Enterprise safety report automatic auditing method based on multi-task AI intelligent agent

Abstract

The invention relates to the technical field of security auditing, in particular to an enterprise security report automatic auditing method based on a multi-task AI agent, which comprises the following steps: a main auditing agent receives enterprise security report text data and generates a primary auditing opinion; receiving the primary auditing opinions by a question generation agent, and generating a group of targeted question sets requiring evidence provision or clarification; a verification execution agent receives the targeted question set and the enterprise safety report text data, and generates a verification evidence chain capable of supporting or counteracting a specific conclusion in the primary auditing opinions; and the main auditing agent receives the verification evidence chain and generates a final auditing report. According to the method, task-driven tool chain arrangement and multi-source information linkage calling are achieved, after verification is completed, tool output is formatted into an'evidence unit 'in a unified mode, and a verification evidence chain is constructed according to a logic / time sequence.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of security audit, in particular to an enterprise security report automatic audit method based on a multi-task AI agent. BACKGROUND

[0002] With the increasing diversification of network attack means and the continuous complexity of enterprise IT architecture, enterprises need to regularly write, review and archive various security reports in daily security management, including vulnerability reports, incident response records, compliance assessment reports, etc. These reports often involve a large amount of unstructured text, complex technical terms, time evolution process and compliance reference content, and have high requirements for professionalism and timeliness. At present, the audit process of the security report of the enterprise still mainly depends on the experience analysis of artificial experts, and the review tasks include: judging whether the risk assessment is accurate, whether the evidence is sufficient, whether there is logical conflict in the conclusion, whether the cited vulnerabilities or clauses are valid, etc.

[0003] However, artificial audit is mainly based on rule matching or keyword recognition, which lacks the ability to critically review the conclusion content and cannot actively find logical flaws, evidence gaps or outdated information in the conclusion. When the doubt is raised, it usually depends on the manual review of the report by security experts, comparison with external databases, cross-analysis of different paragraphs, and lacks reusable, scalable verification tool chain and automatic verification mechanism, which is inefficient and not universal. Even if the reviewer gives the conclusion "established" or "not established", it often lacks traceable evidence support or confidence evaluation, and the report quality is easily affected by individual level, and it is difficult to realize automatic quantization of credibility or establish machine decision standard. The existing technology is difficult to structure the complete chain of "preliminary opinion - doubt - verification - conclusion revision", resulting in that the report content still lacks clear evolution logic and evidence support process after several rounds of revision, which is not conducive to compliance audit and reproduction review. SUMMARY

[0004] The present application provides an enterprise security report automatic audit method based on a multi-task AI agent, which simulates expert thinking path, integrates intelligent judgment, task-driven verification and structured result output capability of enterprise security report automatic audit method, to comprehensively improve the audit efficiency and reduce the artificial dependence.

[0005] The enterprise security report automatic audit method based on a multi-task AI agent, the multi-task AI agent includes a main audit agent, a doubt generation agent and a verification execution agent, and the automatic audit method includes the following steps: S1, the main audit agent receives the enterprise security report text data, performs preliminary analysis and risk assessment thereon, and generates a preliminary audit opinion; S2, the challenge generation agent receives the preliminary audit opinion, critically reviews each risk assessment conclusion therein, and generates a set of targeted challenge set requiring evidence or clarification, wherein each challenge is associated with a specific conclusion in the preliminary audit opinion; S3, the verification execution agent receives the targeted challenge set and the enterprise security report text data, dispatches and executes a plurality of specialized AI tool sets, conducts targeted retrieval, evidence mining and logical reasoning on the original text data of the report according to each challenge, and generates a verification evidence chain that can support or refute a specific conclusion in the preliminary audit opinion; S4, the main audit agent receives the verification evidence chain, conducts fusion analysis with the preliminary audit opinion, and draws a final conclusion, generating a final audit report containing all conclusions and corresponding evidence.

[0006] Optionally, S1 includes format parsing and cleaning of the received enterprise security report text data, removing irrelevant symbols and format markers, and converting unstructured raw text into standardized text with uniform paragraph and chapter identifiers; and using natural language processing-based named entity recognition technology, extracting predefined category security entities from the standardized text, including vulnerability number, affected asset identifier, security event type and compliance clause number.

[0007] Optionally, S1 further includes placing the extracted security entities in the semantic context of the paragraph and chapter where they are located, using a pre-trained risk prediction model to assess the potential risk level of each security entity, and generating a preliminary audit opinion including the security entity and its corresponding risk level.

[0008] Optionally, S2 includes converting each risk assessment conclusion in the preliminary audit opinion into a risk conclusion vector, which encapsulates the semantic content of the conclusion, the confidence level assigned by the main audit agent, and the context location information of the risk conclusion in the report; defining a multi-dimensional analysis framework for each risk conclusion vector, which includes integrity review dimension, accuracy review dimension, consistency review dimension and timeliness review dimension.

[0009] Optionally, S2 further includes calling a corresponding pre-trained challenge discrimination sub-model for each review dimension to analyze the decision-making process, wherein: integrity dimension model, to determine whether the necessary evidence elements supporting the conclusion are complete in the report; accuracy dimension model, to determine whether there is a potential conflict between the conclusion and the report details and external knowledge base; Consistency dimension model, judging whether the conclusion is logically contradictory with other conclusions in the report or relevant conclusions in historical reports; Timeliness dimension model, judging whether the vulnerability, incident or asset status involved in the conclusion is up-to-date; The outputs of each challenge discrimination sub-model are summarized into an associated challenge matrix, which identifies the weak points of each conclusion in the most vulnerable dimension.

[0010] Optionally, according to the associated challenge matrix, a corresponding template is selected from a pre-defined structured challenge template library, and a natural language challenge requiring evidence or clarification is automatically generated; each generated challenge is uniquely bound to a specific conclusion in the primary audit opinion through a challenge-conclusion association identifier, thereby forming the set of targeted challenges.

[0011] Optionally, the S3 specifically comprises: S31, performing semantic analysis on each challenge in the set of targeted challenges to identify the challenge focus and required evidence type; based on the analysis result, generating a verification task metadata for each challenge, the verification task metadata including the target conclusion, the assumption to be verified, the tool type to be called, and the search keywords; S32, according to the verification task metadata, dynamically selecting and serializing one or more tools from a special AI tool set to form a verification tool chain for the challenge, and the verification execution agent drives the verification tool chain to execute by taking the verification task metadata as an input parameter; S33, the last tool in the verification tool chain feeds back its output to the verification execution agent; the agent standardizes the output to generate an evidence unit, which includes an evidence text summary, a source location pointer, and a confidence score supporting or refuting the target conclusion; all evidence units for the same conclusion are linked in logical or chronological order to form a verification evidence chain supporting or refuting the specific conclusion in the primary audit opinion.

[0012] Optionally, the special AI tool set comprises: Deep search tool: used for semantic search beyond simple matching based on keywords to locate relevant paragraphs in the full text of the report; Relationship reasoning tool: used for analyzing the time, cause-and-effect or logical relationship between entities in different paragraphs; External knowledge verification tool: used for accessing external vulnerability databases to verify the authenticity of the statements in the report.

[0013] Optionally, S4 associates the risk assessment conclusion in the primary audit opinion with the built-in challenge-conclusion association identifier in the verification evidence chain; for each conclusion, all corresponding verification evidence chains are traversed, the confidence score of each evidence unit and its support / contradiction position are extracted, and a fusion algorithm based on D-S evidence theory is used to calculate the comprehensive confidence of the conclusion; The comprehensive confidence is compared with a preset confidence threshold: If the comprehensive confidence is higher than the support threshold, the conclusion is confirmed in the final audit report, and the risk level is marked as verified; If the comprehensive confidence is lower than the support threshold but higher than the contradiction threshold, it is determined that the conclusion is not sufficient, and the risk level is revised to be doubtful in the final audit report; If the comprehensive confidence is lower than the contradiction threshold, it is determined that the conclusion is not established, and it is rejected in the final audit report.

[0014] Optionally, S4 further includes generating a structured report, encapsulating and integrating all verified or revised conclusions and their corresponding verification evidence chains to generate the final audit report.

[0015] The beneficial effects of the present application are: 1. The present application introduces a challenge generation intelligent agent as an independent AI function module, which converts the traditional critical review process performed by experts subjectively into a multi-dimensional challenge system executable by machines. Through the construction of four review dimensions of integrity, accuracy, consistency and timeliness, each risk assessment conclusion is structured, deconstructed and compared and evaluated. Not only does the system have the ability of "questioning" and "reflection", but also breaks the limitations of traditional audit which only relies on one-way information extraction and static index scoring. It can effectively find the logical loopholes, evidence missing and time deviation implied in the primary conclusion, and provide accurate trigger basis for subsequent verification; 2. The verification execution intelligent agent of the present application performs semantic analysis on each natural language challenge, generates task metadata, and dynamically schedules different types of AI tools (deep retrieval tools, relationship reasoning tools, external knowledge verification tools) to assemble task adaptive verification tool chains to complete the targeted investigation of the target conclusion. The verification process no longer relies on single retrieval or static rules, but realizes task-driven tool chain arrangement and multi-source information linkage calling. After verification, the tool output is uniformly formatted as "evidence unit", and the "verification evidence chain" is constructed in logical / time order, which improves the verification efficiency and result interpretability of the system in handling complex and security-sensitive reports; 3. This invention introduces DS evidence theory as the basis for multi-source evidence fusion in the final review stage. It performs uncertainty fusion analysis on the supporting / refuting evidence for each conclusion, quantifies the comprehensive confidence level, sets multiple threshold strategies (confirmation, doubt, rejection), makes a clear judgment on each conclusion, and generates a structured review report containing the final judgment, confidence score, and core evidence summary. This not only enables the machine to automatically "make decisions," but also naturally introduces a human-machine collaboration interface through the "doubtful state," clarifies the boundaries of manual review, and realizes an intelligent report review system that is traceable throughout the entire process and whose results are credible and auditable. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only for this invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Fig. 1 This is a schematic diagram of the review method flow according to an embodiment of the present invention; Fig. 2 This is a schematic diagram of the auditing method according to an embodiment of the present invention. Detailed Implementation

[0018] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. For some well-known technologies, those skilled in the art may also use other alternative methods to implement the invention. Moreover, the accompanying drawings are only for more specific description of the embodiments and are not intended to specifically limit the present invention.

[0019] like Figs. 1-2 As shown, the automatic review method for enterprise security reports based on multi-task AI agents includes a main review agent, a question generation agent, and a verification execution agent. The automatic review method includes the following steps: S1. The main auditing agent receives the enterprise security report text data, performs preliminary analysis and risk assessment, and generates a preliminary audit opinion.

[0020] S11. Text parsing and standardization: Perform structural parsing operations on the received enterprise security report text data, including removing XML / HTML format tags, control characters and non-content symbols; normalizing line breaks, indentation and hierarchical relationships; and identifying paragraph structure, chapter levels and heading indexes in the report based on preset regular expression patterns or format templates. Obtain a standardized text set: ;in, For the standardized text collection, For the first segment of the standardized segment text, the total number of segments in the report.

[0021] S12, extract key information, based on the named entity recognition model in natural language processing, for each segment of the standardized text Perform entity recognition operation, extract a set of security entities of predefined categories: ; Where CVE-ID represents the Common Vulnerabilities and Exposures number, Asset-ID represents the unique identifier of the affected asset in the enterprise, and the compliance clause number includes the number defined in ISO 27001 and NIST SP 800-53, and the event type is a classification of security events such as "unauthorized access", "privilege escalation", "service interruption", etc. Each entity has an associated tuple form: .

[0022] The named entity recognition model (NER) is used in the present application to identify security-related information with specific meaning, i.e. "security entities", from the standardized enterprise security report text. The specific execution process of this process can be divided into the following key steps: S121. Each paragraph of the standardized text is input into the NER model for processing. The standardized paragraph has removed impurities and unified the format, which facilitates subsequent high-quality semantic analysis.

[0023] S122. Each paragraph is decomposed into several words or sub-word units, and converted into corresponding semantic vector representations through a pre-trained language model. These semantic representations contain the meaning of the words themselves and their usage in context.

[0024] S123. The NER model predicts whether each word in the input text belongs to a certain named entity and identifies its type in a "sequence labeling" manner. Typical labeling methods such as BIO or BIOES encoding: B-type: beginning of an entity; I-type: internal of an entity; O: non-entity text.

[0025] S124. According to the labeling results of the model, all complete named entities are extracted, and each entity is attached with its type, original text segment, paragraph number in the text, and starting position index in the segment.

[0026] A structured "security entity set" is constructed, each entity contains the following information: Entity Type (CVE-ID, Asset Identifier, Event Type, Compliance Clause Number); Corresponding raw text content; Paragraph number where the entity is located; Position information of the entity in the paragraph.

[0027] S13, Context Association and Risk Assessment: For each identified security entity , obtain its corresponding paragraph as semantic context, input to the deep learning-based risk prediction model , output its risk level score : ; Where, represents a context-aware risk prediction model trained on a large amount of security event corpus, , represents the risk level classification label or continuous risk score of the entity .

[0028] Finally, generate structured primary audit opinions: .

[0029] The model structure of the risk prediction model includes: 1. Input layer: receives two main inputs: Context paragraph : the complete paragraph where the entity is located, used to provide semantic background; Target entity : the security entity identified by NER, including its original text fragment and position in the paragraph.

[0030] 2. Encoding layer: context-aware representation construction, using a pre-trained language model (BERT or RoBERTa) as the basic architecture, converting the input paragraph into a series of word vectors with context semantics. The model uses special entity position indication mechanisms, such as wrapping the entity with [ENT_START] and [ENT_END] tags; or explicitly indicating the start and end indices of the entity in the paragraph through additional position encoding, the purpose is to let the model focus on the relationship between the target entity and its semantic environment, rather than making a general representation of the paragraph.

[0031] 3. Entity context fusion module, after getting the context vector representation, the model fuses the entity and its semantic background in the following ways: Extract the vector representation of the entity's location; Concatenate the vector with the CLS global vector of the full paragraph; Feature fusion and non-linear transformation are performed by one or more feedforward neural networks.

[0032] 4. Classification / regression layer: With classification scheme, the output is three-class risk level labels: low risk / medium risk / high risk; With regression scheme, the output is a continuous risk score (0~1), which is then combined with threshold to divide into risk levels.

[0033] S2, the challenge generation agent receives the primary audit opinion, critically reviews each risk assessment conclusion in it, and generates a set of targeted challenges requiring evidence or clarification, with each challenge associated with a specific conclusion in the primary audit opinion.

[0034] S21, convert each risk assessment conclusion in the primary audit opinion into a risk conclusion vector , which includes the following components: ; where, represents the vector representation of the conclusion semantic content, represents the risk confidence assigned to the conclusion by the main audit agent, represents the vector describing the context location information of the conclusion in the report, including paragraph index, sentence number, page number.

[0035] S211, vectorization of semantic content (semantic encoding): extract the original natural language description of each risk assessment conclusion from the primary audit opinion, such as "the report has an unpatched high-risk vulnerability CVE-2023-4567"; use a pre-trained language model to input the conclusion text into the model and obtain its global semantic vector representation. The [CLS] vector can be used as the overall semantic representative, or the vectors of all tokens in the conclusion text can be averaged and pooled. Finally, a fixed-dimensional semantic vector is generated to represent the semantic meaning of the conclusion.

[0036] S212, quantitative embedding of confidence (trust score): the main audit agent will output a quantitative confidence score during the primary audit, which is standardized to a real number between 0 and 1 as a separate scalar value . Confidence serves as a supplementary indicator for the subsequent challenge generation model, providing a reference signal to determine whether higher intensity review is needed.

[0037] S213, context location information encoding (structural positioning): each conclusion comes from a specific location in the report, which can be marked with the following fields: chapter number; Paragraph number where the information is located; Page number or location index where the information is located; Associated entity identifier.

[0038] Convert these information into integer type by location number, and combine them into a location information vector , with uniform dimensions, such as [3, 7, 5] representing chapter 3, paragraph 7, and page 5, respectively.

[0039] Combine the above three parts into a complete risk conclusion vector.

[0040] Subsequently, a four-dimensional review matrix structure is applied to each for analysis from the following four dimensions: Completeness dimension; Accuracy dimension; Consistency dimension; Timeliness dimension.

[0041] S22, cross-dimension association and weak point identification: for each dimension , a dedicated pre-trained questioning discrimination model is called respectively, and the risk conclusion vector is input into the pre-trained questioning discrimination model (including four sub-models), and the weak score in the dimension is output: ; Wherein, represents the weakness of the th conclusion in the th dimension, the higher the value, the more serious the problem, represents the completeness model, which is used to judge whether the supporting evidence required by the conclusion is complete, represents the accuracy model, which is used to compare whether there is a conflict between the conclusion and the report details or external knowledge base, represents the consistency model, which is used to judge whether there is a logical contradiction with other conclusions in the report or historical reports, represents the timeliness model, which is used to judge whether the object involved in the conclusion (such as vulnerability, asset) is still valid or has been changed.

[0042] Summarize the above results to form an associated questioning matrix : ; The matrix is used to identify the relative weak points of each conclusion in the four dimensions, which is used as a reference for subsequent generation of questions.

[0043] S221, completeness model : The goal is to determine whether the "core evidence elements" required to support a certain conclusion exist and are complete in the original report text.

[0044] Model structure: The backbone model uses a double-input Transformer; Input one: , represents the conclusion itself; Input two: a set of local context paragraphs extracted from the report , represents the text area where evidence may exist; Pre-set "evidence type list" and "conclusion type" matching mechanism (vulnerability conclusion requires three elements: CVE description, impact range, and solution suggestion); Output: a score of 0~1, indicating the degree of evidence missing, the higher the better; The training data comes from the "evidence-conclusion pairing relationship" in the report, which constructs positive and negative sample pairs, simulating incomplete versions as negative samples.

[0045] S222, accuracy model : The goal is to determine whether the conclusion has factual errors, such as conflicts between information and the report itself or external databases.

[0046] Model structure: The backbone model uses a text comparison judgment model (DeBERTa + Siamese structure); Input one: , target conclusion semantics; Input two: relevant paragraphs in the report, official data extracted by knowledge base API; Entity standardization module (unify "log4j vulnerability" with "CVE-2021-44228"); Output: 0~1 confidence score, indicating the likelihood of conflict with facts or standard knowledge.

[0047] The training data comes from "conflict / consistency" data pairs formed by comparing reports with real databases, and semi-automatic comparison pairs are generated by aligning historical reports with security announcements.

[0048] S223, consistency model : The goal is to determine whether the conclusion is logically contradictory to other conclusions in the report or conclusions about the same entity in historical reports.

[0049] Model structure: The backbone model uses a graph attention network (GAT) + multi-text comparison; Input 1: Conclusion vector ; Input 2: Other conclusions associated with it in the current report and the corresponding conclusions in the historical reports; Graph modeling approach: Build a "logical conflict graph" between conclusions, with edge weights representing the degree of conflict, such as the same entity but different risk levels; Output: Score on the maximum conflict path, identifying the maximum logical tension between the conclusion and other conclusions.

[0050] The training data comes from the "conclusion conflict dataset" annotated by humans, and the model is trained to identify scenarios where "risk assessments for the same vulnerability differ in different reports".

[0051] S224, timeliness model

[0052] The goal is to determine whether the referenced entity (vulnerability, event, asset) has become invalid, has been repaired, or has been replaced.

[0053] Model structure: The backbone model uses an entity time label judgment model + collaborative knowledge graph; Input 1: Conclusion semantic vector , entity extraction and database search; Input 2: Query external dynamic database; Output: 0~1 score, indicating the degree to which the conclusion references "outdated information".

[0054] The training data comes from the logs of CVE databases that change over time, enterprise intranet asset change logs, and event lifecycle annotations.

[0055] The above is an introduction to the model structure of the four sub-models. More detailed solutions for each sub-model are as follows: I. The core goal of the integrity model is to simulate the ability of an auditor to judge whether a risk conclusion is "evidence sufficient". By comparing the matching relationship between "what types of supporting information should this conclusion have" and "whether such information actually exists in the report", it identifies whether there is a lack of evidence, logical jumps, or insufficient support.

[0056] The model receives two types of input: Risk conclusion to be judged: a specific conclusion output by the main review agent.

[0057] Evidence context candidate area: the adjacent paragraphs, chart descriptions, or context information of the conclusion in the report, serving as source text containing supporting evidence.

[0058] In addition, the model presets an evidence requirement list in the background, which defines the core evidence elements required for different types of conclusions. This includes: Vulnerability conclusions: should include vulnerability number, affected components, damage description, and handling status; Compliance conclusions: should reference specific provisions, relevant data indicators, and evaluation methods; Security event conclusions: should indicate the type of event, the time of occurrence, the scope of impact, and the response process.

[0059] The model uses a dual-input architecture with context modeling capabilities. The basic processing flow is as follows: Semantic understanding layer: separately encodes the text of the conclusion and its candidate context area, enabling the system to understand the structure, emphasis, and meaning of each piece of text in terms of semantics; Evidence element matching module: the model automatically identifies the "conclusion type" to which the conclusion belongs, and then calls the corresponding evidence list according to the type. Then it searches for the existence of these elements in the context area one by one. For example, for a vulnerability conclusion, the model will try to identify vulnerability description, exploit path, and vulnerability status in the context; Coverage determination mechanism: this mechanism comprehensively determines whether the identified evidence information in the context matches the list requirements. If some key elements are missing or only have vague references but no explicit descriptions, it will be considered that the integrity is a problem; Attention focusing mechanism: the model uses attention mechanisms to emphasize the relative importance of "evidence element fragments" in the text, and further assists in making judgments by combining their semantic consistency with the conclusion; Confidence evaluation and decision output: after considering all matching conditions, output a judgment signal representing whether the conclusion has sufficient supporting evidence. If the model believes that the core elements are missing, the evidence fragments are semantically ambiguous, or the support chain is broken, it will output a "evidence incomplete" challenge signal.

[0060] To train the model, a batch of "conclusion-evidence pairing" labeled data samples are constructed, mainly including: Positive samples: artificially labeled conclusions and their sufficient evidence paragraphs; Negative samples: intentionally delete some key evidence content for the same conclusion to form an "evidence missing version".

[0061] In addition, the review comments from experts in real security reports can be mined to extract typical incomplete cases as real negative samples for supplementation.

[0062] During the training process, the model gradually learns how to establish the reasoning path between "conclusion-support chain" at the semantic level and distinguish between "sufficient evidence" and "insufficient support". Finally, the model outputs an integrity evaluation result.

[0063] II. The core goal of the accuracy model is to determine whether a risk assessment conclusion deviates from the truth or is incorrect, which includes internal consistency within the report itself and standard content from authoritative external security knowledge bases.

[0064] The model mainly accepts two types of input: Main conclusion content: the risk conclusion generated by the main review intelligent agent, usually a statement with a judgment nature; Contrast corpus pair: technical details mentioned in the report, such as version number, asset list, repair status; from the connected security database; These two contrast corpora are considered as "reference basis" to judge the accuracy of the main conclusion.

[0065] The accuracy model adopts a double-channel semantic comparison structure, consisting of the following core modules: 1. Semantic comparison coding module is responsible for encoding the conclusion content and the contrast corpus respectively, so that the model can understand the semantic relationship between the two paragraphs. The model will construct a pair of "semantic vectors" and analyze their similarity or conflict characteristics. This part not only uses context understanding, but also emphasizes the detail alignment capability, including whether the CVE number matches, whether the repair status is consistent with the external database, and whether the affected components claimed in the report are consistent with the official description.

[0066] 2. Entity standardization module: to ensure the effective comparison of the conclusion content and the external database entries, an entity standardization process is introduced, which automatically maps the ambiguous expressions in natural language to standardized entities to facilitate external data query and accurate comparison. This module relies on existing named entity recognition technology, security field dictionary or structured retrieval interface.

[0067] 3. Conflict identification module: this module is the key to judging the essence of accuracy, which compares the details between the conclusion content and the reference basis, including: Whether the time is consistent; Whether the level conflicts; Whether the version range corresponds; Whether the repair suggestion is misleading; Once significant attribute items with obvious contradictions are found, the model will mark them as "conflict" for subsequent question generation.

[0068] The model running process is as follows: Receive a conclusion text; Extract the core entities (vulnerability number, asset name, event name) from it; Search for related paragraphs in the internal report content as internal comparison benchmarks; Fetch the standard description of the entity from external knowledge base through interface; Input the conclusion text and internal / external corpus into the semantic comparison model respectively; Summarize the conflict clues and generate a score or label representing the accuracy judgment.

[0069] If there are problems such as incorrect references, outdated facts, exaggerated assertions, and data conflicts in the conclusion, the model will give an output label of "accuracy in doubt".

[0070] To train the model, we need to build a real "conclusion-reference basis" corpus pair and manually label whether it is consistent, which mainly includes extracting conclusion paragraphs from historical security audit reports; For each conclusion, find its corresponding official description through CVE number, vulnerability name or keyword; Compare whether there is a discrepancy between the report conclusion and the official content, and manually label it (conflict or consistency).

[0071] The final output of the model is a set of accuracy labels: Binary label (accurate / doubtful); Confidence score (indicating conflict probability); Conflict type label (time inconsistency / concept mismatch / data obsolescence).

[0072] Three, the task of the consistency model is to identify whether a certain risk conclusion being analyzed is logically inconsistent with other conclusions in the report or the evaluation results of the same entity in historical reports. The forms of conflict include: The same entity is assigned different risk levels in different conclusions; There are inconsistent and mutually contradictory statements in the same report; The facts inferred by a conclusion are incompatible with the assumptions underlying another conclusion.

[0073] The input of the consistency model consists of three parts: The main conclusion text to be analyzed: the conclusion generated by the main audit agent; Other conclusion set in the current report: extract other conclusions that intersect with the conclusion from the full text of the report; Through entity recognition and time matching mechanism, extract the conclusion text of the same vulnerability, asset, event from the enterprise's historical security reports as external consistency comparison basis.

[0074] The core structure and processing flow are as follows: 1. Semantic comparison module: First, encode the semantic vectors of all conclusion paragraphs to capture their deep semantic representation, not only focusing on surface vocabulary, but also emphasizing intent, judgment vocabulary, entity status, and other deep meanings. The main conclusion will be paired with other conclusions one by one and input into a double-input semantic matching structure. The model needs to determine whether the two paragraphs constitute "conflict", "supplement", "repetition", or "irrelevance".

[0075] 2. Conclusion graph construction module: In order to systematically handle potential conflict relationships between multiple conclusions, the model constructs a conclusion graph, with nodes representing each conclusion and edges representing "semantic comparison relationships".

[0076] The type or weight of the edge can represent: whether it is the same object, whether it is a judgment in the opposite direction, whether it simultaneously mentions mutually exclusive state conditions; The graph structure enables the model to identify higher-order consistency problems, including: contradictions on multiple logical chains, "indirect contradictions" caused by context propagation.

[0077] 3. The model uses attention mechanisms to focus on node pairs with entity overlap, opposite direction of conclusion, and inconsistent time state. When determining consistency, the model focuses on: whether it is the same object, whether it makes opposite judgments on the object, whether there is a time span difference, and whether it references mutually conflicting factual basis (version number, detection results).

[0078] The model classifies the semantic relationship between each pair of conclusion pairs, common relationships include: Explicit conflict: such as the same vulnerability being evaluated as high-risk and low-risk; Temporal conflict: such as a conclusion stating that it has been handled, but another conclusion is still discussing the current unpatched.

[0079] The model integrates these signals to make a judgment about "whether there is a consistency problem with this conclusion" and points out which other conclusion it conflicts with.

[0080] The model needs to rely on high-quality "conclusion pair-consistency relationship" labeled data, which is constructed as follows: Extract the conclusion set from real reports and invite human auditors to label whether they conflict; Construct typical contradictory examples, including "the system has completed reinforcement" vs "there are still ports that have not been closed"; Simulate scenarios where descriptions are repeated but judgments are different, used to train the model to identify "mild semantic conflicts"; Introduce scenarios where "outdated conclusions" in historical reports conflict with new reports, used to train cross-document consistency recognition capabilities.

[0081] The model finally outputs a consistency label or score result, including: whether the current conclusion has a conflict with other conclusions; if there is a conflict, pointing out the associated conflict conclusion number or summary; conflict type label (entity inconsistency, opposite judgment direction, contradictory reference condition); conflict intensity evaluation (mild contradiction / serious conflict / fatal logical error), the output result will be used as an important basis for generating "doubtful opinions".

[0082] Four, the timeliness model aims to determine whether a risk conclusion is based on outdated, changed or invalid information. This model can identify the following situations: The referenced vulnerability has been fixed, but the conclusion still considers it to be at high risk; The security incident referred to has been handled, but the report still describes it as ongoing; The referenced asset or component has been decommissioned, replaced or upgraded, but the conclusion is still based on old version information; In other words, the model is responsible for determining whether the temporal context matches the current time point.

[0083] The model mainly receives the following three types of input: 1. The text of the risk conclusion to be analyzed; 2. Entity extraction results: time-sensitive entities extracted from the conclusion, including vulnerability numbers, asset identifiers, security event identifiers, and compliance clause numbers; 3. Current time point external information or dynamic database status, including vulnerability status, asset account, security event lifecycle status, and whether the compliance clause is updated or replaced.

[0084] The model structure and processing flow are as follows: 1. Entity dynamic state query module: automatically call the corresponding data source interface according to the entity type, including: For vulnerabilities: query CVE database, NVD vulnerability library, etc. to get the release date, repair status, related patch situation; For assets: query the enterprise asset account system to determine the current deployment status, version number, and latest update time; For events: query the event response system to confirm whether it is in the "handling", "closed" or "false positive" state; For regulations: compare the standard document version control information to determine whether there is an updated version or abolition information.

[0085] Obtain the objective state data of the entity at the current time point through the "entity-state" mapping mechanism.

[0086] 2. Time consistency judgment module: compare the expressions in the conclusion with the actual state to determine whether there is a time mismatch. The following types of judgments are supported: Outdated assertion identification: the conclusion claims that a vulnerability still exists, but the vulnerability has been fixed before the system was deployed; State misjudgment identification: the conclusion describes an event as active, but the event has already been handled; Asset state mismatch identification: the conclusion refers to a component vulnerability, but the component has been replaced or decommissioned in the current system architecture; Compliance reference invalidation identification: the report refers to a clause number that has been abandoned or revised.

[0087] The model cross-verified the conclusion and the current fact state through semantic matching and state judgment rules to identify the timeliness deviation between the conclusion and the current fact state.

[0088] 3. Atlas-driven correlation analysis module: To handle the timeliness dependency relationship between multiple entities in complex scenarios, the model introduces a graph neural network module, which takes vulnerabilities, assets, events, and report content as nodes and edges representing time dependency, version dependency, and patch path relationships.

[0089] Through graph calculation, the model can identify: indirect invalidation caused by multi-hop time offset, outdated conclusions caused by replaced vulnerabilities or sub-vulnerabilities, and the chain effect of compliance clause version changes on the entire analysis content.

[0090] The training data includes: Event lifecycle records and asset management change logs accumulated by the enterprise security operations center; Public vulnerability database change records over time; Conclusions in historical reports that have been corrected as "referencing outdated information"; The model learns time comparison rules, state migration patterns, and semantic temporal recognition capabilities through these positive and negative samples.

[0091] The final model outputs timeliness evaluation results, including: whether the current conclusion references outdated information; the entity names involved and the invalidation reasons; contradictory time nodes or alternative information prompts.

[0092] The score output by each sub-model above represents the "questioning intensity" of the conclusion in a certain dimension, and the outputs of multiple dimensions are spliced into a correlation questioning matrix .

[0093] S23, structured questioning generation and correlation: According to the correlation questioning matrix above, identify the maximum or exceed the set threshold dimension index in each row (i.e., each conclusion) , and call the matching template in the structured questioning template library to generate natural language questioning content : ; wherein, Representation and Dimension Related questioning templates, such as "Please supplement the evidence materials on which this conclusion is based," are standard questioning template library entries built by domain experts. Generate() represents a module that automatically generates natural language expressions based on templates and the semantic content of the conclusion.

[0094] Ultimately, each challenge and the conclusion it addresses are linked by a unique challenge-conclusion association identifier. Establish binding relationships and output structured, targeted question sets: .

[0095] S23 describes how to transform the output of the challenge discrimination model into natural language challenge text and organize it into a "targeted challenge set" for subsequent verification and auditing. Its core idea is to link the model scoring results with the challenge template to generate readable challenge content that is precisely linked to the conclusion.

[0096] The previous stage generated a "correlation and questioning matrix", where each row represents a conclusion's questioning intensity score under four review dimensions (completeness, accuracy, consistency, and timeliness). These scores reflect whether each conclusion has any questionable issues in certain dimensions.

[0097] For each risk assessment conclusion, scan its corresponding scoring vector to identify the dimension with the highest score, or those dimensions exceeding a set threshold. This dimension represents the weakest point of the conclusion and the area most likely to have a problem. For example: If the "completeness" dimension scores the highest, it indicates that the conclusion lacks supporting evidence; If the "timeliness" dimension exceeds the threshold, it indicates that the conclusion may be based on outdated information.

[0098] The system has a pre-set library of structured challenge templates. Each challenge dimension has a corresponding set of templates, which are standardized, manually written formats designed to guide report writers in providing supplementary explanations or corrections for a specific dimension. Based on the selected dimension, a matching template is chosen from the template set for that dimension. For example: For the completeness dimension, the following could be selected: "This conclusion lacks necessary supporting evidence; please provide supplementary explanations regarding the relevant basis." For the consistency dimension, you might choose: "This conclusion contradicts other analyses in the report. Please verify and unify the description." Next, the selected template is combined with the semantic content of the current conclusion to generate a natural language query statement with context. This process requires the use of a generation module that can automatically fill in placeholders in the query template with vulnerability numbers, asset names, or event types mentioned in the conclusion, making the query statement more targeted and context-aware.

[0099] To ensure traceability and verifiability of the query results, each generated query is associated with a "binding identifier" of the original risk assessment conclusion it targets, i.e., the query-conclusion association ID. This ID ensures that during subsequent verification or manual review, the query is accurately identified as being generated for which conclusion, avoiding ambiguity or misattribution.

[0100] S3, the verification execution agent receives the targeted query set and enterprise security report text data, schedules and executes multiple specialized AI tool sets, and performs targeted retrieval, evidence mining, and logical reasoning on the original text data of the report according to each query, generating a verification evidence chain that can support or refute specific conclusions in the preliminary audit opinion.

[0101] S31, for each query in the targeted query set perform semantic analysis operations to extract internal structure information and identify the following three core elements: query focus : including whether it has been repaired, whether the evidence is complete, and whether the clause is applicable; required evidence type : including text evidence, structural reference, and external database verification; corresponding conclusion identifier : the target conclusion bound to the query.

[0102] The analysis results are encapsulated into a verification task metadata object: ; where represents the target conclusion, represents the hypothesis proposition to be verified, and represents the set of tool types to be called, represents the set of keywords or query parameters for tool execution.

[0103] The core task of S31 is to extract machine-executable verification instruction information from each natural language query, i.e., to understand the query text and determine what it is questioning, what type of evidence is needed, and which specific conclusion it is targeting, thereby driving the subsequent execution of the verification tool chain.

[0104] ​Read each piece of text in turn, and use natural language processing techniques for deep semantic analysis. The specific approach includes: segmenting the text, part-of-speech tagging, and syntactic dependency analysis; using pre-trained language models to obtain the context semantic embedding of the question, combining word meaning, sentence structure and keyword hints to determine the purpose and logical structure of the question.

[0105] Through the above semantic analysis process, three key elements need to be identified: 1. Focus of the question: that is, what does this question want to question, which is represented by the user's review angle, such as: "Please supplement the evidence" → focus on integrity; "Does the vulnerability still exist?" → focus on timeliness; "This contradicts the previous conclusion, please check" → focus on consistency; "Is the CVE real?" → focus on accuracy.

[0106] Focus recognition relies on a set of defined question intent classifiers, which match the sentence with a set of standard question intents and select the most suitable one.

[0107] 2. Required evidence type: that is, what type of evidence is needed to answer this question. It can be divided into the following categories: Text evidence: find the relevant narrative paragraph in the report; Structured reference: compare the numbers, standards or event items cited in the report; External data verification: call external information sources such as CVE database, regulations database, asset inventory; Timeline data: need to build the time logic of events or version changes.

[0108] The type of evidence is determined by the way the question is asked and the target object in the question. For example, "Has the CVE been fixed?" clearly points to the external vulnerability database as a verification source.

[0109] 3. Target conclusion identifier: this is the specific conclusion that the question is directed at, which is bound to the question-conclusion association identifier through the binding relationship established in the S2 stage. Through the binding relationship established in advance in the S2 stage, each question is quickly located to the original audit conclusion text, and the unique identifier of the conclusion is extracted, ensuring that the question is not an isolated problem, but is anchored to a specific conclusion.

[0110] When the above three types of information are successfully identified, they will be packaged into a structured data object, namely verification task metadata. This data object is equivalent to a "verification plan sheet", which clearly states: which conclusion to verify, what questions to verify, which types of tools to use, and which keywords to bring in for retrieval or query. This metadata will become the "task description" that drives the automatic operation of the subsequent verification tool chain.

[0111] S32, dynamic tool chain scheduling and execution: the verification execution agent dynamically selects and concatenates one or more tools from the special AI tool set to form a verification tool chain for the suspected : ; Wherein each tool belongs to one of the following special AI tools: Deep retrieval tool: used to locate relevant paragraphs in the full text of the original report based on semantic matching; Relationship reasoning tool: used to analyze the logical, temporal or causal relationship between entities in paragraphs; External knowledge verification tool: used to access external structured databases, including CVE number database, regulations and policies library, to verify the validity and timeliness of the referenced content.

[0112] The verification execution agent uses the task metadata as a scheduling instruction to trigger the execution of each tool in the tool chain step by step, forming a targeted verification process.

[0113] I. Deep retrieval tools are used to build a semantic-driven text positioning mechanism that uses multi-modal semantic encoding and vector indexing mechanisms to achieve problem-driven paragraph positioning capabilities, including the following: The full text of the report has been segmented and embedded by a large-scale pre-trained language model during system initialization, generating a high-dimensional semantic vector for each segment and storing it in an index library; In the execution of the generated verification task metadata, the natural language question text and keywords are converted into vector form and their intent is normalized; Through approximate vector search technology (ANN retrieval based on FAISS), the most relevant paragraph to the question intent is selected from the encoded report paragraphs; Combine confidence threshold, context integrity, and paragraph structure weight indicators to reorder the candidate paragraphs, and keep the top N segments as the original corpus for reasoning or analysis.

[0114] ​The deep retrieval tool is an entry link of the verification tool chain in the application, responsible for providing an "evidence context range" for downstream relationship reasoning or knowledge verification, ensuring that the subsequent processing does not deviate from the questioning target, and used to support verification requirements in multiple dimensions such as integrity, accuracy, timeliness, etc.

[0115] II. The relationship reasoning tool is used to build logical bridges and causal chains between paragraphs. The relationship reasoning tool is specifically used to process the logical consistency and causality verification across paragraphs and entities in the same report. The content of multiple paragraphs is structured into a relationship network, and reasoning is determined through graph calculation. Mainly includes the following: Using a sequence labeling model based on Transformer, key security entities (vulnerability number, asset ID, status description, etc.) in each paragraph are extracted and standardized coding is performed through a normalization dictionary mapping; Using a language model fine-tuned relationship classifier, the semantic relationship between any two paragraphs is determined; Taking entities as nodes and paragraphs as context carriers, a "paragraph-entity" and "entity-entity" double-layer graph structure is automatically constructed, forming a multi-level reasoning path graph; Based on the constructed graph structure, a RGCN type model is used for feature propagation and node reasoning to determine whether there are the following conflicts or inconsistencies: The same entity is given different states; The prerequisite of a conclusion is negated in other paragraphs; Time evolution logic is reversed (such as "later text says repaired, but earlier text says not handled").

[0116] The relationship reasoning tool is a key component for realizing conclusion consistency verification and logical reasonableness analysis in the application, used to verify questioning content that relies on context logical coherence.

[0117] III. The external knowledge verification tool is used to access authoritative databases to complete fact checking, verifying whether the standards referenced in the enterprise security report are real, accurate, and well-timed. Its technical path is as follows: Extract the entity to be verified from the verification task metadata, and use regular matching and entity standardization models for accurate identification and type judgment; Knowledge source interface calling engine: dynamically routed to different authoritative data sources according to entity type; The structured data returned from the external interface is compared with the original content in the report at the field level to identify the following issues: Is the referenced content real? Is the referenced clause the latest version? Is the referenced vulnerability still active?

[0118] The comparison results are converted into a unified verification output format for the agent to make further decisions.

[0119] This tool is the key external channel for verifying the accuracy and timeliness of facts in this invention, and is suitable for dealing with questions regarding accuracy and timeliness.

[0120] In summary, these three tools serve the following functions in this invention: Deep search tools: responsible for finding relevant content; Relational reasoning tools: responsible for analyzing logical relationships; External knowledge verification tools: responsible for verifying whether the citations are true and valid.

[0121] S33. Evidence Synthesis and Chain Construction: The Last Tool in the Toolchain Output the results Returning to the verification execution agent, the result is standardized and constructed into structured evidence units: ;in, This represents the essence of the text in the evidence paragraph. This indicates the location identifier (page number, paragraph number) of the paragraph in the original report. This evidence indicates the hypothesis. The support confidence score indicates that the higher the score, the more supportive the view.

[0122] All related to the same objective conclusion Evidence Unit By linking these pieces in chronological or logical order, a final chain of verification evidence is formed: .

[0123] S4. The main review agent receives and verifies the evidence chain, integrates and analyzes it with the initial review opinions, draws a final conclusion, and generates a final review report containing all conclusions and their corresponding evidence.

[0124] S41. Based on the verified chain of evidence Includes question-conclusion association identifiers Map it precisely to the initial review comments. The corresponding risk assessment conclusion For each conclusion Iterate through all the verification evidence chains associated with it. Extract the confidence scores of all evidence units. And the unit relative to the hypothesis The position (supporting or refuting) forms the following set of supporting / refuting evidence: Supported collections: ; represents the confidence score of the evidence unit supporting the conclusion, ranging from 0 to 1, and the closer to 1 indicates the stronger support.

[0125] Counterargument set: ; represents the confidence score of the evidence unit refuting the conclusion, also ranging from 0 to 1, and the closer to 1 indicates the stronger refutation.

[0126] The above evidence set is input into a fusion algorithm based on Dempster-Shafer (D-S) evidence theory to calculate the comprehensive confidence of the conclusion , wherein tends to 1 indicating that most of the evidence supports the conclusion, tends to 0 indicating that most of the evidence supports the conclusion should be denied, and the intermediate value indicates that the evidence is inconsistent or insufficient.

[0127] D-S evidence theory is a mathematical theory for handling uncertainty and multi-source information fusion, which integrates the "partially reliable" judgments provided by multiple independent information sources to obtain an overall confidence about the proposition, without explicitly knowing the exact probability distribution of each source.

[0128] Each evidence unit (such as a text or a database verification result) does not directly give a conclusion that is definitely true or false, but gives a confidence interval supporting a certain possibility. D-S theory allows such incomplete uncertain information to be systematically integrated.

[0129] In the present application, different tools output evidence units, some of which support a conclusion and some of which refute it. D-S theory aggregates all these supporting, opposing, neutral, or even ambiguous evidence to avoid bias that may be caused by simple weighted averaging. If there is a conflict between different evidences, D-S theory has a conflict normalization mechanism to balance these inconsistent information to ensure that the final output is still interpretable. After fusion, a value between 0 and 1 is output, representing the comprehensive confidence of the conclusion, and based on which it is determined whether the conclusion is confirmed, doubtful or rejected.

[0130] S42, compare the comprehensive confidence with the preset confidence threshold, including the support threshold and the refutation threshold , and make the following ruling: If , the conclusion is confirmed to be valid, and the risk level is marked as verified; If , the conclusion is rejected, and the risk level is marked as unverified.​If the conclusion is not supported by the evidence, mark it as doubtful and suggest manual review. If the conclusion is not supported by the evidence, mark it as doubtful and suggest manual review. If the conclusion is not supported by the evidence, mark it as doubtful and suggest manual review.

[0131] Finally, form a set of final review judgments: Wherein, .

[0132] Support threshold value to determine whether the conclusion is fully supported, set to 0.75 to 0.85. Set the logic to combine historical audit data analysis, statistics on which conclusions are finally accepted by manual review under the support of a large number of high confidence evidence, take the 75% quantile or higher position in the corresponding confidence distribution as the support threshold, if the system is biased towards conservative review, the threshold can be set high to avoid misjudgment as credible.

[0133] Rebuttal threshold value to determine whether the conclusion is fully rebutted, set to 0.25 to 0.35, by analyzing the conclusions that are manually revoked or judged invalid in history, their comprehensive evidence confidence is usually low, take the 25% quantile or lower position of these samples as the rebuttal threshold, which can be adjusted according to the business tolerance requirements, and more doubtful situations can be relaxed.

[0134] S43, structure and encapsulate all final conclusions and their corresponding verification evidence chain to generate a final audit report automatically .The report has the following data structure composition: Final conclusion list: list all the risk assessment conclusions and their status; Conclusion comprehensive confidence: record the score of each conclusion in the fusion analysis; Core evidence summary: select the key information in each evidence chain and summarize it into an easy-to-review explanation; Source tracing information: mark the location of all quoted content in the original report or external database; Manual review suggestion: provide manual review entry for doubtful conclusions to improve transparency and collaborative efficiency.

[0135] The final audit report is in a format compatible with machine-readable and human-readable, supporting data interface call and export to visual report.

[0136] The present application encompasses any alternatives, modifications, equivalent methods and solutions made to the essence and scope of the present application. In order to make the public have a thorough understanding of the present application, specific details are described in the following preferred embodiments of the present application, and the present application can also be fully understood without the description of these details to those skilled in the art. In addition, in order to avoid unnecessary confusion to the essence of the present application, well-known methods, processes, procedures, elements and circuits, etc. are not described in detail.

[0137] The above is only the preferred embodiment of the present application, and it should be pointed out that for ordinary skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can also be made, which should be considered as the protection scope of the present application.

Claims

1. A method for automatic review of enterprise security reports based on multi-task AI agents, characterized in that, The multi-task AI intelligent agent includes a main audit intelligent agent, a challenge generation intelligent agent, and a verification execution intelligent agent, and the automatic audit method includes the following steps: S1, the main audit intelligent agent receives enterprise security report text data, performs preliminary analysis and risk assessment thereon, and generates a preliminary audit opinion; S2, the challenge generation intelligent agent receives the preliminary audit opinion, critically reviews each risk assessment conclusion therein, and generates a set of targeted challenges requiring evidence or clarification, wherein each challenge is associated with a specific conclusion in the preliminary audit opinion; S3, the verification execution intelligent agent receives the set of targeted challenges and the enterprise security report text data, dispatches and executes a plurality of special AI tool sets, performs directional retrieval, evidence mining and logical reasoning on the original text data of the report according to each challenge, and generates a verification evidence chain that can support or refute a specific conclusion in the preliminary audit opinion; S4, the main audit intelligent agent receives the verification evidence chain, performs fusion analysis on it and the preliminary audit opinion, draws a final conclusion, and generates a final audit report containing all conclusions and corresponding evidence.

2. The multi-task AI agent-based enterprise security report automatic auditing method of claim 1, wherein, The S1 includes format analysis and cleaning of the received enterprise security report text data, removing irrelevant symbols and format markers, and converting unstructured raw text into standardized text with uniform paragraph and chapter identifiers; And using the named entity recognition technology based on natural language processing, the pre-defined category of security entities is extracted from the standardized text, including vulnerability number, affected asset identifier, security event type and compliance clause number. 3.The multi-task AI agent based enterprise security report automatic auditing method of claim 2, wherein, The S1 also includes placing the extracted security entities in the semantic context of the paragraphs and chapters where they are located, using a pre-trained risk prediction model to evaluate the potential risk level of each security entity, and generating a preliminary audit opinion including the security entity and its corresponding risk level.

4. The multi-task AI agent based enterprise security report automatic auditing method of claim 1, wherein, The S2 includes converting each risk assessment conclusion in the preliminary audit opinion into a risk conclusion vector, which encapsulates the semantic content of the conclusion, the confidence level assigned by the main audit intelligent agent, and the context location information of the risk conclusion in the report; a multi-dimensional analysis framework is defined for each risk conclusion vector, including integrity review dimension, accuracy review dimension, consistency review dimension and timeliness review dimension.

5. The multi-task AI agent-based enterprise security report automatic auditing method of claim 4, wherein, The S2 also includes calling a corresponding pre-trained challenge discrimination sub-model for each review dimension to analyze the decision-making process, wherein: The integrity dimension model determines whether the necessary evidence elements supporting the conclusion are complete in the report; The accuracy dimension model determines whether there is a potential conflict between the conclusion and the report details and external knowledge base; The consistency dimension model determines whether there is a logical contradiction between the conclusion and other conclusions in the report or related conclusions in historical reports; The timeliness dimension model determines whether the vulnerability, event or asset state involved in the conclusion is up-to-date; The outputs of each challenge discrimination model are aggregated into an associated challenge matrix, which identifies the weak points of each conclusion in the most vulnerable dimension.

6. The multi-task AI agent-based enterprise security report automatic auditing method of claim 5, wherein, According to the associated challenge matrix, a corresponding template is selected from a pre-defined structured challenge template library, and a natural language challenge requiring evidence or clarification is automatically generated; each generated challenge is uniquely bound to a specific conclusion in the preliminary review opinion through a challenge-conclusion association identifier, thereby forming the set of targeted challenges.

7. The multi-task AI agent based enterprise security report automatic auditing method of claim 1, wherein, The S3 specifically includes: S31. Semantic analysis is performed on each challenge in the set of targeted challenges to identify the challenge focus and required evidence type; based on the analysis results, a verification task metadata is generated for each challenge, including the target conclusion, the hypothesis to be verified, the tool type to be called, and the search keywords; S32. According to the verification task metadata, one or more tools are dynamically selected and serialized from a dedicated AI tool set to form a verification tool chain for the challenge; the verification execution agent drives the verification tool chain to execute by taking the verification task metadata as an input parameter; S33. The last tool in the verification tool chain feeds back its output to the verification execution agent; the agent standardizes the output to generate evidence units, which include evidence text summaries, source location pointers, and confidence scores supporting or refuting the target conclusion; all evidence units for the same conclusion are linked in logical or chronological order to form a verification evidence chain supporting or refuting the specific conclusion in the preliminary review opinion.

8. The multi-task AI agent-based enterprise security report automatic auditing method of claim 7, wherein, The dedicated AI tool set includes: Deep search tools: used for semantic search beyond simple matching based on keywords to locate relevant passages in the report; Relationship reasoning tools: used to analyze the temporal, causal, or logical relationships between entities in different passages; External knowledge verification tools: used to access external vulnerability databases to verify the truthfulness of statements in the report. 9.The multi-task AI agent based enterprise security report automatic auditing method of claim 1, wherein, S4 associates the verification evidence chain with the risk assessment conclusion in the preliminary review opinion according to the built-in challenge-conclusion association identifier in the verification evidence chain; for each conclusion, all corresponding verification evidence chains are traversed to extract the confidence scores and support / refutation positions of each evidence unit, and a fusion algorithm based on D-S evidence theory is used to calculate the comprehensive confidence of the conclusion; The comprehensive confidence is compared with a pre-set confidence threshold: If the comprehensive confidence is higher than the support threshold, the conclusion is confirmed in the final review report, and its risk level is marked as verified; If the comprehensive confidence is lower than the support threshold but higher than the refutation threshold, the conclusion is determined to be insufficiently evidenced, and its risk level is revised to questionable in the final review report; If the comprehensive confidence is lower than the refutation threshold, the conclusion is determined to be invalid, and it is rejected in the final review report.

10. The multi-task AI agent based enterprise security report automatic auditing method of claim 9, wherein, S4 also includes generating a structured report, which encapsulates and integrates all verified or revised conclusions with their corresponding verification evidence chains to generate the final review report.

Images