An Internet of Vehicles security auditing method and system based on feature decoupling and double-path hybrid retrieval, and a storage medium

Abstract

The application provides a kind of vehicle networking security audit method, system and storage medium based on feature decoupling and double-way mixed retrieval, method includes: step 1: receiving the natural language audit demand of user;Step 2: the query sentence is parsed using hybrid feature extractor, hard features are extracted from the parsed results by regular engine, and soft features are extracted from the parsed results by semantic classification;Step 3: double-way parallel retrieval strategy of vector retrieval channel and atlas retrieval channel is adopted;Step 4, correlation joint evaluation: the fact context formed by vector retrieval channel and the rule context formed by atlas retrieval channel are correlated and evaluated;Step 5: convert JSON topology into natural language linear sequence, and use adaptive pruning algorithm for dynamic pruning;Step 6: guide large model to execute logical judgment according to inference template, and generate structured security audit response report.The beneficial effect is: the proportion of effective information input into the model is improved.

Description

Technical Field

[0001] This invention relates to the field of computer network security technology, and in particular to a method, system and storage medium for vehicle network security auditing based on feature decoupling and dual-path hybrid retrieval. Background Technology

[0002] With the development of intelligent connected vehicle technology, the amount of operational log data generated by vehicles continues to grow. In the context of vehicle-to-everything (V2X) security auditing, simple anomaly detection is no longer sufficient to meet industry regulatory and compliance requirements. Auditors need to extract evidence chains of violations of compliance standards from massive amounts of log data. To improve audit efficiency, retrieval-enhanced generation techniques using large language models combined with external knowledge bases have gradually become a research hotspot. Under this architecture, how to accurately extract key facts from the underlying logs and logically align them with laws and regulations is a key technical challenge in achieving automated and professional auditing.

[0003] In terms of attack path deduction and threat modeling for connected vehicles, some existing technologies employ probabilistic graph-based computational methods. For example, patent CN 121750505A proposes a monitoring method. This scheme correlates platform-oriented threat intelligence with publicly available vulnerability information, abstracts system assets and data flows into a graph model with probability and time weights, and filters out feasible attack routes. Subsequently, it performs multi-round attack simulations based on a domain-specific meta-attack language to calculate the global compromise time and issue early warnings.

[0004] In the research of large language model knowledge graph applications in vertical fields, patent publication number CN 121745275A discloses a generation scheme. This method inputs the obtained user modification request text into a cloud-based large model to extract key information, converts it into query vectors, and then matches and retrieves them with entity embeddings in a commercial vehicle modification knowledge graph. Subsequently, based on the retrieved knowledge, prompt words are constructed, and finally, a vehicle modification scheme is generated through the large model's thought chain reasoning.

[0005] In summary, existing retrieval enhancement and attack inference techniques still face several technical bottlenecks when handling vehicle network security auditing tasks. First, traditional graph model attack inference methods, as described in the aforementioned literature, heavily rely on pre-defined static rules and probabilistic topologies, lacking the natural language generalization capabilities of large language models, making it difficult to transform unstructured logs into audit reports with strong compliance interpretability. Second, the graph RAG technology used in the aforementioned modification scheme generation patent has a single retrieval path and lacks a dual-path routing mechanism based on query feature decoupling, easily leading to a logical disconnect between the underlying operational "facts" and security "rules." Furthermore, such methods often directly input the graph subgraph into the large model after retrieval, lacking adaptive pruning and high-density semantic reconstruction mechanisms for heterogeneous retrieval results. In the context of the vast number of interconnected entities in the vehicle network, this loose contextual structure easily leads to window overflow or attention diversion in the large model, affecting the stability and accuracy of compliance inference. Therefore, it is necessary to construct a vehicle network security log auditing method based on feature decoupling and graph-text hybrid retrieval, integrating semantic pruning and thought chain reasoning.

[0006] The information disclosed in this background section is intended only to enhance understanding of the overall background of the invention and should not be construed as an admission or in any way implying that the information constitutes prior art known to those skilled in the art. Summary of the Invention

[0007] To address the issues of low efficiency in matching audit facts with audit rules, information loss due to a single retrieval path, and reasoning illusion caused by context overflow in large models during vehicle network log auditing, this invention provides a vehicle network security auditing method, system, and storage medium based on feature decoupling and dual-path hybrid retrieval.

[0008] This invention provides a vehicle network security auditing method based on feature decoupling and dual-path hybrid retrieval, comprising: Step 1, Startup Phase: Receive users' natural language auditing requests; Step 2, Query parsing and semantic routing: Design a feature decoupling mechanism, use a hybrid feature extractor to parse the query statement, extract hard features from the parsing results through a regular expression engine, and extract soft features from the parsing results through semantic classification; Step 3, Dual-path parallel hybrid retrieval: A dual-path parallel retrieval strategy of vector retrieval path and graph retrieval path is adopted; the vector retrieval path uses the extracted hard features to match in the underlying fact base to form the fact context of the audit, and the graph retrieval path uses entity linking technology to recall and query relevant knowledge with entity nodes as the center to form the rule context of the audit. Step 4, Joint Relevance Assessment: Jointly assess the relevance between the factual context formed by the vector retrieval path and the rule context formed by the graph retrieval path; Step 5, Semantic Reconstruction and Adaptive Pruning: Design a graph-text semantic reconstruction operator to convert the JSON topology into a natural language linear sequence, and use a priority-based adaptive pruning algorithm to dynamically prune, retaining only the core logical links; Step 6, Large Model Thinking Chain Reasoning: Inject the system instructions and required reasoning templates of the security expert role into the prompt word template, guide the large model to perform step-by-step logical judgments according to the reasoning template, and generate a structured security audit response report containing the reasoning chain.

[0009] As a further improvement of the present invention, step 4 further includes: Given user query vector Vector path recall log vector Similarity is divided into Graph path recall node x relative anchor point The jump decay score is , This represents the anchor node mapped in the knowledge graph, and the candidate set scoring function for dual-path fusion recall. Defined as: In the formula, and These are the normalized weighting coefficients. Measure the cosine similarity of vector spaces. Measuring topological relevance of a map; Represents a node The shortest path hop count to the query anchor point. As the jump penalty factor, Represents a node x eigenvectors.

[0010] As a further improvement of the present invention, in step 5, the image-text semantic reconstruction operator includes the following steps: For entity data in the graph, an entity description compression operator is used to remove redundant JSON syntax tags, retaining only the entity name, type, and core description. For relational data, a relational path linearization operator is applied to transform discrete triples into text links with logical direction.

[0011] As a further improvement of the present invention, in step 5, the dynamic pruning based on the priority-based adaptive pruning algorithm includes the following steps: Step 1: The log text set retrieved and denoised by vector path is concatenated with the standard rule sequence retrieved and linearized by graph path to form the initial global context; then, the total token length of the global context is calculated. If the total token length is greater than the preset large model safety window threshold, the adaptive pruning procedure is automatically triggered. Step 2: Based on the degree of relevance between the search content and the user's original query intent, the text fragments in the context are quantified and assigned different retention priority scores; Step 3: Sort all text fragments to be processed in descending order according to their corresponding priority scores. Then, using a greedy strategy, start with the text fragment with the lowest priority score and perform physical removal in sequence until the context length meets the preset standard.

[0012] This invention also discloses a vehicle network security audit system based on feature decoupling and dual-path hybrid retrieval, comprising: Startup unit: Receives the user's natural language auditing request; Query parsing and semantic routing unit: Design a feature decoupling mechanism, use a hybrid feature extractor to parse the query statement, extract hard features from the parsing results through a regular expression engine, and extract soft features from the parsing results through semantic classification; Dual-path parallel retrieval strategy unit: adopts a dual-path parallel retrieval strategy of vector retrieval path and graph retrieval path; the vector retrieval path uses extracted hard features to match in the underlying fact base to form the fact context of auditing, and the graph retrieval path uses entity linking technology to recall and query relevant knowledge with entity nodes as the center to form the rule context of auditing. Joint Relevance Assessment Unit: Used to jointly assess the relevance between the factual context formed by the vector retrieval path and the rule context formed by the graph retrieval path; Semantic Reconstruction and Adaptive Pruning Unit: Through the designed graph-text semantic reconstruction operator, the JSON topology is converted into a linear sequence of natural language, and a priority-based adaptive pruning algorithm is used for dynamic pruning, retaining only the core logical links; Large Model Thinking Chain Reasoning Unit: Injects system instructions and required reasoning templates for security expert roles into the prompt word templates, guiding the large model to perform step-by-step logical judgments according to the reasoning templates, and generating a structured security audit response report containing the reasoning chain.

[0013] As a further improvement of the present invention, the correlation joint evaluation unit is configured as follows: Based on user query vectors Vector path recall log vector Similarity score Graph path recall node x relative anchor point Jump decay score , This represents the anchor node mapped in the knowledge graph, and constructs a candidate set scoring function for dual-path fusion recall. : In the formula, and These are the normalized weighting coefficients. Measure the cosine similarity of vector spaces. Measuring topological relevance of a map; Represents a node The shortest path hop count to the query anchor point. As the jump penalty factor, Represents a node x eigenvectors.

[0014] As a further improvement of the present invention, the semantic reconstruction and adaptive pruning unit further includes: The graph semantic reconstruction operator module: For entity data in the graph, it uses an entity description compression operator to remove redundant JSON syntax tags and retain only the entity name, type and core description; for relational data, it applies a relational path linearization operator to transform discrete triples into text links with logical direction.

[0015] As a further improvement of the present invention, the semantic reconstruction and adaptive pruning unit further includes a module for dynamic pruning based on a priority-based adaptive pruning algorithm, which performs the following steps: Step 1: Concatenate the log text set retrieved and denoised by vector path with the standard rule sequence retrieved and linearized by graph path to form the initial global context; then, calculate the total token length of the global context. If the total token length is greater than the preset large model safety window threshold, the adaptive pruning procedure will be automatically triggered. Step 2: Based on the degree of relevance between the search content and the user's original query intent, the text fragments in the context are quantified and assigned different retention priority scores; Step 3: Sort all text fragments to be processed in descending order according to their corresponding priority scores. Then, using a greedy strategy, start with the text fragment with the lowest priority score and perform physical removal in sequence until the context length meets the preset standard.

[0016] The present invention also discloses a computer-readable storage medium storing a computer program configured to implement the steps of the method described in the present invention when invoked by a processor.

[0017] The beneficial effects of this invention are: 1. This invention improves the "fact-rule disconnect" problem caused by a single retrieval mode by designing a semantic routing mechanism based on feature decoupling, which helps to achieve accurate recall of audit evidence. Existing retrieval enhancement systems usually rely on single vector similarity retrieval, making it difficult to handle both specific numerical queries and abstract intent queries simultaneously. This invention decomposes the natural language auditing requirements, routing hard features with clear formats to the underlying fact base for accurate recall, and routing soft features with abstract intents to the graph database for multi-hop logical recall. This dual-path complementary architecture enables the system to take into account both physical facts and upper-level knowledge when facing complex security assessment questions.

[0018] 2. This invention helps improve the contextual information density of retrieval results and reduce context overflow and illusion phenomena during large model inference. Graph retrieval results typically contain a large number of redundant JSON topological structures and long-tailed edge noise nodes, which can easily lead to large models losing focus on key information if directly input. This invention introduces semantic reconstruction operators and adaptive pruning strategies to compress data into high-density sequences and dynamically truncate long-tailed redundant data, thereby increasing the proportion of effective information input to the model.

[0019] 3. This invention helps improve the interpretability and professionalism of audit conclusions. Existing security large-scale model applications often lack intermediate logical deduction steps, resulting in low credibility of the generated audit reports. This invention designs a domain-specific thought chain reasoning mechanism in the generation stage, constraining the judgment logic of the large-scale model through customized system instructions. This enables the system to handle unknown threat combinations beyond preset rules and improves the traceability of the evidence chain in the output audit report. Attached Figure Description

[0020] Figure 1 This is the overall flowchart of the method of the present invention. Detailed Implementation

[0021] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings, but it should be understood that the scope of protection of the present invention is not limited to the specific embodiments.

[0022] Unless otherwise expressly stated, throughout the specification and claims, the term "comprising" or its variations such as "including" or "comprises" shall be understood to include the stated elements or components without excluding other elements or other components.

[0023] This invention specifically relates to the fields of intelligent auditing, automated compliance detection, network attack threat path deduction, and retrieval enhancement and optimization based on large language models in the field of vehicle network security operation centers.

[0024] This invention proposes a vehicle network security log auditing method based on feature decoupling and dual-path hybrid retrieval. Through intelligent retrieval routing and semantic pruning techniques, it achieves high-confidence generation from original facts to compliance judgment conclusions. This invention divides the auditing process into four continuous and complementary stages: query decoupling, dual-path parallel recall, semantic reconstruction pruning, and guided thought chain reasoning.

[0025] The flowchart of the vehicle network security auditing method and system based on feature decoupling and dual-path hybrid retrieval proposed in this invention is as follows: Figure 1 As shown. Next, the implementation process of the present invention will be described in detail.

[0026] Step 1, Startup Phase: In the startup phase of the audit process, the system first receives the user's natural language audit request.

[0027] Step 2, Query Parsing and Semantic Routing: Since vehicle network audit questions usually involve both specific physical objects and abstract compliance intentions, this invention designs a feature decoupling mechanism. It uses a hybrid feature extractor to parse the query statement, extracts hard features, including IP / VIN / DTC, from the parsing results through a regular expression engine, and extracts soft features, including compliance intentions / attack tactics, from the parsing results through semantic classification, thus completing feature decoupling. Step 3, Dual-path parallel hybrid retrieval: After the features are decoupled, the system starts a dual-path parallel retrieval strategy; the vector retrieval path uses the extracted hard features to match in the underlying fact base to form the "fact context" of the audit, while the graph retrieval path uses entity linking technology to recall and query relevant knowledge centered on entity nodes to form the "rule context" of the audit; through this parallel routing mechanism, the system can simultaneously acquire micro-level field data and macro-level logical constraints.

[0028] Step 4, Joint Relevance Assessment: After completing the dual-path recall, the system needs to conduct a joint relevance assessment of the recalled log fragments (facts) and graph nodes (rules); Given user query vector Vector path recall log vector Similarity is divided into Graph path recall node x relative anchor point The jump decay score is , This represents the anchor node mapped in the knowledge graph. The candidate set scoring function for dual-path fusion recall. Defined as: In the formula, and These are normalized weight coefficients; the former measures the cosine similarity of the vector space, while the latter measures the topological relevance of the graph. Represents a node The shortest path hop count to the query anchor point. As the jump penalty factor, Represents a node x eigenvectors.

[0029] Step 5, Semantic Reconstruction and Adaptive Pruning: Due to the heterogeneity and redundancy of the original data retrieved by dual-path retrieval, directly inputting it into a large model may lead to attention dispersion. To address this, this invention designs a set of graph-text semantic reconstruction operators, aiming to compress loose data into a high-density, linearized representation.

[0030] For entity data in the graph, the system uses an entity description compression operator to remove redundant JSON syntax tags, retaining only the entity name, type, and core description. For relational data, a relational path linearization operator is applied to transform discrete triples into text links with logical direction. After reconstruction, the system uses an adaptive pruning algorithm for dynamic trimming, retaining only the core logical links, thus providing concise background knowledge for subsequent large-scale model inference.

[0031] The adaptive pruning algorithm was introduced to address the technical problem of context overflow or attention diversion in large models caused by data heterogeneity and redundancy after merging dual-path retrieval. Specifically, it includes: Step 1: The system concatenates the log text set retrieved and denoised by vector path with the standard rule sequence retrieved and linearized by graph path to form the initial global context. Then, the system calculates the total token length of this global context. If the total token length exceeds a preset large model safety window threshold, the system automatically triggers an adaptive pruning procedure.

[0032] The second step: Based on the closeness of the relevance between the search content and the user's original query intent, the system quantifies the text fragments in the context and assigns them different retention priority scores. (For example, it prunes edge tail description nodes in the graph that are more than two hops away from the core node, as well as general background knowledge or long text protocol descriptions). Step 3: The system sorts all text fragments to be processed in descending order according to their corresponding priority scores. Then, using a greedy strategy, it performs physical removal sequentially, starting with the text fragment with the lowest priority score, until the context length meets the preset standard.

[0033] Step 6, Large Model Thinking Chain Reasoning: After obtaining a high-density reconstructed context, the system enters the reasoning and judgment stage. To reduce logical jumps or illusions that may occur in complex security judgments by large language models, this invention constructs a dedicated thinking chain guidance mechanism. The system forces the model to explicitly display intermediate reasoning steps before generating the final judgment by injecting system instructions from a security expert role into the prompt word template.

[0034] This invention also discloses a vehicle network security audit system based on feature decoupling and dual-path hybrid retrieval, comprising: Startup unit: Receives the user's natural language auditing request; Query parsing and semantic routing unit: Design a feature decoupling mechanism, use a hybrid feature extractor to parse the query statement, extract hard features from the parsing results through a regular expression engine, and extract soft features from the parsing results through semantic classification; Dual-path parallel retrieval strategy unit: adopts a dual-path parallel retrieval strategy of vector retrieval path and graph retrieval path; the vector retrieval path uses extracted hard features to match in the underlying fact base to form the fact context of auditing, and the graph retrieval path uses entity linking technology to recall and query relevant knowledge with entity nodes as the center to form the rule context of auditing. Joint Relevance Assessment Unit: Used to jointly assess the relevance between the factual context formed by the vector retrieval path and the rule context formed by the graph retrieval path; Semantic Reconstruction and Adaptive Pruning Unit: Through the designed graph-text semantic reconstruction operator, the JSON topology is converted into a linear sequence of natural language, and a priority-based adaptive pruning algorithm is used for dynamic pruning, retaining only the core logical links; Large Model Thinking Chain Reasoning Unit: Injects system instructions and required reasoning templates for security expert roles into the prompt word templates, guiding the large model to perform step-by-step logical judgments according to the reasoning templates, and generating a structured security audit response report containing the reasoning chain.

[0035] The correlation joint evaluation unit is configured as follows: Based on user query vectors Vector path recall log vector Similarity score Graph path recall node x relative anchor point Jump decay score , This represents the anchor node mapped in the knowledge graph, and constructs a candidate set scoring function for dual-path fusion recall. : In the formula, and These are the normalized weighting coefficients. Measure the cosine similarity of vector spaces. Measuring topological relevance of a map; Represents a node The shortest path hop count to the query anchor point. As the jump penalty factor, Represents a node x eigenvectors.

[0036] The semantic reconstruction and adaptive pruning unit also includes: The graph semantic reconstruction operator module: For entity data in the graph, it uses an entity description compression operator to remove redundant JSON syntax tags and retain only the entity name, type and core description; for relational data, it applies a relational path linearization operator to transform discrete triples into text links with logical direction.

[0037] The semantic reconstruction and adaptive pruning unit also includes a module for dynamic pruning using a priority-based adaptive pruning algorithm. This module performs the following steps: Step 1: Concatenate the log text set retrieved and denoised by vector path with the standard rule sequence retrieved and linearized by graph path to form the initial global context; then, calculate the total token length of the global context. If the total token length is greater than the preset large model safety window threshold, the adaptive pruning procedure will be automatically triggered. Step 2: Based on the degree of relevance between the search content and the user's original query intent, the text fragments in the context are quantified and assigned different retention priority scores; Step 3: Sort all text fragments to be processed in descending order according to their corresponding priority scores. Then, using a greedy strategy, start with the text fragment with the lowest priority score and perform physical removal in sequence until the context length meets the preset standard.

[0038] The present invention also discloses a computer-readable storage medium storing a computer program configured to implement the steps of the method described in the present invention when invoked by a processor.

[0039] Key points of this invention: 1. This invention protects a feature-decoupled "vector-graph" dual-path hybrid retrieval and routing architecture. Upon receiving a natural language audit request, the system separates hard and soft features using a built-in feature decoupler. Subsequently, the system uses hard features for recall in the fact base and soft features for recall in the rule base, achieving separate acquisition of underlying facts and rules. The difference between this invention and existing technologies lies in the improved retrieval efficiency of "facts" and "rules" in complex security audit queries through a precise routing mechanism based on query feature decoupling.

[0040] 2. This invention protects a graph semantic reconstruction and adaptive pruning method for large model context windows. The system reconstructs complex graph data into a high-density sequence through entity description compression and relation path linearization operators. Based on the reconstruction, the system dynamically truncates redundant data. The difference between this invention and existing technologies lies in the introduction of graph-text reconstruction operators and a priority-based dynamic pruning strategy to improve the effectiveness of contextual information.

[0041] 3. This invention protects a guided reasoning mechanism for vehicle-to-everything (V2X) compliance auditing based on a domain-specific thought chain. During the generation phase, the system optimizes the judgment logic of the large model by injecting security expert role instructions into the prompt word template. The difference between this invention and existing technologies lies in the introduction of a thought chain from the field of V2X security auditing to optimize the rigor and traceability of the large model's output report.

[0042] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A vehicular internet of things security auditing method based on feature decoupling and two-path hybrid retrieval, characterized in that, include: Step 1, Startup Phase: Receive users' natural language auditing requests; Step 2, Query parsing and semantic routing: Design a feature decoupling mechanism, use a hybrid feature extractor to parse the query statement, extract hard features from the parsing results through a regular expression engine, and extract soft features from the parsing results through semantic classification; Step 3, Dual-path parallel hybrid retrieval: A dual-path parallel retrieval strategy of vector retrieval path and graph retrieval path is adopted; the vector retrieval path uses the extracted hard features to match in the underlying fact base to form the fact context of the audit, and the graph retrieval path uses entity linking technology to recall and query relevant knowledge with entity nodes as the center to form the rule context of the audit. Step 4, Joint Relevance Assessment: Jointly assess the relevance between the factual context formed by the vector retrieval path and the rule context formed by the graph retrieval path; Step 5, Semantic Reconstruction and Adaptive Pruning: Design a graph-text semantic reconstruction operator to convert the JSON topology into a natural language linear sequence, and use a priority-based adaptive pruning algorithm to dynamically prune, retaining only the core logical links; Step 6, Large Model Thinking Chain Reasoning: Inject the system instructions and required reasoning templates of the security expert role into the prompt word template, guide the large model to perform step-by-step logical judgments according to the reasoning template, and generate a structured security audit response report containing the reasoning chain. 2.The method of claim 1, wherein, Step 4 also includes: Given user query vector , vector path recall log vector , similarity score of , atlas path recall node x , relative anchor point , hop decay score of , , anchor point node mapped by query in knowledge graph, candidate set score function of double path fusion recall is defined as: wherein, and is a normalized weight coefficient, measures vector space cosine similarity, measures graph topology correlation; denotes a node the shortest path hop count to the query anchor point, is a hop penalty factor, denotes a node x the feature vector of the node 3.The method of claim 1, wherein, In step 5, the graph-text semantic reconstruction operator includes the following steps: For entity data in the graph, an entity description compression operator is used to remove redundant JSON syntax tags, retaining only the entity name, type, and core description. For relational data, a relational path linearization operator is applied to transform discrete triples into text links with logical direction. 4.The method of claim 3, wherein, In step 5, the priority-based adaptive pruning algorithm for dynamic pruning includes the following steps: Step 1: The log text set retrieved and denoised by vector path is concatenated with the standard rule sequence retrieved and linearized by graph path to form the initial global context; then, the total token length of the global context is calculated. If the total token length is greater than the preset large model safety window threshold, the adaptive pruning procedure is automatically triggered. Step 2: Based on the degree of relevance between the search content and the user's original query intent, the text fragments in the context are quantified and assigned different retention priority scores; Step 3: Sort all text fragments to be processed in descending order according to their corresponding priority scores. Then, using a greedy strategy, start with the text fragment with the lowest priority score and perform physical removal in sequence until the context length meets the preset standard.

5. An Internet of Vehicles security auditing system based on feature decoupling and two-way hybrid retrieval, characterized in that, include: Startup unit: Receives the user's natural language auditing request; Query parsing and semantic routing unit: Design a feature decoupling mechanism, use a hybrid feature extractor to parse the query statement, extract hard features from the parsing results through a regular expression engine, and extract soft features from the parsing results through semantic classification; Dual-path parallel retrieval strategy unit: adopts a dual-path parallel retrieval strategy of vector retrieval path and graph retrieval path; the vector retrieval path uses extracted hard features to match in the underlying fact base to form the fact context of auditing, and the graph retrieval path uses entity linking technology to recall and query relevant knowledge with entity nodes as the center to form the rule context of auditing. Joint Relevance Assessment Unit: Used to jointly assess the relevance between the factual context formed by the vector retrieval path and the rule context formed by the graph retrieval path; Semantic Reconstruction and Adaptive Pruning Unit: Through the designed graph-text semantic reconstruction operator, the JSON topology is converted into a linear sequence of natural language, and a priority-based adaptive pruning algorithm is used for dynamic pruning, retaining only the core logical links; Large Model Thinking Chain Reasoning Unit: Injects system instructions and required reasoning templates for security expert roles into the prompt word templates, guiding the large model to perform step-by-step logical judgments according to the reasoning templates, and generating a structured security audit response report containing the reasoning chain. 6.The system according to claim 5, wherein, The correlation joint evaluation unit is configured as follows: Based on user query vector , vector path recall log vector , similarity score , atlas path recall node x , relative anchor point , hop attenuation score , The anchor point node to which the query is mapped in the knowledge graph is represented, and a candidate set score function of double-path fusion recall is constructed : wherein, and is a normalized weight coefficient, measures vector space cosine similarity, measures graph topology correlation; denotes a node the shortest path hop count to the query anchor point, is a hop penalty factor, denotes a node x the feature vector of the node.

7. The vehicle network security audit system according to claim 5, characterized in that, The semantic reconstruction and adaptive pruning unit also includes: The graph semantic reconstruction operator module: For entity data in the graph, it uses an entity description compression operator to remove redundant JSON syntax tags and retain only the entity name, type and core description; for relational data, it applies a relational path linearization operator to transform discrete triples into text links with logical direction.

8. The vehicle network security audit system according to claim 7, characterized in that, The semantic reconstruction and adaptive pruning unit also includes a module for dynamic pruning using a priority-based adaptive pruning algorithm. This module performs the following steps: Step 1: Concatenate the log text set retrieved by vector path and denoised with the standard rule sequence retrieved by graph path and linearized reconstruction to form the initial global context; Then, the total token length of the global context is calculated. If the total token length is greater than the preset large model safety window threshold, the adaptive pruning procedure is automatically triggered. Step 2: Based on the degree of relevance between the search content and the user's original query intent, the text fragments in the context are quantified and assigned different retention priority scores; Step 3: Sort all text fragments to be processed in descending order according to their corresponding priority scores. Then, using a greedy strategy, start with the text fragment with the lowest priority score and perform physical removal in sequence until the context length meets the preset standard.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program configured to implement the steps of the method according to any one of claims 1-4 when invoked by a processor.

Images