses the hidden Markov model, and命名实体识别uses the bidirectional long short-term memory network model.

[0044] Furthermore,剔除通用停用词与领域停用词from the sequence after词性标注. General stop words include "的", "了", "在", etc., and domain stop words include high-frequency but low-information words such as "系统", "设备", etc.

[0045] Subsequently, apply the TF-IDF statistical method to剔除出现频率低于预设阈值的低频词or保留词频最高的设定数目个词语. The TF-IDF threshold is set to 0.001, and 1000 words with the highest word frequencies are retained.

[0046] Next, apply a word2vec extended model trained in combination with a domain knowledge graph to perform word vectorization on the processed word sequence to generate a word vector representation with domain semantic features. The word vector dimension is set to 300 dimensions, the window size is 5, and negative sampling is used to optimize the training.

[0047] Finally, perform structured parsing on the table data in the report, convert the parsing result into a standardized key-value pair sequence, and perform vectorization representation. Table parsing uses a rule-based method to extract the table header and cell content and generate key-value pairs in the form of field name: field value.

[0048] This application further proposes that the review processing module uses the trained review model to review the equal protection evaluation report to be reviewed, specifically including: receiving the equal protection evaluation report to be reviewed; performing multi-granularity text preprocessing on the report that is consistent with the training stage to obtain its word vector and sentence vector representations; inputting the vector representations into the trained review model, and the model calls the knowledge graph module to perform real-time semantic association queries, and outputs the compliance score and confidence level of each sentence in the equal protection evaluation report relative to specific equal protection clauses; aggregating the sentence-level scores to generate chapter-level compliance conclusions and overall report compliance conclusions; establishing a review context vector to record the decision-making path and key judgment basis during the review process, providing a reference for subsequent reviews.

[0049] It should be noted that there are some terms in the original text that seem to be in Chinese and not fully described in the instructions. I have tried to translate them as accurately as possible based on the context, but they may need further clarification in a real application scenario. For example, "词性标注与命名实体识别" and "剔除通用停用词与领域停用词" are directly translated as the corresponding Chinese terms first and then left for possible adjustment according to the actual meaning.The multi-granularity text preprocessing uses the same word segmentation tools and word vector generation models as the training phase to ensure consistency in the input feature space. Real-time semantic association queries are implemented through the graph neural network subgraph query interface in the knowledge graph module, dynamically obtaining the embeddings of standard clause entities related to the current sentence. Compliance score aggregation uses a weighted average algorithm, with weights dynamically adjusted based on the sentence's position and confidence level in the report. The review context vector encodes key judgment nodes in the review process through a long short-term memory network, forming a traceable decision path sequence.

[0050] Specifically, after the audit report is preprocessed to generate a structured vector, it is input into the audit model for sentence-by-sentence analysis. When calculating the compliance score, the model simultaneously initiates a query request to the knowledge graph module to obtain the embedding vectors of standard clause entities related to the current sentence. For example, when processing sentences involving firewall configuration, the model retrieves the vectors of security control measures clauses related to access control in the Cybersecurity Classified Protection 2.0 standard through a knowledge graph query. In the scoring aggregation stage, chapter-level conclusions are derived by calculating the weighted scores of all sentences within that chapter, with the weight coefficients determined based on sentence confidence and chapter structure hierarchy. The audit context vector is updated with each scoring operation, recording key parameters of the current audit status, including the entity identifier that triggered the knowledge graph query, the rule version number used for scoring calculation, and confidence distribution data. This vector is stored in a vector database as key-value pairs, allowing historical decision-making basis to be retrieved through vector similarity when subsequent audits involve similar content.

[0051] As a preferred embodiment, the solution of this application is specifically implemented as follows: The review and processing module uses a trained review model to review the compliance assessment reports to be reviewed. First, it receives the compliance assessment reports. Then, it performs multi-granularity text preprocessing on the reports, consistent with the training phase, to obtain word and sentence vector representations. Next, the vector representations are input into the trained review model, which calls the knowledge graph module to perform real-time semantic association queries, outputting the compliance score and confidence level of each sentence in the compliance assessment report relative to a specific compliance clause. Further, sentence-level scores are aggregated to generate chapter-level compliance conclusions and overall report compliance conclusions. Finally, a review context vector is established to record the decision-making path and key judgment criteria during the review process, providing a reference for subsequent reviews.

[0052] Specifically, the compliance assessment report to be reviewed is obtained from the compliance assessment management platform via a secure file transfer protocol. Multi-granular text preprocessing includes segmentation using a domain-adaptive Chinese word segmentation tool, part-of-speech tagging and named entity recognition on the segmentation results, stop word removal, TF-IDF statistical method for word selection, and word2vec extended model for generating word vector representations. The review model employs a bidirectional long short-term memory network structure with an attention mechanism, combined with entity embedding vectors from the knowledge graph for reasoning. Compliance scoring uses a standardized score of 0-1, with confidence expressed as a percentage. Chapter-level and overall report compliance conclusions are generated using a weighted average method. The review context vector contains the input features, output results, and associated knowledge graph entity IDs for each decision node.

[0053] This application further proposes that when a sentence's compliance score is lower than a preset threshold or its confidence level is lower than another preset threshold, the sentence is marked as a high-uncertainty anomalous sentence; the high-uncertainty anomalous sentence, its context vector, and the associated information security clause ID are submitted to the rule management module for precise rule matching; the review result of the sentence is updated based on the precise rule matching result, and this case is sent to the feedback learning module; at the same time, root cause analysis is performed on the anomalous sentence to identify the problem type that leads to the compliance issue and potential remedial solutions.

[0054] Specifically, when marking sentences with high uncertainty, a preset threshold and a confidence threshold are used as judgment conditions, and the threshold settings are based on the statistical analysis of historical review data; the context vector contains the structured information of the chapter in which the sentence is located and the semantic features of adjacent sentences; the precise rule matching of the rule management module is achieved through semantic similarity calculation and logical condition comparison, and the matching results cover clause citation relationships and constraints; the root cause analysis is based on the rule matching results and the association with knowledge graph entities to construct a problem type classification model and output correction scheme suggestions.

[0055] Specifically, when a sentence's compliance score or confidence level fails to meet a preset standard, the system automatically triggers an exception handling process. The exception sentence and its context vector are transmitted to the rule management module, where the rule parsing engine performs a step-by-step logical match between the sentence content and structured clauses, eliminating uncertainty in the model's initial judgment. The matching results are used to correct the sentence's review conclusion, and discrepancies are stored in the feedback learning module to generate incremental training samples. The root cause analysis module, combining the violation clause IDs from the rule matching results, extracts associated security control measures and evaluation items from the knowledge graph, identifies the root cause of the problem through path reasoning, and generates specific correction suggestions including configuration parameter adjustments or supplementary detection items. This process improves the accuracy of the review results through a secondary verification mechanism, while providing targeted cases for model optimization, reducing the probability of similar errors recurring.

[0056] As a preferred embodiment, the solution of this application is specifically implemented as follows: When the review processing module reviews the information security compliance assessment report to be reviewed using the trained review model, it marks a sentence as a high-uncertainty anomalous sentence if it finds that the compliance score is lower than a preset threshold or the confidence level is lower than another preset threshold. For example, the compliance score threshold is set to 0.7 and the confidence level threshold is set to 0.8. For a specific sentence, if its compliance score is 0.65 or its confidence level is 0.75, then the sentence will be marked as a high-uncertainty anomalous sentence.

[0057] Furthermore, the review and processing module submits the highly uncertain abnormal sentence, its context vector, and the associated information security compliance clause ID to the rule management module for precise rule matching. Specifically, the context vector contains the semantic representations of the five sentences before and after the sentence, and the information security compliance clause ID is the specific information security compliance 2.0 standard clause number corresponding to the sentence.

[0058] Therefore, after receiving the submitted information, the rule management module uses the rule parsing engine to calculate the semantic similarity and logical condition matching of the sentence content and vector features with the clauses in the rule base, and outputs the matching result and compliance judgment. Based on the accurate rule matching result, the review processing module updates the review result of the sentence and sends this case to the feedback learning module.

[0059] The review and processing module also performs root cause analysis on abnormal sentences to identify the types of issues leading to compliance problems and potential remedial solutions. For example, issue types might include insufficient descriptions of security measures, incomplete control point coverage, or parameter configurations that do not meet requirements. Potential remedial solutions provide corresponding suggestions for different issue types, such as supplementing specific security measure descriptions, adding missing control points, or adjusting parameter configurations.

[0060] This application further proposes a rule management module comprising a rule base unit, a rule parsing engine, and a rule update unit. The rule base unit stores specific security control measures and clauses from each level of the Cybersecurity Classified Protection 2.0 (CCP 2.0) requirements in a structured format. The rule parsing engine performs semantic similarity calculations and logical condition matching between the submitted sentence content and vector features and the clauses in the rule base, outputting the matching results and compliance determination. The rule update unit receives manual revision instructions from the system administrator for the rule base or automatically generates new rule logic based on the output of the feedback learning module. The rule management module also includes a rule conflict detection and resolution mechanism to ensure the consistency and consistency of rules in the rule base.

[0061] The rule base unit stores clauses in XML format, with each clause corresponding to a security control point number, applicable level, control requirement text, and logical condition expression. The rule parsing engine incorporates a BERT-based semantic similarity calculation model, using a cosine similarity threshold to determine the match between sentences and clauses, while simultaneously parsing logical expressions to verify condition fulfillment. The rule update unit has a version control interface; upon receiving a manual revision instruction, it automatically generates a new version of the rule and records the operation log. For automatically generated rule logic, inductive logic programming techniques are used to extract rule patterns from incremental samples. The conflict detection and resolution mechanism establishes a rule dependency graph, uses a graph traversal algorithm to detect mutually exclusive rules, and automatically resolves them according to a preset priority strategy.

[0062] Specifically, when a highly uncertain anomalous sentence is submitted to the rule management module, the rule parsing engine first extracts the sentence vector features and calculates their similarity with the clause vectors stored in the rule base unit, filtering candidate clauses with a similarity higher than 0.85. Then, the logical conditional expressions of the candidate clauses are parsed to verify whether the sentence content meets all necessary conditions. If a match is successful, the compliance determination result is returned to the review processing module; if a match fails, the rule update process is triggered. The rule update unit generates new logical rules based on the difference cases provided by the feedback learning module through pattern mining, and writes them into the rule base after conflict detection confirms there are no contradictions. For example, when a conflict is detected between the applicability level of a clause and a newly added rule, the conflict resolution mechanism automatically retains the higher version rule based on the priority of the security compliance standard version. This process ensures the accuracy of rule matching and system adaptability through structured storage and dynamic update mechanisms.

[0063] As a preferred embodiment, the solution of this application is specifically implemented as follows: The rule management module comprises a rule base unit, a rule parsing engine, and a rule update unit. The rule base unit stores the specific security control measures and clauses from each level of the Cybersecurity Classified Protection 2.0 (CCP 2.0) requirements in a structured format. The rule parsing engine calculates semantic similarity and performs logical condition matching between the submitted sentence content and vector features and the clauses in the rule base, outputting the matching results and compliance determination. The rule update unit receives manual revision instructions from the system administrator for the rule base, or automatically generates new rule logic based on the output of the feedback learning module. The rule management module also includes a rule conflict detection and resolution mechanism to ensure the consistency and consistency of rules in the rule base.

[0064] Specifically, the rule base unit uses a relational database to store the security control measures clauses in the Cybersecurity Classified Protection 2.0 standard. Each rule includes fields such as clause ID, clause content, applicable level, and keywords. The rule parsing engine uses a BERT-based semantic similarity calculation model to match the input sentence with the rule clauses based on similarity. Simultaneously, the engine also includes a decision tree-based logical matching module for handling rules with explicit logical relationships. The rule update unit receives revision instructions from the administrator via a web interface and automatically generates new rules based on feedback data using an incremental learning algorithm. Rule conflict detection employs graph theory algorithms, representing rules as a directed graph and detecting potential conflicts by finding cycles.

[0065] This application further proposes a knowledge graph module including an entity recognition and linking unit, a relation extraction unit, and a graph reasoning unit. The entity recognition and linking unit is used to extract security domain entities from the audit report and link them to standard nodes in the knowledge graph. The relation extraction unit identifies and stores the membership, dependency, mutual exclusion, and satisfaction relationships between entities based on a predefined ontology schema. The graph reasoning unit is used to provide subgraph query and relation reasoning services based on graph neural networks for the audit processing module and the rule management module. The knowledge graph module also supports dynamic graph updates and version management to ensure that the graph data is consistent with the latest security compliance standards.

[0066] The entity recognition and linking unit employs a sequence labeling model combining bidirectional LSTM and CRF. It enhances entity boundary recognition by loading a domain entity dictionary and performs similarity matching between extracted entities and predefined compliance standard nodes in the knowledge graph to achieve accurate linking. The relation extraction unit defines the relationship types and constraints between entities using a predefined ontology schema and employs a graph attention-based relation classification model to extract multi-dimensional relation features from sentence context and entity attributes. The graph reasoning unit integrates a graph neural network model and achieves subgraph reasoning through multi-hop neighbor information aggregation, supporting semantic queries with complex logical rules. Dynamic graph updates are implemented through a version control mechanism for incremental updates. When a new version of the compliance standard is detected, the graph structure migration and entity relationship reconstruction process is automatically triggered.

[0067] Specifically, the entity recognition and linking unit first performs word segmentation and part-of-speech tagging on the review report text. It then identifies entities such as security control points and evaluation items using a sequence labeling model, and calculates similarity by combining the vector representations of existing nodes in the knowledge graph to complete entity alignment. The relation extraction unit extracts semantic features from the context of entity co-occurrence based on the relation types defined in the ontology schema. It determines the specific relation type between entities using a relation classification model and stores it in the graph database. After receiving query requests from the review processing module, the graph reasoning unit performs embedding representation learning on relevant subgraphs based on graph neural networks, generating reasoning results through multi-level neighbor node information propagation. During dynamic updates, the version management module compares the differences between old and new standards, updates the graph structure through entity mapping and relation reconstruction algorithms, and retains historical version data for backtracking. Through these technical means, the knowledge graph module can accurately identify entity associations, support multi-dimensional relation reasoning, and maintain synchronization with the latest standards, thereby improving the accuracy and completeness of semantic association queries during the review process.

[0068] As a preferred embodiment, the solution of this application is implemented as follows: The knowledge graph module includes an entity recognition and linking unit, a relation extraction unit, and a graph reasoning unit. The entity recognition and linking unit is used to extract security domain entities from the audit report and link them to standard nodes in the knowledge graph. The relation extraction unit, based on a predefined ontology schema, identifies and stores the membership, dependency, mutual exclusion, and satisfaction relationships between entities. The graph reasoning unit is used to provide subgraph query and relation reasoning services based on graph neural networks for the audit processing module and the rule management module. The knowledge graph module also supports dynamic graph updates and version management to ensure that the graph data is consistent with the latest security compliance standards.

[0069] Specifically, the entity recognition and linking unit employs a deep learning-based named entity recognition model, such as the BiLSTM-CRF model, to process the audit report and identify key entities such as security control measures, evaluation items, and equipment names. The identified entities are then matched with existing entity nodes in the knowledge graph using an entity linking algorithm to establish associations. The relation extraction unit uses a remote supervision method, combined with predefined relation patterns, to extract semantic relationships between entities from the report text. The graph reasoning unit employs a graph attention network (GAT) model to perform representation learning on the knowledge graph, generating low-dimensional vector representations of entities and relations, supporting complex semantic query and reasoning tasks.

[0070] Furthermore, the dynamic update mechanism of the knowledge graph periodically crawls the latest information security standards documents, uses natural language processing technology to extract newly added or changed entities and relationships, and integrates them into the existing graph. The version management function records the evolution history of the graph through timestamps and difference comparison algorithms, and supports backtracking and querying the graph status at a specific point in time.

[0071] This application further proposes an intelligent agent decision-making module comprising a policy network unit and an action execution unit. The policy network unit is a neural network based on deep Q-learning, which generates the optimal processing policy based on the current review status, including compliance score distribution, the number of high-uncertainty abnormal sentences, knowledge graph query results, and historical decision-making efficiency. The action execution unit is used to execute the policy actions output by the policy network unit. These actions include marking the report as automatically approved, returning it to a specified modification stage, triggering a human expert review process, or calling the automatic correction submodule to make suggested modifications to the report text.

[0072] The policy network unit employs a deep Q-learning framework to construct a multilayer perceptron network. The input layer receives a multidimensional state vector consisting of a compliance score distribution vector, a count of high-uncertainty abnormal sentences, a knowledge graph subgraph embedding vector, and historical decision performance indicators. The hidden layer abstracts features through a fully connected layer, and the output layer generates Q-value estimates for each selectable action. The action execution unit is equipped with a policy mapping table that maps the action with the highest Q-value to a predefined set of operation instructions. The operation instruction set includes automatic approval instructions, return modification instructions, manual review request instructions, and automatic correction instructions. The automatic correction submodule has a built-in text generation model that generates compliance modification suggestions based on the knowledge graph reasoning results.

[0073] Specifically, the policy network unit learns the state-action value function through offline training. During training, an experience replay mechanism is used to store state transition samples, and the target network is updated periodically to stabilize the training process. In the online inference stage, the compliance score distribution and abnormal sentence count output by the review processing module are received in real time. Combined with the embedded vectors of the related entity subgraph returned by the knowledge graph module, the feature representation of the current state is calculated. After the policy network outputs the Q-value of each selectable action, the action execution unit selects the action with the largest Q-value to execute according to a preset threshold. When the difference in Q-values ​​is less than the set threshold, the manual review action is given priority. For example, when the number of highly uncertain abnormal sentences exceeds the set threshold and the knowledge graph query shows that there are mutually exclusive clauses, the policy network generates a decision action to trigger manual review to ensure the reliability of the review conclusion.

[0074] As a preferred embodiment, the solution of this application is implemented as follows: The intelligent agent decision-making module includes a policy network unit and an action execution unit. The policy network unit adopts a deep Q-learning neural network architecture, which includes an input layer, three fully connected hidden layers, and an output layer. The number of nodes in the input layer is consistent with the feature dimensions of the current review status, including the compliance score distribution vector, the normalized value of the number of high-uncertainty abnormal sentences, the entity association degree matrix of the knowledge graph query results, and the sliding window statistics of historical decision effectiveness. The hidden layers use the ReLU activation function, and the output layer corresponds to the probability distribution of four preset review actions. The action execution unit is configured with a multi-threaded processing architecture. After the policy network outputs the action probability distribution, it selects the action type with the highest probability value. If the action is to trigger the manual expert review process, a work order containing abnormal sentence location information and compliance defect classification is generated and pushed to the designated review terminal through a message queue. If the action is to call the automatic correction submodule, suggestions for completing missing control items in the report text are generated based on the compliance benchmark template provided by the knowledge graph module.

[0075] This application further proposes an intelligent agent decision-making module comprising a policy network unit and an action execution unit. The policy network unit is a neural network based on deep Q-learning, which generates the optimal processing policy based on the current review status, including compliance score distribution, the number of high-uncertainty abnormal sentences, knowledge graph query results, and historical decision-making efficiency. The action execution unit is used to execute the policy actions output by the policy network unit. These actions include marking the report as automatically approved, returning it to a specified modification stage, triggering a human expert review process, or calling the automatic correction submodule to make suggested modifications to the report text.

[0076] The strategy network unit employs a deep Q-learning algorithm to construct a neural network model. The input layer of this network receives compliance score distribution vectors, statistical values ​​of the number of abnormal sentences, knowledge graph-related entity vectors, and historical decision-making effectiveness index vectors. The hidden layer performs feature fusion through a fully connected layer, and the output layer generates Q-value evaluations for each candidate action. The action execution unit is configured with interface components that interface with the review process, including automatic approval, return for modification, manual review triggering, and text correction interfaces. After receiving action instructions from the strategy network, the interface components call the corresponding business logic modules to execute the operations.

[0077] Specifically, after the review and processing module completes the report compliance score calculation, the strategy network unit receives the current review status data and calculates the expected reward value of each candidate action through forward propagation of the neural network. For example, when the compliance score is higher than the threshold and the number of abnormal sentences is zero, the strategy network outputs the highest Q-value for the automatic pass action, and the action execution unit calls the automatic interface to complete the report marking. When the number of highly uncertain abnormal sentences exceeds the set threshold, the strategy network selects to trigger the manual review process based on historical decision-making efficiency data to avoid erroneous decisions. The deep Q-learning network continuously optimizes the network weight parameters through a reward function mechanism, based on the review result difference data provided by the subsequent feedback learning module, so that the strategy generation process gradually approaches the optimal decision path.

[0078] As a preferred embodiment, the solution of this application is implemented as follows: The storage module adopts a multimodal database architecture. The relational database uses a MySQL cluster to store report metadata, including report number, creation time, audit status fields, and user ID and timestamp from the system operation log. The graph database deploys a Neo4j instance to store knowledge graph data, where node types include entities of security compliance standards and security control measures, and edge relationships use an attribute graph model to record the hierarchical affiliation and logical dependencies between entities. The vector database uses a Milvus distributed architecture to store 768-dimensional sentence vectors generated by the BERT model from the report text, while also saving the weight matrix of the fully connected layer of the audit model. The data governance unit has a built-in automated data cleaning pipeline that performs integrity checks and outlier filtering on the incoming data, and establishes a role-based access control policy to implement dynamic permission approval for similarity retrieval requests in the vector database.

[0079] This application further proposes a feedback learning module comprising a difference comparison unit, a sample generation unit, a model optimization unit, and an effectiveness evaluation unit. The difference comparison unit captures the difference data between the manual review results and the system review conclusions in real time; the sample generation unit converts the difference cases into labeled samples and calculates the sample weights; the model optimization unit uses weighted incremental samples to periodically fine-tune the review model, strategy network, and knowledge graph entity vectors; and the effectiveness evaluation unit verifies the performance of the optimized system through A / B testing.

[0080] The system comprises several functionalities: The discrepancy comparison unit obtains the final judgment results from the manual review database in real time via a data interface, performs field-level comparisons with the system's initial review conclusions, and generates discrepancy records containing discrepancy types, discrepancy locations, and correction annotations. The sample generation unit vectorizes the text fragments and corresponding annotation information in the discrepancy records, sets sample weight coefficients based on the discrepancy type, with samples of compliance judgment errors having higher weights than samples with insufficient confidence. The model optimization unit employs a mini-batch gradient descent algorithm, inputting weighted samples into the bidirectional long short-term memory network layer of the review model, and simultaneously updating the embedding vectors of relevant entities in the knowledge graph and the Q-value function parameters of the policy network. The performance evaluation unit proportionally allocates system traffic to model instances before and after optimization, and generates a performance comparison report by statistically analyzing compliance review accuracy, abnormal sentence recall rate, and manual review intervention rate.

[0081] Specifically, when manual reviewers modify the compliance conclusions automatically generated by the system through the management interface, the difference comparison unit automatically records the original score, correction result, and associated information security clause number of the modified sentence. The sample generation unit extracts the word vectors, context vectors, and associated knowledge graph subgraphs of the sentence, combines them with the correction results to generate training samples, and assigns weight values ​​based on the error frequency of the sentence in historical reviews. The model optimization unit initiates a fine-tuning process during preset low-load periods, using a dynamic learning rate mechanism to update the attention layer parameters of the review model, while adjusting the vector representations of relevant entity nodes in the knowledge graph. Under the control of the effect evaluation unit, the optimized model and policy network process some reports in real-time review tasks. By comparing the changes in F1 scores of the versions before and after optimization on the same test set, the effectiveness of model iteration is verified. When A / B testing shows that the accuracy improvement of the optimized version exceeds a preset threshold and the false positive rate does not increase significantly, the system automatically completes a full model switch.

[0082] As a preferred embodiment, the specific implementation of this application's solution is as follows: The difference comparison unit of the feedback learning module collects JSON format data records of the final review results of manual review and the initial review results of the system in real time through the log interface. The comparison fields include compliance judgment conclusions, abnormal sentence identifiers, and correction opinions. When the sample generation unit transforms cases with differences into labeled samples, it adopts a weight calculation method based on edit distance, assigning higher weight coefficients to samples involving multiple clause conflicts. The model optimization unit adopts an incremental learning algorithm with weighted sampling, inputting new samples into the fully connected layer of the review model every 24 hours for parameter fine-tuning, while simultaneously optimizing the vector representations of related entities in the knowledge graph using cosine similarity alignment. The effect evaluation unit deploys the optimized model copy in the pre-release environment, processes the same batch of evaluation reports in parallel with the production environment model, and compares the differences in the compliance conclusion distribution of the two sets of outputs using a chi-square test. When the P-value is less than 0.05, a version rollback mechanism is triggered.

[0083] Through the above technical solution, this application effectively solves the problem of traditional review systems lacking dynamic optimization capabilities. By establishing a closed-loop feedback mechanism, it achieves continuous iterative optimization of the review model and knowledge graph. This solution can automatically identify cases where there are discrepancies between manual review and system judgment, transforming them into high-quality training samples, and improving the model's ability to handle complex cases through weighted fine-tuning. Simultaneously, a rigorous A / B testing verification mechanism ensures the stability of the system during updates, avoiding abnormal fluctuations in review conclusions caused by model parameter drift.

[0084] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. An automated verification and rule matching system for information security compliance assessment reports based on intelligent agents, characterized in that, The system includes: The report acquisition module is used to obtain the pending information security assessment report and the historical information security assessment report marked as compliant from the information security assessment management platform via a secure file transfer protocol. The review processing module is used to load the trained review model and perform automated compliance review on the information security level assessment report to be reviewed. The rule management module is used to store, parse, and match machine-readable audit rules structured from the terms of the Cybersecurity Classified Protection 2.0 standard. The knowledge graph module is used to construct and store domain knowledge graphs based on the multi-dimensional relationships between the Classified Protection 2.0 standard family, security control measures, and evaluation items; The intelligent agent decision-making module is used to generate and execute review decision actions based on the output of the review processing module and in conjunction with a reinforcement learning strategy. The feedback learning module is used to collect the differences between the results of manual review and the system decision, and generate incremental training samples; The storage module is used to vectorize all report data, model parameters, rule sets, knowledge graph entity relationships, and decision logs.

2. The system according to claim 1, characterized in that, The trained audit model is obtained through the following steps: The report acquisition module obtains a training sample set of labeled historical information security assessment reports; the rule management module provides a basic rule set as prior knowledge. For each report in the training sample set, multi-granular text preprocessing is performed to generate corresponding word vector sequences and sentence vector sequences. A bidirectional long short-term memory network model with an attention mechanism is constructed, and the word vector sequences, sentence vector sequences, and relevant entity embedding vectors obtained from the knowledge graph module are fused and used as model input for joint training to optimize model parameters until convergence. The model is fine-tuned by continuously acquiring incremental samples through the feedback learning module to obtain the finally deployed trained audit model.

3. The system according to claim 2, characterized in that, The multi-granularity text preprocessing includes: using a domain-adaptive Chinese word segmentation tool to segment the input information security assessment report to obtain a Chinese word sequence; Part-of-speech tagging and named entity recognition are performed on the Chinese word sequence to identify key entities in the report, such as safety control points, evaluation items, equipment models, and configuration parameters. Remove general stop words and domain stop words from the part-of-speech tagging sequence; The TF-IDF statistical method is used to remove low-frequency words that occur below a preset threshold or to retain a set number of words with the highest frequency. The word2vec extended model, trained with a domain knowledge graph, is applied to vectorize the processed word sequence, generating word vector representations with domain semantic features. Simultaneously, the tabular data in the report is subjected to structured parsing, and the parsing results are converted into a standardized key-value pair sequence and then vectorized.

4. The system according to claim 2, characterized in that, The review processing module uses a trained review model to review the information security compliance assessment report to be reviewed, specifically including: Receive the pending information security compliance assessment report; The report is subjected to the same multi-granularity text preprocessing as during the training phase to obtain its word vectors and sentence vector representations. The vector representation is input into the trained audit model, which calls the knowledge graph module to perform real-time semantic association query and outputs the compliance score and confidence level of each sentence in the information security level assessment report relative to the specific information security level clause. Aggregate sentence-level scores to generate chapter-level compliance conclusions and overall report compliance conclusions; establish an audit context vector to record the decision-making path and key judgment criteria during the audit process, providing a reference for subsequent audits.

5. The system according to claim 4, characterized in that, The audit processing module is used for: When a sentence has a compliance score below a preset threshold or a confidence level below another preset threshold, the sentence is marked as a high-uncertainty abnormal sentence. The highly uncertain abnormal sentence, its context vector, and the associated information security clause ID are submitted to the rule management module for precise rule matching. The review result of the sentence is updated based on the result of precise rule matching, and this case is sent to the feedback learning module. Perform root cause analysis on abnormal sentences to identify the types of problems that lead to compliance issues and potential remedial measures.

6. The system according to claim 5, characterized in that, The rule management module includes a rule base unit, a rule parsing engine, and a rule update unit; The rule base unit is used to store the specific security control measures clauses in the requirements of each level of the Cybersecurity Classified Protection 2.0 in a structured form; The rule parsing engine is used to perform semantic similarity calculation and logical condition matching between the submitted sentence content and vector features and the terms in the rule base, and output the matching results and compliance judgment. The rule update unit is used to receive manual revision instructions for the rule base from the system administrator, or to automatically generate new rule logic based on the output of the feedback learning module.

7. The system according to claim 6, characterized in that, The knowledge graph module includes an entity recognition and linking unit, a relation extraction unit, and a graph reasoning unit. The entity recognition and linking unit extracts security domain entities from the audit report and links them to standard nodes in the knowledge graph. The relation extraction unit identifies and stores membership, dependency, mutual exclusion, and satisfaction relationships between entities based on a predefined ontology schema. The graph reasoning unit provides subgraph query and relation reasoning services based on graph neural networks for the audit processing module and the rule management module. The knowledge graph module also supports dynamic graph updates and version management to ensure that the graph data is consistent with the latest security compliance standards.

8. The system according to claim 7, characterized in that, The intelligent agent decision-making module includes a strategy network unit and an action execution unit. The strategy network unit is a deep Q-learning-based neural network that generates the optimal processing strategy based on the current review status, including compliance score distribution, the number of high-uncertainty abnormal sentences, knowledge graph query results, and historical decision-making efficiency. The action execution unit is used to execute the strategy actions output by the strategy network unit. These actions include marking the report as automatically approved, returning it to a specified modification stage, triggering a human expert review process, or calling the automatic correction submodule to make suggestive modifications to the report text.

9. The system according to claim 1, characterized in that, The storage module employs an intelligent multimodal database system, including a relational database, a graph database, and a vector database. The relational database stores structured report metadata and system logs. The graph database stores the knowledge graph data. The vector database stores high-dimensional vector representations of all reports and sentences, as well as the parameters of the trained auditing model, and provides a fast retrieval function based on similarity. The storage module also includes a data governance unit responsible for data lifecycle management, quality checks, and access control to ensure data consistency and security.

10. The system according to claim 1, characterized in that, The feedback learning module includes a difference comparison unit, a sample generation unit, and a model optimization unit. The difference comparison unit monitors and collects the differences between the final manual review results and the initial system review results. The sample generation unit converts the difference cases into labeled samples and calculates the sample weights. The model optimization unit uses weighted incremental samples to periodically fine-tune and optimize the trained review model, the policy network of the agent decision-making module, and the entity vector representation of the knowledge graph. The feedback learning module also includes an effect evaluation unit, which evaluates the performance of the optimized system through A / B testing to ensure the stability and effectiveness of system iteration.

Images