Safety product self-evaluation report intelligent auditing method based on artificial intelligence assistance

Abstract

The invention relates to the technical field of computers, and particularly discloses a security product self-evaluation report intelligent auditing method based on artificial intelligence assistance, and the method comprises the steps: analyzing a self-evaluation report to generate structured detection item data; carrying out multi-modal feature extraction and fusion on the text and image proof materials; semantic conflicts, configuration compliance, evidence credibility, image-text consistency and historical risk matching degree are analyzed in parallel through an artificial neural network, a support vector machine, a random forest, logistic regression and a weighted neighbor algorithm; according to a preset weight, dynamically fusing results of all dimensions to determine a compliance probability; similar historical cases are retrieved in combination with a security product compliance analysis knowledge graph, and auditing instructions and improvement suggestions with violation positioning bases are generated; and finally, outputting a structured auditing report and supporting continuous optimization of a manual reexamination feedback driving model. According to the method, high-precision, full-dimension and automatic security product self-evaluation report auditing can be realized, and the auditing efficiency, objectivity and large-scale processing capability are remarkably improved.

Description

Technical Field

[0001] This invention belongs to the field of computer technology, specifically relating to an intelligent review method for security product self-assessment reports based on artificial intelligence. Background Technology

[0002] With the rapid development of the internet industry, while cybersecurity products are iterating rapidly in terms of functionality and performance, their security compliance issues are becoming increasingly prominent. To standardize the security baseline of network products and services, national and industry regulatory authorities have successively issued standards such as GB / T 39276-2020 and QB-F-017-2019, clearly covering 81 testing requirements across 12 core modules, including identity identification and authentication, authorization and access control, and logging and auditing, thus constructing a relatively complete security assessment system. Against this backdrop, enterprises are required to conduct regular self-assessments and submit structured or semi-structured self-assessment reports as key evidence for compliance audits, which places higher demands on the accuracy, consistency, and scalability of the audit mechanism.

[0003] The review of security product self-assessment results focuses on the compliance determination of 81 test items, involving the comprehensive analysis of multimodal unstructured supporting materials such as text descriptions, interface screenshots, and configuration logs. This process not only requires an accurate understanding of the security baseline semantics but also verifies the consistency between the self-assessment conclusions and supporting materials, and incorporates risk inference based on historical violation patterns to achieve a comprehensive, objective, and traceable review judgment.

[0004] However, current technologies still heavily rely on manual review, with automation limited to simple rule matching based on regular expressions, resulting in an overall automation coverage rate of less than 15%. Traditional methods struggle to effectively parse unstructured text and image materials and lack the ability to identify semantic contradictions between security benchmarks and self-assessment statements. Furthermore, the review process lacks a multi-dimensional feature fusion mechanism, making it impossible to perform correlation analysis on interface configuration status, evidence credibility, and historical risk patterns. In addition, the explanations and suggestions in the review results rely entirely on manual drafting, leading to delayed responses and inconsistent quality, making it difficult to support large-scale, high-frequency security compliance regulatory needs. Therefore, there is an urgent need for an intelligent review method based on artificial intelligence to achieve high-precision, multi-dimensional, and automated compliance verification of security product self-assessment reports. Summary of the Invention

[0005] The purpose of this invention is to provide an intelligent review method for security product self-assessment reports based on artificial intelligence, which can effectively solve the problems mentioned in the background technology. In existing technologies, the review of security product self-assessment reports heavily relies on manual operation. It lacks effective semantic parsing and consistency verification capabilities for multimodal unstructured data such as text descriptions, interface screenshots, and configuration logs, making it difficult to identify logical contradictions between self-assessment conclusions and supporting materials. Furthermore, it cannot achieve cross-test item historical risk pattern correlation analysis, resulting in low automation coverage, low review efficiency, and poor consistency of judgment results. This invention, by constructing a multimodal feature fusion model and a security product compliance analysis knowledge graph, achieves full-dimensional, high-precision, and automated compliance review of 81 test requirements across 12 modules, significantly improving the objectivity, traceability, and scalability of the review process.

[0006] According to a first aspect of the present invention, the present invention claims protection for an intelligent review method for security product self-assessment reports based on artificial intelligence, comprising: S1: Obtain the self-assessment report of the security product to be reviewed, analyze the content of each test item, and generate structured test item data; S2: Multimodal feature extraction is performed on the structured detection item data. A pre-trained language model is used to encode the security benchmark description and self-assessment description into high-dimensional semantic vectors. A convolutional neural network is used to extract visual features from the images in the proof materials to obtain image feature vectors. The text vectors and image vectors are concatenated to form a composite fusion feature vector. S3: Construct multiple basic classifiers to process feature information of different dimensions in parallel; S4: The results output by each basic classifier are dynamically weighted and fused according to preset weights. The comprehensive compliance probability is calculated by weighted summation, and a binary decision is made based on a set threshold of 0.8. When the comprehensive compliance probability is greater than 0.8, it is judged as approved; otherwise, it is judged as unapproved. S5: Using the multi-dimensional discrimination results output by the fusion model as query conditions, perform multi-link comprehensive retrieval in the knowledge graph of security product compliance analysis, match historical violation cases that are similar to the current detection item in terms of semantics, configuration, evidence and historical risk patterns, use the comprehensive sorting tool to score and sort the retrieval results according to relevance, and generate audit explanations and improvement suggestions with violation location basis; S6: The audit results, audit instructions and audit suggestions for each detection item are structured and integrated to generate a standardized audit report with granularity down to a single detection item. It also supports triggering a manual review process for low-confidence audit results and collects expert-annotated feedback data for incremental training and continuous optimization of the model.

[0007] Furthermore, S1 also includes: The structured test item data includes the test module, test item number, test item benchmark description, self-assessment result, self-assessment description, and corresponding supporting materials.

[0008] Furthermore, S3 also includes: Artificial neural networks are used to analyze the probability of semantic conflicts in text, support vector machines are used to determine the compliance of the configuration status of interface elements, random forests are used to evaluate the credibility score of the supporting materials, logistic regression is used to quantify the incremental probability of violations caused by the consistency between text and images, and weighted nearest neighbor algorithm is used to calculate the risk matching degree between the current detection item and historical violation cases.

[0009] Furthermore, S4 also includes: In S4, semantic conflict probability accounts for 35% of the weight, configuration compliance accounts for 30% of the weight, evidence credibility accounts for 20% of the weight, and cross-modal conflict impact accounts for 15% of the weight.

[0010] Furthermore, in S1, the parsing process of the security product self-assessment report includes the natural language processing module performing syntactic segmentation and entity recognition on paragraph-level text, extracting data fields that strictly correspond to the detection requirements, and establishing a unique mapping relationship between each self-assessment content and its corresponding detection module and detection item number.

[0011] Furthermore, the method also includes: In S2, a Chinese pre-trained BERT model is used to independently encode the safety benchmark description and the self-evaluation description. Each text segment is input into the model's bottom layer after word segmentation to generate a 768-dimensional context-aware semantic vector. Then, the key semantic components are extracted through the attention mechanism, and the first 384 dimensions are truncated to form a simplified semantic vector for subsequent comparison and analysis. Deep feature extraction was performed on the images of the evidence materials using the ResNet50 network. After outputting a 2048-dimensional global feature vector, the principal component analysis algorithm was applied to reduce its dimensionality to 300-dimensional, retaining more than 95% of the original variance contribution rate. Alternatively, the computer vision model detection system can be used to configure the layout of controls in the screenshot, identify key UI components such as account input boxes, password boxes, and permission switches, and generate a 768-bit binary state vector based on visibility, enabled status, and interaction attributes.

[0012] Furthermore, the method also includes: In S3, the artificial neural network is set with a fully connected layer structure. The input is a 768-dimensional concatenated text vector, and the output is the semantic conflict probability value in the range of 0 to 1. The weight matrix focuses on the dimensions of uniqueness, minimum authorization, and non-repudiation security keywords, and the bias term is initialized to -1.2. The support vector machine uses a radial basis function kernel to process the n-dimensional interface element state vector, and the kernel function parameter γ is set to 0.1; The random forest consists of 150 decision trees of depth 8. The input is a two-dimensional vector composed of clarity and feature completeness, and the output is an evidence credibility score in the range of 0 to 1. The logistic regression model introduces a sigmoid function with a slope of -3.2 to convert the text-image consistency score into an increment of the violation probability, and the threshold adjustment term is set to 1.5; The weighted KNN algorithm selects k=12 nearest neighbor historical cases, measures the similarity of risk matching vectors based on cosine distance, distributes weights according to the inverse of distance, and outputs a weighted average reference probability.

[0013] Furthermore, the method also includes: In S4, the dynamic weighted fusion process adjusts the weight ratio of each dimension according to the detection module type, increasing the semantic weight to 40% in the identity authentication detection item and increasing the evidence credibility to 25% in the log audit detection item.

[0014] Furthermore, the method also includes: In S5, the knowledge graph for security product compliance analysis contains multiple historical audit record nodes. Each node contains detection item benchmarks, self-assessment content, multimodal evidence, audit results, and description and suggestion attributes. It also establishes an association index through semantic embedding, configuration vectors, and risk label multi-sided relationships. The comprehensive sorter uses a learning sorting algorithm that combines four indicators—BM25 semantic matching score, vector cosine similarity, evidence quality weighted score, and time decay factor—to jointly score and re-sort the retrieved historical cases.

[0015] Furthermore, the method also includes: In S6, the generated structured audit report is output using a unified template. Each test result includes the audit conclusion, confidence score, summary of core contradictions, cited historical case number, and detailed improvement suggestions. It supports export in both JSON and XML formats. The review results after manual review and correction are added to the historical database as new training samples. Incremental training tasks are launched regularly to update the parameters of each basic classifier and the fusion weight coefficients.

[0016] Compared with the prior art, the present invention has the following beneficial effects: This invention overcomes the limitations of traditional rule engines, which can only process structured data, by constructing an intelligent audit framework based on multimodal feature fusion. It achieves unified modeling and collaborative analysis of various unstructured evidence, including text, images, and configuration status. Through deep comparison of security benchmark semantics and self-assessment statements, it effectively identifies logical contradictions and exaggerated statements at the semantic level. Through interface element status recognition and configuration compliance verification, it verifies the authenticity of visual evidence. By integrating semantics, configuration, evidence, and historical risk as four-dimensional criteria, it constructs a highly robust comprehensive judgment mechanism, significantly reducing the risk of misjudgment from a single dimension. Furthermore, relying on a knowledge graph of security product compliance analysis, it achieves intelligent generation and accurate recommendation of audit suggestions, changing the previous reliance on manually written explanations based on expert experience and improving the professionalism and consistency of audit opinions. The overall solution increases the automated review coverage of security product self-assessment reports from less than 15% to over 90%, with a review accuracy rate of over 96% and a 98% reduction in single report processing time. It fully meets the needs of high-frequency, large-scale, and high-standard cybersecurity supervision, and provides core technical support for building an independent, controllable, intelligent, and efficient digital security governance system. Attached Figure Description

[0017] Figure 1 The flowchart illustrates a method for intelligent review of self-assessment reports of security products based on artificial intelligence, as claimed in an embodiment of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0019] The terms "first," "second," and "third" in this application are for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first," "second," or "third" may explicitly or implicitly include at least one of those features. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified. All directional indications in the embodiments of this application, such as up, down, left, right, front, back, etc., are only used to explain the relative positional relationships and movements between components in a specific orientation as shown in the accompanying drawings. If the specific orientation changes, the directional indications will change accordingly. Furthermore, the terms "including" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices.

[0020] References to embodiments herein mean that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0021] Currently, with the rapid development of the internet industry, while cybersecurity products are rapidly iterating in terms of functionality and performance, their security compliance issues are becoming increasingly prominent. To standardize the security baseline of network products and services, national and industry regulatory authorities have successively issued standards such as GB / T 39276-2020 and QB-F-017-2019, clearly covering 81 testing requirements across 12 core modules, including identity identification and authentication, authorization and access control, and log recording and auditing, thus constructing a relatively complete security assessment system. Against this backdrop, enterprises are required to conduct regular self-assessments and submit structured or semi-structured self-assessment reports as key evidence for compliance audits. This places higher demands on the accuracy, consistency, and scalability of the audit mechanism. The audit of security product self-assessment results focuses on determining the compliance of the 81 testing items, involving the comprehensive analysis of multimodal unstructured supporting materials such as text descriptions, screenshots, and configuration logs. This process not only requires an accurate understanding of the security baseline semantics but also verification of the consistency between the self-assessment conclusions and supporting materials, and risk inference based on historical violation patterns to achieve a comprehensive, objective, and traceable audit judgment. However, existing technologies still heavily rely on manual review, with automation limited to simple rule matching based on regular expressions, resulting in an overall automation coverage rate of less than 15%. Traditional methods struggle to effectively parse unstructured text and image materials and lack the ability to identify semantic contradictions between security benchmarks and self-assessment statements. Furthermore, the review process lacks a multi-dimensional feature fusion mechanism, making it impossible to perform correlation analysis on interface configuration status, evidence credibility, and historical risk patterns. In addition, the explanations and suggestions in the review results rely entirely on manual drafting, leading to delayed responses and inconsistent quality, making it difficult to support large-scale, high-frequency security compliance regulatory needs. To address these technical problems, this invention proposes a method for intelligent review of security product self-assessment reports based on artificial intelligence, by constructing a multi-modal feature fusion model and a knowledge graph for security product compliance analysis. This achieves comprehensive, high-precision, and automated compliance review of 81 testing requirements across 12 modules, significantly improving the objectivity, traceability, and scalability of the review process.

[0022] Reference Appendix Figure 1 This invention presents an intelligent review method for security product self-assessment reports based on artificial intelligence, with an overall workflow diagram illustrating the entire data flow and core processing from original report input to final review report output. The entire system consists of a report parsing engine, a multimodal feature extractor, a multidimensional classifier cluster, a dynamic weighted fusion unit, a knowledge graph retrieval module, a review report generator, and a model incremental update mechanism. These modules work collaboratively to achieve end-to-end automated intelligent review.

[0023] According to a first embodiment of the present invention, the present invention claims protection for an intelligent review method for security product self-assessment reports based on artificial intelligence, comprising: S1: Obtain the self-assessment report of the security product to be reviewed, analyze the content of each test item, and generate structured test item data; S2: Multimodal feature extraction is performed on the structured detection item data. A pre-trained language model is used to encode the security benchmark description and self-assessment description into high-dimensional semantic vectors. A convolutional neural network is used to extract visual features from the images in the proof materials to obtain image feature vectors. The text vectors and image vectors are concatenated to form a composite fusion feature vector. S3: Construct multiple basic classifiers to process feature information of different dimensions in parallel; S4: The results output by each basic classifier are dynamically weighted and fused according to preset weights. The comprehensive compliance probability is calculated by weighted summation, and a binary decision is made based on a set threshold of 0.8. When the comprehensive compliance probability is greater than 0.8, it is judged as approved; otherwise, it is judged as unapproved. S5: Using the multi-dimensional discrimination results output by the fusion model as query conditions, perform multi-link comprehensive retrieval in the knowledge graph of security product compliance analysis, match historical violation cases that are similar to the current detection item in terms of semantics, configuration, evidence and historical risk patterns, use the comprehensive sorting tool to score and sort the retrieval results according to relevance, and generate audit explanations and improvement suggestions with violation location basis; S6: The audit results, audit instructions and audit suggestions for each detection item are structured and integrated to generate a standardized audit report with granularity down to a single detection item. It also supports triggering a manual review process for low-confidence audit results and collects expert-annotated feedback data for incremental training and continuous optimization of the model.

[0024] Furthermore, S1 also includes: The structured test item data includes the test module, test item number, test item benchmark description, self-assessment result, self-assessment description, and corresponding supporting materials.

[0025] Furthermore, S3 also includes: Artificial neural networks are used to analyze the probability of semantic conflicts in text, support vector machines are used to determine the compliance of the configuration status of interface elements, random forests are used to evaluate the credibility score of the supporting materials, logistic regression is used to quantify the incremental probability of violations caused by the consistency between text and images, and weighted nearest neighbor algorithm is used to calculate the risk matching degree between the current detection item and historical violation cases.

[0026] Furthermore, S4 also includes: In S4, semantic conflict probability accounts for 35% of the weight, configuration compliance accounts for 30% of the weight, evidence credibility accounts for 20% of the weight, and cross-modal conflict impact accounts for 15% of the weight.

[0027] Furthermore, in S1, the parsing process of the security product self-assessment report includes the natural language processing module performing syntactic segmentation and entity recognition on paragraph-level text, extracting data fields that strictly correspond to the detection requirements, and establishing a unique mapping relationship between each self-assessment content and its corresponding detection module and detection item number.

[0028] In this embodiment, step S1 involves acquiring the self-assessment report of the security product to be reviewed, parsing the content of each test item, and generating structured test item data. This structured test item data includes the test module, test item number, test item benchmark description, self-assessment result, self-assessment explanation, and corresponding supporting materials, serving as input data for subsequent multi-dimensional compliance analysis. Specifically, in step S1, the parsing process of the security product self-assessment report is executed by a natural language processing module. This module first performs syntactic segmentation on the paragraph-level text, uses a dependency parser to identify the subject-verb-object structure, and then uses a BiLSTM-CRF-based named entity recognition model to accurately extract data fields strictly corresponding to 81 test requirements. These fields include, but are not limited to, the names of 12 test modules such as identity identification and authentication, authorization and access control, test item numbers such as 1.1 and 2.3, benchmark descriptions for test items such as support for two-factor authentication, self-assessment results such as compliance or non-compliance, self-assessment explanations such as deployment of SMS verification code + password login, and associated supporting material file paths or embedded image data. To ensure data integrity and consistency, the system establishes a unique mapping table, which strongly binds each self-assessment item to its corresponding detection module and sequence number. A hash verification mechanism is used to prevent information misalignment or omission, and missing fields are automatically marked as not provided, triggering subsequent evidence credibility downgrading processing.

[0029] Data source: Structured data of each test item from historically reviewed and manually annotated self-assessment reports, including samples of approved and unapproved reports. The difference between approved and unapproved reports is the addition of review explanation and review suggestion fields, as shown in Table 1. Table 1 Data Source Explanation Table

[0030] Furthermore, the method also includes: In S2, a Chinese pre-trained BERT model is used to independently encode the safety benchmark description and the self-evaluation description. Each text segment is input into the model's bottom layer after word segmentation to generate a 768-dimensional context-aware semantic vector. Then, the key semantic components are extracted through the attention mechanism, and the first 384 dimensions are truncated to form a simplified semantic vector for subsequent comparison and analysis. Deep feature extraction was performed on the images of the evidence materials using the ResNet50 network. After outputting a 2048-dimensional global feature vector, the principal component analysis algorithm was applied to reduce its dimensionality to 300-dimensional, retaining more than 95% of the original variance contribution rate. Alternatively, the computer vision model detection system can be used to configure the layout of controls in the screenshot, identify key UI components such as account input boxes, password boxes, and permission switches, and generate a 768-bit binary state vector based on visibility, enabled status, and interaction attributes.

[0031] In this embodiment, step S2 involves multimodal feature extraction of the structured detection item data, text encoding of the security benchmark description and self-assessment description using a pre-trained language model to obtain a high-dimensional semantic vector, and visual feature extraction of the images in the evidence materials using a convolutional neural network to obtain an image feature vector. The text vector and the image vector are then concatenated to form a composite fusion feature vector.

[0032] Specifically, in S2, a pre-trained Chinese BERT model is used to independently encode the security benchmark description and the self-evaluation description. Each text segment is first finely segmented by the Jieba word segmenter, and after adding the special tags [CLS] and [SEP], it is input into the bottom layer of the BERT model. After passing through 12 layers of Transformer encoders, a 768-dimensional context-aware semantic vector is generated. Then, the word vectors are dynamically weighted and aggregated by a multi-head attention mechanism with 12 heads, and the key components that are most discriminative to the security semantics are extracted. The first 384 dimensions are truncated to form a simplified semantic vector for subsequent comparison and analysis. This approach significantly reduces the computational cost while retaining the core semantic information. For images in the supporting materials, if they are screenshots of system configuration, a specially trained UI element detection model is invoked. This model, based on the YOLOv5 architecture, is fine-tuned on a dataset containing 100,000 labeled screenshots and can accurately identify 76 key UI components, such as account input boxes, password boxes, permission switches, and log level dropdown menus. It generates a 768-bit binary state vector based on the visibility, activation status, and interaction attributes of the UI element, with each bit corresponding to a predefined UI element's state code, thus quantifying the consistency between the actual configuration and standard requirements. For general images such as network topology diagrams or certificate screenshots, a ResNet50 network is used for deep feature extraction. The input image is normalized to 224×224 pixels and then abstracted layer by layer through 50 residual blocks, ultimately outputting a 2048-dimensional global feature vector. To eliminate redundant information and improve computational efficiency, principal component analysis is applied to reduce the dimensionality to 300 dimensions, retaining over 95% of the original variance contribution rate, ensuring compact features and complete information. Finally, the 384-dimensional security baseline semantic vector, the 384-dimensional self-assessment semantic vector, the 300-dimensional general image feature vector, and the 768-bit UI state vector are concatenated by channel to form a composite fusion feature vector with a total dimension of 1836, which serves as the unified input to the multidimensional classifier cluster.

[0033] The fused feature vector generated in this embodiment is shown in Table 2: Table 2 Fusion Feature Vector Table

[0034] Furthermore, the method also includes: In S3, the artificial neural network is set with a fully connected layer structure. The input is a 768-dimensional concatenated text vector, and the output is the semantic conflict probability value in the range of 0 to 1. The weight matrix focuses on the dimensions of uniqueness, minimum authorization, and non-repudiation security keywords, and the bias term is initialized to -1.2. The support vector machine uses a radial basis function kernel to process the n-dimensional interface element state vector, and the kernel function parameter γ is set to 0.1; The random forest consists of 150 decision trees of depth 8. The input is a two-dimensional vector composed of clarity and feature completeness, and the output is an evidence credibility score in the range of 0 to 1. The logistic regression model introduces a sigmoid function with a slope of -3.2 to convert the text-image consistency score into an increment of the violation probability, and the threshold adjustment term is set to 1.5; The weighted KNN algorithm selects k=12 nearest neighbor historical cases, measures the similarity of risk matching vectors based on cosine distance, distributes weights according to the inverse of distance, and outputs a weighted average reference probability.

[0035] In this embodiment, step S3 involves constructing multiple basic classifiers to process feature information of different dimensions in parallel. Among them, artificial neural networks are used to analyze the probability of semantic conflicts in text, support vector machines are used to determine the compliance of the configuration status of interface elements, random forests are used to evaluate the credibility score of supporting materials, logistic regression is used to quantify the increase in the probability of violations caused by consistency between text and images, and weighted nearest neighbor algorithms are used to calculate the risk matching degree between the current detection item and historical violation cases.

[0036] Specifically, in S3, the artificial neural network uses a three-layer fully connected structure. The input layer receives a 768-dimensional concatenated text vector, which is the concatenation of a 384-dimensional baseline vector and a 384-dimensional self-assessment vector. The hidden layer has 512 nodes, and the output layer is a single neuron. The activation function is Sigmoid. The weight matrix is ​​fine-tuned during initialization using a pre-trained security corpus, focusing particularly on security keyword dimensions such as uniqueness, least privilege, non-repudiation, and anti-replay, to ensure high sensitivity in the relevant semantic space. The bias term is initialized to -1.2 to suppress the model's tendency to generate false positives when there are no obvious contradictions. The final output is a semantic conflict probability value in the range of 0 to 1; a higher value indicates a greater likelihood of logical contradiction between the self-assessment and the security baseline. The support vector machine receives a 768-bit UI state vector as input and adopts a radial basis function kernel (RBF kernel). The kernel parameter γ is set to 0.1. This parameter is selected by optimizing the validation set through grid search. It aims to enhance the sensitivity of decision boundaries for key control such as whether to enable two-factor authentication and whether to allow anonymous access, so as to achieve accurate identification of configuration missing behavior such as being turned off when it should be turned on or wrongly turned on when it should be turned off. The output is a binary compliance judgment and decision distance. The random forest consists of 150 decision trees with a depth of 8. When splitting a node, each tree randomly selects sqrt(2) candidate features from all features, namely the clarity score and the element completeness score. The optimal split point is selected based on the principle of minimizing Gini impurity. The clarity score is obtained by calculating the image gradient variance by the Laplacian operator. The element completeness score is obtained by the OCR engine recognizing key text regions and comparing them with the preset element list. The two together constitute a two-dimensional input vector. The model output is an evidence credibility score in the range of 0 to 1, which reflects the quality level of the evidence material. A low score will directly lead to a decrease in the overall compliance probability of the detection item. The logistic regression model is specifically designed to handle the text-image consistency problem. Its input is a weighted average of the text semantic similarity calculated by cosine similarity and the UI state matching degree normalized by Hamming distance. A sigmoid function with a slope of -3.2 is introduced to convert the consistency score into a violation probability increment. The negative coefficient is designed to amplify the risk amplification effect in the case of text-image inconsistency. For example, when the self-assessment claims that two-factor authentication has been enabled but the screenshot shows that the relevant switch is turned off, the consistency score approaches 0. After the negative slope sigmoid transformation, a violation increment close to 1 is generated. The threshold adjustment term is set to 1.5 to balance sensitivity and specificity and avoid over-penalization due to slight inconsistencies.The weighted KNN algorithm maintains a risk matching vector database containing no less than 100,000 historical violation cases. Each vector is composed of the aforementioned four-dimensional features: semantic conflict, configuration compliance, evidence credibility, and image-text consistency normalization. For the current detection item, k=12 nearest neighbor historical cases are selected. Similarity is measured based on cosine distance, and the weights are distributed according to the inverse of the distance, that is, the closer the distance, the higher the weight. The output is a weighted average reference probability, which reflects the correlation strength between the current detection item and past violation patterns. The higher the value, the closer the current situation is to the known high-risk pattern.

[0037] This embodiment selects various basic learners with good processing capabilities for high-dimensional data, such as SVM, random forest, logistic regression, and weighted KNN, to improve the compliance analysis capability and overall generalization performance of multi-dimensional data of detection items. The basic learners not only include traditional machine learning classifiers, but can also be extended to deep learning classifiers.

[0038] Artificial Neural Network (ANN): To improve the accuracy of semantic conflict detection, a deep neural network is introduced to analyze the 768-dimensional text semantic feature security benchmark and the BERT vector of self-assessment. This method focuses on monitoring keyword dimensions such as uniqueness and minimum authorization through the weight matrix of fully connected layers, outputting a semantic conflict probability of 0 to 1, which can be described as follows:

[0039] Where x_{\text{text}}: 768-dimensional text semantic vector extracted by BERT, w: weight matrix such as uniqueness, minimum authorization and other keyword dimensions, b: bias term defaults to -1.2 to reduce false positives.

[0040] Support Vector Machine (SVM): To address the compliance verification problem of interface configurations, an RBF kernel SVM is introduced to process the n-dimensional interface element state vectors, such as permission switches [1,0,1]. This method controls the sensitivity of key control decision boundaries using γ=0.1, outputting a 0 / 1 compliance judgment, which can be described as follows:

[0041] Among them, the interface element state vector is such as [1,0,1], K: RBF kernel function \exp(-\gamma|x_i-x|^2), \gamma=0.1: decision boundary of key controls such as control permission switch.

[0042] Random Forest (RF): To improve the robustness of evidence credibility assessment, 150 decision trees are introduced to analyze the two-dimensional evidence quality features of clarity and completeness. This method achieves splitting through Gini impurity minimization and outputs a credibility score of 0-1, which can be described as follows:

[0043] Where x: [clarity, element completeness] vector, \text{tree}_t: 150 decision trees with a depth of 8.

[0044] Logistic Regression (LR): To quantify the impact of cross-modal inconsistencies, a logistic regression model with a slope k=-3.2 is introduced to process 1D text-image consistency scores. This method uses the sigmoid function to transform the degree of inconsistency into an increment of the probability of violation, which can be specifically described as follows:

[0045] Where x_{\text{consist}}: 1-dimensional consistency score of text and image, k=-3.2: negative value of contradiction coefficient strengthens the effect of inconsistency, c=1.5: threshold adjustment term.

[0046] Weighted KNN: To leverage historical experience for decision-making, a weighted nearest neighbor algorithm (k=12) is introduced to process the 3D risk matching vector using the highest / average similarity and type encoding. This method calculates the reference probability of historical cases using cosine distance weighting, as detailed below:

[0047] Where x: risk matching vector [highest similarity, average similarity, type encoding], k is the number of reference cases, and d_i: cosine distance.

[0048] Furthermore, the method also includes: In S4, the dynamic weighted fusion process adjusts the weight ratio of each dimension according to the detection module type, increasing the semantic weight to 40% in the identity authentication detection item and increasing the evidence credibility to 25% in the log audit detection item.

[0049] In this embodiment, step S4 involves dynamically weighting and fusing the results output by each basic classifier according to preset weights. Semantic conflict probability accounts for 35% of the weight, configuration compliance accounts for 30%, evidence credibility accounts for 20%, and cross-modal contradiction impact accounts for 15%. The overall compliance probability is calculated through weighted summation, and a binary decision is made based on a set threshold of 0.8. If the overall compliance probability is greater than 0.8, the review is deemed passed; otherwise, it is deemed failed. Specifically, the dynamic weighting and fusing process in S4 is not fixed but allows adjustment of the weight ratios of each dimension based on the type of detection module. For example, in identity verification detection items such as items 1.1 to 1.8, the accuracy of semantic description is crucial; therefore, the system automatically increases the semantic weight to 40% and correspondingly reduces other weights. In log auditing detection items such as items 11.1 to 11.7, the completeness and clarity of supporting materials such as log screenshots are key; therefore, the evidence credibility weight is increased to 25%, achieving a differentiated judgment strategy.

[0050] To achieve optimal fusion of multi-dimensional features, a dynamic weighting algorithm is introduced to integrate the outputs of each classifier: semantics (35%), configuration (30%), evidence (20%), and contradiction (15%). This method generates the final review result through threshold segmentation of 0.45 / 0.7, which can be specifically described as follows:

[0051] Parameter descriptions: P_{\text{ANN}}: Semantic conflict probability (35% weight), P_{\text{SVM}}: Configuration compliance (30% weight), P_{\text{RF}}: Evidence credibility (20% weight), P_{\text{LR}}: Increment of contradiction probability (15% weight).

[0052] Decision Explanation: If the overall probability P_{\text{final}} > 0.8, the review is approved; otherwise, the review is rejected.

[0053] Furthermore, the method also includes: In S5, the knowledge graph for security product compliance analysis contains multiple historical audit record nodes. Each node contains detection item benchmarks, self-assessment content, multimodal evidence, audit results, and description and suggestion attributes. It also establishes an association index through semantic embedding, configuration vectors, and risk label multi-sided relationships. The comprehensive sorter uses a learning sorting algorithm that combines four indicators—BM25 semantic matching score, vector cosine similarity, evidence quality weighted score, and time decay factor—to jointly score and re-sort the retrieved historical cases.

[0054] In this embodiment, step S5 uses the multi-dimensional discrimination results output by the fusion model as query conditions to perform a multi-link comprehensive retrieval in the knowledge graph of security product compliance analysis, matches historical violation cases that are similar to the current detection item in terms of semantics, configuration, evidence, and historical risk patterns, and uses a comprehensive sorting device to score and sort the retrieval results according to relevance, generating audit explanations and improvement suggestions with violation location basis.

[0055] Specifically, in S5, the security product compliance analysis knowledge graph is a massive heterogeneous graph database containing no fewer than 100,000 historical audit record nodes. Each node includes attributes such as the detection item benchmark, self-assessment content, multimodal evidence, audit results, explanations, and suggestions. It also establishes a relational index through multiple edge relationships, including semantic embedding vectors, configuration state vectors, and risk tags. When the retrieval process begins, the system uses the four-dimensional feature vectors of the current detection item—semantic, configuration, evidence, and risk—as query vectors, and performs an approximate nearest neighbor search along the corresponding relational edges in the graph to recall the Top-50 candidate cases. Subsequently, a comprehensive ranking system jointly scores and re-ranks these candidate cases. This ranking system employs the LambdaMART learning ranking algorithm, trained on a dataset containing 50,000 manually annotated relevance data points. The scoring function integrates four metrics: BM25 semantic matching score (measuring keyword overlap between the self-assessment text and historical case texts), vector cosine similarity (measuring the overall similarity of four-dimensional feature vectors), evidence quality weighting (giving higher weight to high-definition and high-completeness historical evidence), and a time decay factor (giving 1.0 weight to cases occurring within 3 months, 0.8 within 6 months, 0.6 within 1 year, and 0.4 over 1 year), ensuring that the most relevant and instructive cases are presented first. Finally, the system extracts the review explanations and improvement suggestions from the top-3 cases and generates the review explanation for the current detection item through template filling.

[0056] The manual review and feedback learning mechanism introduces a manual review mechanism, which manually annotates the results of detection items with low review accuracy and feeds them back to the model for optimization. On this basis, incremental data training is carried out to achieve continuous optimization of the model.

[0057] Furthermore, the method also includes: In S6, the generated structured audit report is output using a unified template. Each test result includes the audit conclusion, confidence score, summary of core contradictions, cited historical case number, and detailed improvement suggestions. It supports export in both JSON and XML formats. The review results after manual review and correction are added to the historical database as new training samples. Incremental training tasks are launched regularly to update the parameters of each basic classifier and the fusion weight coefficients.

[0058] In this embodiment, step S6 involves structurally integrating the review results, review descriptions, and review suggestions for each detection item to generate a standardized review report with granularity refined to a single detection item. It also supports triggering a manual review process for low-confidence review results and collecting expert-annotated feedback data for incremental training and continuous optimization of the model.

[0059] Specifically, in step S6, the generated structured review report uses a unified XML / JSON dual-format template for output. Each test result includes the following fields: test module, test item number, review conclusion (pass / fail), confidence score (0.0 to 1.0), a summary of the core contradictions (no more than 100 words), the cited historical case number (e.g., #A2023-08765), and detailed improvement suggestions in structured text. The report generator has a built-in format verification module to ensure that the output conforms to the electronic report specifications in Appendix B of GB / T 39276-2020. For low-confidence results with a confidence score below 0.1, the system automatically routes them to the manual review queue. Review experts can view all original materials, intermediate model outputs, and suggestions on a dedicated interface to make a final decision. All manually corrected results and their original prediction data are recorded as new training samples and added to the historical database. The system initiates incremental training tasks daily at midnight, employing an online learning strategy. It uses new samples to fine-tune the parameters of various basic classifiers, such as the weights of the ANN, the kernel parameters of the SVM, and the dynamic fusion weight coefficients. This enables the overall model to continuously adapt to new threat patterns, such as novel methods for bypassing two-factor authentication, and changes in standards, such as newly added detection items. In actual deployments of large-scale cybersecurity product access review platforms, this method can process over 50,000 self-assessment reports per day, with an average review time of less than 0.8 seconds per detection item. The end-to-end automation rate reaches 92%, significantly outperforming the daily processing limit of traditional manual review methods.

[0060] The semantic conflict probability, configuration compliance status, evidence credibility, and cross-modal contradiction degree output by the above five classifiers are used as inputs for multi-dimensional detection and retrieval of the knowledge graph of security product compliance analysis. Historical violation cases are matched, and the multi-dimensional retrieval results are sorted based on the comprehensive sorter to generate audit explanations and audit suggestions for specific violation locations.

[0061] The system performs structured processing on the audit results output by the fusion model and the audit explanations and suggestions retrieved from the knowledge graph, according to the granularity of the detection items, and generates the final audit report.

[0062] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between apparatuses or units, and may be electrical, mechanical, or other forms.

[0063] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated units described above can be implemented in hardware or as software functional units. The above are merely embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made based on the description and drawings of this application, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

[0064] The specific embodiments of the invention have been described in detail above, but they are only examples, and this application is not limited to the specific embodiments described above. For those skilled in the art, any equivalent modifications or substitutions to the invention are also within the scope of this application. Therefore, all equivalent changes, modifications, and improvements made without departing from the spirit and principles of this application should be covered within the scope of this application.

Claims

1. A method for intelligently reviewing self-assessment reports of security products based on artificial intelligence, characterized in that... ,include: S1: Obtain the self-assessment report of the security product to be reviewed, analyze the content of each test item, and generate structured test item data; S2: Multimodal feature extraction is performed on the structured detection item data. A pre-trained language model is used to encode the security benchmark description and self-assessment description into high-dimensional semantic vectors. A convolutional neural network is used to extract visual features from the images in the proof materials to obtain image feature vectors. The text vectors and image vectors are concatenated to form a composite fusion feature vector. S3: Construct multiple basic classifiers to process feature information of different dimensions in parallel; S4: The results output by each basic classifier are dynamically weighted and fused according to preset weights. The comprehensive compliance probability is calculated by weighted summation, and a binary decision is made based on a set threshold of 0.

8. When the comprehensive compliance probability is greater than 0.8, it is judged as approved; otherwise, it is judged as unapproved. S5: Using the multi-dimensional discrimination results output by the fusion model as query conditions, perform multi-link comprehensive retrieval in the knowledge graph of security product compliance analysis, match historical violation cases that are similar to the current detection item in terms of semantics, configuration, evidence and historical risk patterns, use the comprehensive sorting tool to score and sort the retrieval results according to relevance, and generate audit explanations and improvement suggestions with violation location basis; S6: The audit results, audit instructions and audit suggestions for each detection item are structured and integrated to generate a standardized audit report with granularity down to a single detection item. It also supports triggering a manual review process for low-confidence audit results and collects expert-annotated feedback data for incremental training and continuous optimization of the model.

2. The intelligent review method for security product self-assessment reports based on artificial intelligence assistance according to claim 1, characterized in that, S1 also includes: The structured test item data includes the test module, test item number, test item benchmark description, self-assessment result, self-assessment description, and corresponding supporting materials.

3. The intelligent review method for security product self-assessment reports based on artificial intelligence as described in claim 1, characterized in that, S3 also includes: Artificial neural networks are used to analyze the probability of semantic conflicts in text, support vector machines are used to determine the compliance of the configuration status of interface elements, random forests are used to evaluate the credibility score of the supporting materials, logistic regression is used to quantify the incremental probability of violations caused by the consistency between text and images, and weighted nearest neighbor algorithm is used to calculate the risk matching degree between the current detection item and historical violation cases.

4. The intelligent review method for security product self-assessment reports based on artificial intelligence as described in claim 1, characterized in that, S4 also includes: In S4, semantic conflict probability accounts for 35% of the weight, configuration compliance accounts for 30% of the weight, evidence credibility accounts for 20% of the weight, and cross-modal conflict impact accounts for 15% of the weight.

5. The intelligent review method for security product self-assessment reports based on artificial intelligence assistance according to claim 1, characterized in that: In S1, the parsing process of the security product self-assessment report includes the natural language processing module performing syntactic segmentation and entity recognition on paragraph-level text, extracting data fields that strictly correspond to the detection requirements, and establishing a unique mapping relationship between each self-assessment content and its corresponding detection module and detection item number.

6. The intelligent review method for security product self-assessment reports based on artificial intelligence as described in claim 1, characterized in that, Also includes: In S2, a Chinese pre-trained BERT model is used to independently encode the safety benchmark description and the self-evaluation description. Each text segment is input into the model's bottom layer after word segmentation to generate a 768-dimensional context-aware semantic vector. Then, the key semantic components are extracted through the attention mechanism, and the first 384 dimensions are truncated to form a simplified semantic vector for subsequent comparison and analysis. Deep feature extraction was performed on the images of the evidence materials using the ResNet50 network. After outputting a 2048-dimensional global feature vector, the principal component analysis algorithm was applied to reduce its dimensionality to 300-dimensional, retaining more than 95% of the original variance contribution rate. Alternatively, the computer vision model can be used to detect the layout of controls in the screenshot, identify key UI components such as account input boxes, password boxes, and permission switches, and generate a 768-bit binary state vector based on visibility, enabled status, and interaction attributes.

7. The intelligent review method for security product self-assessment reports based on artificial intelligence assistance according to claim 1, characterized in that, Also includes: In S3, the artificial neural network is set with a fully connected layer structure. The input is a 768-dimensional concatenated text vector, and the output is the semantic conflict probability value in the range of 0 to 1. The weight matrix focuses on the dimensions of uniqueness, minimum authorization, and non-repudiation security keywords, and the bias term is initialized to -1.

2. The support vector machine uses a radial basis function kernel to process the n-dimensional interface element state vector, and the kernel function parameter γ is set to 0.1; The random forest consists of 150 decision trees of depth 8. The input is a two-dimensional vector composed of clarity and feature completeness, and the output is an evidence credibility score in the range of 0 to 1. The logistic regression model introduces a sigmoid function with a slope of -3.2 to convert the text-image consistency score into an increment of the violation probability, and the threshold adjustment term is set to 1.5; The weighted KNN algorithm selects k=12 nearest neighbor historical cases, measures the similarity of risk matching vectors based on cosine distance, distributes weights according to the inverse of distance, and outputs a weighted average reference probability.

8. The intelligent review method for security product self-assessment reports based on artificial intelligence as described in claim 1, characterized in that, Also includes: In S4, the dynamic weighted fusion process adjusts the weight ratio of each dimension according to the detection module type, increasing the semantic weight to 40% in the identity authentication detection item and increasing the evidence credibility to 25% in the log audit detection item.

9. The intelligent review method for security product self-assessment reports based on artificial intelligence as described in claim 1, characterized in that, Also includes: In S5, the knowledge graph for security product compliance analysis contains multiple historical audit record nodes. Each node contains detection item benchmarks, self-assessment content, multimodal evidence, audit results, and description and suggestion attributes. It also establishes an association index through semantic embedding, configuration vectors, and risk label multi-sided relationships. The comprehensive sorter uses a learning sorting algorithm that combines four indicators—BM25 semantic matching score, vector cosine similarity, evidence quality weighted score, and time decay factor—to jointly score and re-sort the retrieved historical cases.

10. The intelligent review method for security product self-assessment reports based on artificial intelligence as described in claim 1, characterized in that, Also includes: In S6, the generated structured audit report is output using a unified template. Each test result includes the audit conclusion, confidence score, summary of core contradictions, cited historical case number, and detailed improvement suggestions. It supports export in both JSON and XML formats. The review results after manual review and correction are added to the historical database as new training samples. Incremental training tasks are launched regularly to update the parameters of each basic classifier and the fusion weight coefficients.

Images