Automatic decision-making system and method for information asset large model

Abstract

The invention discloses an automatic decision-making system and method for an information asset large model, and belongs to the technical field of information asset management. The method comprises the following steps: acquiring multi-modal information asset data corresponding to information assets, and inputting the multi-modal information asset data into a preset information asset large model to obtain a prediction label of the information assets; the communication frequency, the operation state and the dynamic log of the information assets are obtained in real time and input into a preset information asset large model according to the communication frequency, the operation state and the dynamic log, and whether information asset updating needs to be carried out or not is determined; and if so, re-outputting the prediction label of the information asset according to the communication frequency, the operation state and the dynamic log through a preset information asset large model. According to the scheme, the multi-modal information and the dynamic state are combined, the current state of the information asset can be comprehensively analyzed, the label can be automatically re-evaluated when the dynamic change is detected, the manual inspection frequency and workload are reduced, and the operation and maintenance cost is reduced.

Description

Technical Field

[0001] The present application belongs to the field of information asset management, and specifically relates to an information asset large model automated decision-making system and method. Background Art

[0002] With the rapid development of information technology, the number and complexity of information assets that enterprises and organizations rely on are growing. These information assets, including but not limited to data, software, hardware and related services, constitute the core foundation of enterprise operations and business decisions.

[0003] Traditional information asset management mainly relies on manual monitoring and manual decision-making. Asset identification, classification, status monitoring, use approval and disposal all require manual participation. Managers need to manually count assets, register information, monitor asset status through regular inspections, and make decisions on maintenance, updates or disposal based on this information.

[0004] However, human judgment is dominant, which leads to limited management efficiency and is prone to errors. As the scale and complexity of information assets grow, traditional methods can no longer meet the needs of efficient and accurate management. Summary of the invention

[0005] This application belongs to the field of information asset management, and specifically relates to an information asset large model automated decision-making system, which solves the problem that the existing technology of manual information asset management leads to limited management efficiency and is prone to errors. With the growth of information asset scale and the increase of complexity, traditional methods have been unable to meet the needs of efficient and accurate management.

[0006] In a first aspect, an embodiment of the present application provides an information asset large model automated decision-making system, the system comprising: A classification module, used to obtain multimodal information asset data corresponding to information assets, input the multimodal information asset data into a preset information asset macro model, obtain a predicted label of the information asset, and update the predicted label to the information asset list; wherein the multimodal information asset data includes information asset descriptions, information asset logs, and information asset images; An update confirmation module is used to obtain the communication frequency, operation status and dynamic log of the information asset in real time if the tag classification error information transmitted by the control center is not received, and input the communication frequency, operation status and dynamic log into the preset information asset macro model to determine whether the information asset needs to be updated; The update module is used to re-output the prediction label of the information asset according to the communication frequency, operation status and dynamic log through the preset information asset big model if the information asset needs to be updated, and update the prediction label to the information asset list.

[0007] In a second aspect, an embodiment of the present application provides an information asset large model automated decision-making method, characterized in that the method includes: Obtain multimodal information asset data corresponding to the information asset, input the multimodal information asset data into a preset information asset macro model, obtain a predicted label of the information asset, and update the predicted label to the information asset list; wherein the multimodal information asset data includes an information asset description, an information asset log, and an information asset picture; If the label classification error information transmitted by the control center is not received, the communication frequency, operation status and dynamic log of the information asset are obtained in real time, and the communication frequency, operation status and dynamic log are input into the preset information asset macro model to determine whether the information asset needs to be updated; If it is necessary to update the information asset, the prediction label of the information asset is re-output according to the communication frequency, operation status and dynamic log through the preset information asset macro model, and the prediction label is updated to the information asset list.

[0008] In an embodiment of the present application, the multimodal information asset data corresponding to the information asset is obtained, the multimodal information asset data is input into the preset information asset big model, the prediction label of the information asset is obtained, and the prediction label is updated to the information asset list; wherein, the multimodal information asset data includes information asset description, information asset log and information asset picture; if the label classification error information transmitted by the control center is not received, the communication frequency, operation status and dynamic log of the information asset are obtained in real time, and the communication frequency, operation status and dynamic log are input into the preset information asset big model to determine whether the information asset needs to be updated; if the information asset needs to be updated, the prediction label of the information asset is re-output according to the communication frequency, operation status and dynamic log through the preset information asset big model, and the prediction label is updated to the information asset list. Through the above-mentioned information asset big model automated decision-making system, by combining multimodal information and dynamic status, the model can comprehensively analyze the current status of the information asset, and the system can automatically re-evaluate the label when dynamic changes are detected, reducing the frequency and workload of manual inspections, and reducing operation and maintenance costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 It is a structural diagram of the information asset large model automated decision-making system provided in Example 1 of the present application; Figure 2 It is a structural diagram of the information asset large model automated decision-making system provided in Example 2 of the present application; Figure 3 It is a structural diagram of the information asset large model automated decision-making system provided in Example 3 of the present application; Figure 4 It is a flow chart of the information asset big model automated decision-making method provided in Example 4 of the present application. DETAILED DESCRIPTION

[0010] In order to make the purpose, technical scheme and advantages of the present application clearer, the specific embodiments of the present application are further described in detail below in conjunction with the accompanying drawings. It is understood that the specific embodiments described herein are only used to explain the present application, rather than to limit the present application. It should also be noted that, for the convenience of description, only part of the present application is shown in the accompanying drawings, but not all of the content. Before discussing the exemplary embodiments in more detail, it should be mentioned that some exemplary embodiments are described as processes or methods depicted as flow charts. Although the flow chart describes each operation (or step) as a sequential process, many of the operations therein can be implemented in parallel, concurrently or simultaneously. In addition, the order of the operations can be rearranged. The process can be terminated when its operation is completed, but it can also have additional steps not included in the accompanying drawings. The process can correspond to a method, a function, a procedure, a subroutine, a subprogram, etc.

[0011] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of this application.

[0012] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0013] The information asset big model automated decision system provided by the embodiment of the present application is described in detail below through specific embodiments and their application scenarios in conjunction with the accompanying drawings.

[0014] Embodiment 1 Figure 1 This is a schematic diagram of the structure of the information asset large model automated decision-making system provided in Example 1 of the present application. The system includes: The classification module 101 is used to obtain multimodal information asset data corresponding to the information asset, input the multimodal information asset data into a preset information asset macro model, obtain a predicted label of the information asset, and update the predicted label to the information asset list; wherein the multimodal information asset data includes an information asset description, an information asset log, and an information asset picture; The update confirmation module 102 is used to obtain the communication frequency, operation status and dynamic log of the information asset in real time if the tag classification error information transmitted by the control center is not received, and input the communication frequency, operation status and dynamic log into the preset information asset macro model to determine whether the information asset needs to be updated; The updating module 103 is used to re-output the prediction label of the information asset according to the communication frequency, operation status and dynamic log through the preset information asset macro model if the information asset needs to be updated, and update the prediction label to the information asset list.

[0015] First, the usage scenario of this solution can be to predict the labels of information assets through the information asset big model, and determine in real time whether they need to be updated, and update the labels if they need to be updated.

[0016] Based on the above usage scenarios, it can be understood that the executor of this application can be the information asset large model automated decision-making system, and no excessive limitations are made here.

[0017] In this solution, information assets can be resources with data value or functional value in an enterprise or system, such as databases, servers, virtual machines, applications, network equipment, hosts, databases, etc., which are mainly used to support business operations and decision-making.

[0018] Multimodal data can refer to heterogeneous data from multiple sources or in multiple forms. Specifically, information asset descriptions can be text information, such as asset name, attributes, purpose, deployment location, responsible person, etc. Information asset logs can be time series records, including asset operation logs, error logs, access records, etc. Information asset images can be visual data, such as asset appearance pictures, hardware device screenshots, monitoring screens, etc.

[0019] The preset information asset big model can be a multi-task deep learning model for multiple tasks such as classification, behavior prediction, resource allocation, scoring and optimization suggestions. The model consists of the following branches: Classification branch: classify multimodal data and generate prediction labels. Resource allocation branch: generate resource allocation suggestions based on performance and demand. Behavior prediction branch: detect asset behavior (normal or abnormal) and predict trends. Scoring branch: evaluate asset health status and generate optimization suggestions.

[0020] It should be noted that in order to make full use of the complementary information of multimodal data and achieve more accurate classification and prediction, we designed a multimodal collaborative feature fusion method based on the attention mechanism: Exemplarily, the information asset set is set to …, , for each information asset , we obtain its multimodal data: text description , log data , image data Feature extraction for each modal data: Text features: ,;Log features: ; Image features: ,in, They are feature extraction functions for text, logs, and images, respectively. Usually, pre-trained deep learning models such as BERT, LSTM, ResNet, sequence models, etc. can be used.

[0021] The fusion method based on the attention mechanism is used to collaboratively fuse the features of different modalities to obtain : in: , , It is a trainable weight matrix. The weight matrix learned during the training process is used to perform linear transformation on the features of different modalities.

[0022] is the self-attention function, defined as: in, = Represents features extracted from text description data. = Represents the features extracted from log data. = Represents the features extracted from image data.

[0023] Attention Weight , reflecting the importance of mode j, is calculated as follows: in: , , are trainable parameters, Represents the transpose of parameter u. is the activation function. More specifically, is a trainable weight matrix used to adjust the input features ( , , ) to perform linear transformation; is a bias vector used to adjust the output of the linear transformation; is a vector used to calculate the attention weights from the activation values. These parameters together determine the weight of each modality feature , thus reflecting the importance of this modality feature to the final fusion representation.

[0024] in , , It is a trainable parameter and is optimized by the backpropagation algorithm during the training process of the model. Specifically, first, the model calculates the loss function (for example, the cross entropy loss in the classification task) through forward propagation.

[0025] Then, the gradient of the loss function to the parameters V, u, and b is calculated through back propagation. Finally, an optimization algorithm (such as gradient descent, Adam, etc.) is used to update these parameters according to the gradient so that the loss of the model gradually decreases.

[0026] During training, the input data is the features of multimodal data (text features , Log Features , picture features ), these features are extracted by pre-trained models (such as BERT, ResNet, etc.). The model continuously adjusts V, u and b to learn parameters that can better integrate these modal features, thereby improving the discriminability and richness of the overall feature representation. During the training process, these parameters are dynamically adjusted according to the characteristics of the input data and the loss function of the target task, and finally learn the weights and biases that can optimally integrate multimodal features.

[0027] The self-attention mechanism is used to perform weighted fusion of multimodal features (text features, log features, and image features). The importance of different modal features is expressed through attention weights. Dynamic calculation, the generation of weights depends on a trainable network, including weight matrix V, bias vector b and attention vector u. The weighted summation formula of the attention mechanism is used to fuse different modal features according to their importance to generate a comprehensive feature representation. This collaborative fusion method can capture the complementarity of multimodal information in the same feature space, making the fused features not only more comprehensive but also more discriminative.

[0028] In dealing with information asset collection Multimodal data (text description , log data , Image data ), the collaborative feature fusion method based on the attention mechanism can capture the complementary relationship of different modal features by dynamically adjusting the importance weights of modal features. In this way, the model can not only comprehensively utilize the key information of text, logs and pictures, but also adaptively improve the richness of feature representation (comprehensive integration of multimodal information) and discriminability (accurate representation of information assets), thereby more effectively supporting the implementation of downstream tasks. In order to solve the problem that different modal data (text, logs, pictures) often have independent information expression capabilities, but a single modality may not be able to fully express the full picture of information assets. Text descriptions may contain key semantic information, while the contribution of image data is relatively small; in other scenarios, pictures may contain richer visual features. The model uses attention weights ( ) calculation, flexibly capturing these differences, and ensuring that the importance of each modal feature in the fusion process matches its actual contribution.

[0029] This fusion method can dynamically adjust the weights according to the importance of each modal feature, achieve collaborative fusion, and improve the richness and discriminability of feature representation.

[0030] In addition, through the collaborative feature fusion method based on the attention mechanism, the model can adaptively capture the importance of features of different modalities, achieve information complementarity, and improve the discriminability and richness of feature representation.

[0031] The prediction label can be a classification or prediction result of the large model for the information asset and the corresponding description. Specifically, it can be an asset category and the corresponding description, for example, core router (normal).

[0032] The information asset list can be a unified record of all information assets in the system, including descriptions, logs, pictures, performance indicators, etc. of each information asset. The list will be updated dynamically to maintain real-time performance.

[0033] Information asset descriptions, operation logs, and images can be collected in real time, and then multimodal data can be preprocessed. Specifically, text data (information asset descriptions, logs): use natural language processing tools (such as BERT, TF-IDF) to convert text into semantic vectors. Image data (information asset images): use convolutional neural networks (such as ResNet, EfficientNet) to extract image features. Time series data (log timestamps): use time series models (such as LSTM, Transformer) to extract dynamic features. Then input data in modalities such as text, images, and time series into the preset multimodal large model. The model integrates data into a unified feature vector through a multimodal feature fusion module (such as the Attention mechanism). Then the classification branch outputs the predicted label of the information asset, such as: asset type (such as "network equipment (normal)", "database server (high risk)").

[0034] The control center can be a main control platform for centralized management and monitoring of information assets. It is responsible for collecting, storing, and analyzing the operation data and status information of all information assets. It also verifies the classification results of the information asset model to determine whether there are classification errors in the model, and generates label classification error information to transmit to the model update module.

[0035] The label classification error information may refer to feedback information sent when the model classification result detected by the control center does not match the actual situation. If no error information is received, it is considered that the current classification result is accurate and the current model can continue to be used.

[0036] Communication frequency can be the frequency of communication between information assets and other systems or devices, such as the number of network requests per second or the data transmission rate.

[0037] The operating status can be the current working status of the information asset (such as normal, idle, abnormal, etc.), including hardware performance and software operating status.

[0038] Dynamic logs can be real-time log data generated by information assets, recording events, operations, warnings, and exception information.

[0039] It can detect whether there is any label classification error information from the control center. If no classification error information is received, proceed to the next step; otherwise, trigger the model update or retraining process according to the error information. Monitor the communication rate or request number of information assets through the network interface. Obtain real-time status (such as CPU usage, memory usage) through the built-in status monitoring component. Extract real-time recorded event data from the log generation module. Then format and normalize the collected data: clean invalid data (such as missing values ​​or duplicate data). Convert the communication frequency, operation status and dynamic logs into feature vectors that can be recognized by the model. Input the processed data into the preset information asset large model. The large model predicts whether the information asset needs to be updated through modules such as static classification branches and dynamic classification branches. Determine whether the classification label or other information of the information asset needs to be updated based on the model prediction results: If the model prediction results show that an update is required, the dynamic classification branch evaluates the input data based on the feature mapping relationship during model training. The model gives the latest dynamic classification label based on dynamic data. For example, the original predicted label is edge router (normal), and then the following real-time data is collected from the router: Communication frequency: Current number of data packets sent per minute: 2800 times. Average frequency in the past 10 minutes: 2500 times. Operating status: CPU utilization: 85% (higher than the safety threshold of 70%). Memory usage: 90%. Temperature: 75°C (close to the warning value of 80°C). Dynamic log: "The router has reached the bandwidth limit, and some traffic is limited", "Port 3 connection is abnormal, try to reconnect", and then input the above data into the dynamic classification branch of the information asset model. Model processing: Compare the fluctuation of the current communication frequency and the historical communication characteristics. Analyze the distribution difference between the operating status data and the historical normal / abnormal status. Use NLP technology to parse the abnormal events described in the dynamic log. Model output: The predicted label is "Edge Router (Abnormal)". The label in the last updated information asset list is "Edge Router (Abnormal)".

[0040] It should be noted that we have designed a dynamic update mechanism for the real-time communication frequency, operation status and dynamic logs, so that the model can adaptively adjust the prediction results according to the new data.

[0041] Specifically, a gated recurrent unit (GRU) is introduced to process time series data: Based on the real-time communication frequency, operation status and dynamic logs, we designed a dynamic update mechanism to enable the model to adaptively adjust the prediction results based on new data.

[0042] Specifically, a gated recurrent unit (GRU) is introduced to process time series data: in: : At time The dynamic state representation reflects the state characteristics of the information asset at the current moment. It is processed by GRU to process the dynamic state of the previous moment. and the current input features generated; : At time The input features (communication frequency, reflecting the communication activity and operation status of information assets with the outside world, describing the current operation status of information assets, the characteristics of dynamic logs, and recording the real-time behavior logs of information assets); GRU: gated recurrent unit function; then, using the dynamic state representation Update the comprehensive features: in: is a comprehensive feature representation, is a static feature representation (obtained by multimodal collaborative feature fusion); : Trainable weight matrix; Finally, the updated comprehensive features are adopted Make predictions and get more accurate results.

[0043] By introducing the time series model (GRU), the model can adaptively adjust the prediction results according to the dynamic data obtained in real time, thereby improving the sensitivity and response speed to state changes.

[0044] In addition, through the combination of multimodal collaborative feature fusion and GRU time series modeling, the model can adaptively capture the complementarity of static modal features and the changing trends of time series dynamic features, ultimately achieving a comprehensive characterization of information assets and significantly improving the accuracy of predictions, sensitivity to state changes, and real-time response capabilities.

[0045] By combining multimodal static feature fusion based on attention mechanism with GRU dynamic feature modeling, the system has the following significant advantages: static features capture the multimodal basic attributes of information assets, dynamic features reflect real-time state changes, and the comprehensive feature representation generated by the combination of the two It has stronger expressive power and discrimination ability; the system realizes sensitive response to state changes through dynamic modeling, and can quickly update the prediction results when state changes are detected, ensuring the accuracy and timeliness of information asset labels; the dynamic and static combination method makes up for the shortcomings of a single feature and significantly improves the adaptability and robustness of the system in diversified scenarios. The dynamic and static combination of technical means gives full play to the advantages of multimodal data and time series data, and provides a comprehensive, efficient and intelligent solution for the large-scale automated decision-making system of information assets.

[0046] In the embodiment of the present application, the multimodal information asset data corresponding to the information asset is obtained, the multimodal information asset data is input into the preset information asset big model, the prediction label of the information asset is obtained, and the prediction label is updated to the information asset list; wherein, the multimodal information asset data includes information asset description, information asset log and information asset picture; if the label classification error information transmitted by the control center is not received, the communication frequency, operation status and dynamic log of the information asset are obtained in real time, and the communication frequency, operation status and dynamic log are input into the preset information asset big model to determine whether the information asset needs to be updated; if the information asset needs to be updated, the prediction label of the information asset is re-output according to the communication frequency, operation status and dynamic log through the preset information asset big model, and the prediction label is updated to the information asset list. Through the above-mentioned information asset big model automated decision-making system, by combining multimodal information and dynamic status, the model can comprehensively analyze the current status of the information asset, and the system can automatically re-evaluate the label when dynamic changes are detected, reducing the frequency and workload of manual inspections, and reducing operation and maintenance costs.

[0047] Based on the above technical solution, optionally, the system further includes an information asset update module, and the information asset update module is used to: Acquire network traffic data in the system in real time, and determine whether there are new information assets based on the network traffic data; If there are new information assets, the multimodal information asset data corresponding to the new information assets is obtained, the multimodal information asset data is input into the preset information asset macro model, the prediction label of the new information assets is obtained, and the prediction label is updated to the information asset list.

[0048] In this solution, network traffic data can refer to the information of various data streams transmitted in the network, specifically, it can include traffic rate: the number of bytes or packets transmitted per second. Source IP and destination IP: the IP addresses of the two communicating parties. Protocol type: such as TCP, UDP, HTTP, etc. Port number: source port and destination port, identifying the communication application. Traffic behavior pattern: such as sudden high-frequency requests, communication occupying a specific port for a long time, etc. Packet content characteristics: such as request header, packet size, timestamp, etc.

[0049] A newly added information asset may be a device, service, or application that is identified for the first time in the network and was not previously in the information asset inventory.

[0050] Traffic collection tools (such as Wireshark, NetFlow, sFlow) or dedicated network monitoring equipment can be used to capture network traffic in real time. Then filter and extract key feature data, including IP address, port number, protocol type, communication behavior, etc. Then compare the relevant device or service features in the captured traffic with the existing asset list to find unmatched traffic. Based on machine learning models or preset rules, it can be detected whether the traffic has the characteristics of new assets: continuous traffic patterns (such as devices that send requests regularly). Abnormal communication range (such as unregistered devices sending data to multiple known devices). If data traffic that meets the characteristics of new assets is found, it is marked as "suspected new information assets". Then perform a deep scan on the suspected new information assets: collect their metadata (device name, model, version). Collect their initial logs (such as startup time, system information). Capture device pictures or running interfaces (such as photos of physical connections or remote desktop screenshots). Organize the above data into standardized multimodal information asset data. The model integrates the data into a unified feature vector through a multimodal feature fusion module (such as the Attention mechanism). Then the classification branch outputs the predicted label of the information asset.

[0051] In this solution, the system can monitor network traffic in real time and identify new information assets, avoiding security risks or management blind spots caused by information lag. The system can automatically complete asset identification, classification and update without manual comparison and classification. It can improve the efficiency of information asset management and save a lot of time and energy for the IT operation and maintenance team.

[0052] On the basis of the above technical solution, optionally, the system further includes a resource allocation module, and the resource allocation module is used to: Update the information asset log of each information asset in the information asset list in real time, obtain the performance indicators and business requirements of each information asset in real time, input the information asset log, performance indicators and business requirements into the preset information asset macro model, and determine whether resource allocation is required; If resource allocation is required, a resource allocation suggestion is output through a preset information asset macro model, and the resource allocation suggestion is sent to a control center.

[0053] In this solution, performance indicators can be quantitative parameters that describe the operating status of information assets, including: Computing performance: CPU usage, memory occupancy, disk IO rate. Network performance: bandwidth utilization, packet loss rate, delay. Stability: failure rate, mean time between failures (MTBF). Power consumption indicators: real-time power consumption, energy utilization efficiency. Performance indicators reflect the current status and operating capabilities of the equipment and are an important basis for resource allocation decisions.

[0054] Business requirements can be the actual business scenarios and their requirements supported by information assets: Computing requirements: required processing power or number of threads (such as video encoding, data analysis). Storage requirements: data storage capacity or read and write speed (such as file services, databases). Network requirements: bandwidth, number of connections or traffic requirements (such as real-time communication, streaming media). Business requirements reflect the functional priorities and resource allocation goals of the system.

[0055] Resource allocation suggestions can be optimized allocation plans generated by the big model based on current performance indicators and business needs. Specifically, they can include resource allocation strategies: increase or decrease computing resources (such as allocating more CPU cores and memory). Load balancing optimization: adjust network traffic distribution or task scheduling. Storage optimization suggestions: expand storage space and clean up cache. Energy management solutions: reduce power consumption or enable energy-saving mode.

[0056] The system can collect real-time performance indicators of information assets through monitoring tools. Business requirements are obtained through the scheduling system or API (such as computing requirements triggered by high-load tasks). The collected information asset descriptions, logs, pictures, communication frequencies, dynamic logs, etc. are used as input, combined with performance indicators and business requirements, and input into the preset large model. Then the resource allocation branch generates optimization suggestions based on resource allocation history and business rules. Finally, the resource allocation suggestions output by the model are sent to the control center through API or message queue. The control center dynamically adjusts the resource allocation strategy based on the suggestions.

[0057] In this solution, by acquiring the performance indicators and business requirements of information assets in real time, the system can make accurate judgments on resource allocation needs and avoid over- or under-allocation of resources.

[0058] On the basis of the above technical solution, optionally, the system further includes a health status determination module, and the health status determination module is used to: Obtaining historical usage data, real-time status data, and performance degradation data of each information asset in the information asset list, inputting the historical usage data, real-time status data, and performance degradation data into a preset information asset macro model, and determining a health status score of each information asset; If there is an information asset whose health status score is lower than a preset health threshold, optimization suggestions for the information asset are output through a preset information asset macro model.

[0059] In this solution, historical usage data can be the usage of information assets in the past period of time. This data may include the operating time of the equipment, usage frequency, load conditions, operation history, etc. It reflects whether there is abnormal load or overuse of information assets during daily use.

[0060] Real-time status data can be the current status data of information assets. These data usually include the real-time health status of the equipment, operating parameters, system performance indicators, etc. These data can be obtained in real time through sensors or monitoring tools to reflect the real-time operating status of the equipment.

[0061] Performance degradation data can be the gradual decline in performance of information assets during long-term use due to factors such as natural aging, overuse, or environmental impact. These data are usually based on the historical performance records of the equipment, such as reduced processing speed, increased energy consumption, and increased failure rate.

[0062] The health status score may be a comprehensive score that measures the overall health level of an information asset, and is usually a numerical value that represents the current health status of the information asset.

[0063] The preset health threshold can be a benchmark value used to determine whether the health status of information assets meets the standard. Generally speaking, if the health status score is lower than this threshold, it means that the information asset may face the risk of failure or need maintenance or optimization. This threshold can be set based on industry standards, historical data analysis, or actual usage experience.

[0064] Optimization recommendations can be improvement measures for information assets with low health scores. The purpose of optimization recommendations is to help devices return to normal working conditions, extend their service life, or improve performance. Specifically, they can include hardware maintenance: such as cleaning, replacing worn parts, or adding additional cooling equipment. Software upgrades: such as updating firmware, operating systems, or related applications to improve performance or fix known vulnerabilities. Reconfiguration: For example, adjusting resource allocation, optimizing load balancing, or reducing invalid operations.

[0065] The historical usage records of information assets can be collected through databases, device management systems, sensors, or monitoring tools. For example, data can be extracted from the device's log system and operation and maintenance management system to understand the device's usage frequency, operating time, and other information. The current operating status of the information asset is obtained through a real-time monitoring system or sensor. This may include the device's real-time load, temperature, voltage, power consumption, fault alarms, etc. Collect long-term performance data of the device to evaluate the degradation of the device. This data can be obtained by comparing historical performance records, such as whether the device's processing power, efficiency, energy consumption, etc. have gradually decreased over time. The collected historical usage data, real-time status data, and performance degradation data are organized into an input format to ensure that the data is clean and complete. The organized data is input into the information asset big model. This model can be a machine learning model, a deep learning model, or a statistical analysis model, which calculates the health status score of each information asset according to a preset algorithm. The model will evaluate the health status of the information asset based on the input historical usage data, real-time status data, and performance degradation data. The trained big model is used to calculate the health status score of each information asset to determine whether it is below the preset health threshold. If the health status score is lower than the preset health threshold, the model will output specific optimization suggestions through preset rules or learning based on historical data. These suggestions will be customized according to the specific status of the device, and the suggestions may include hardware repairs, software updates, or configuration adjustments. These optimization suggestions will be passed to relevant personnel or systems so that necessary measures can be taken for optimization or maintenance to prevent equipment failure or further performance degradation.

[0066] In this solution, by real-time monitoring of the health status of information assets, potential problems can be discovered in time to avoid equipment failure or performance degradation. Assessments based on health status scores can provide data support to help decision makers understand the health status of equipment and make more scientific and reasonable decisions.

[0067] Based on the above technical solution, the optional, preset information asset large model training process includes: Constructing a large information asset model, obtaining historical multimodal information asset data and corresponding static classification labels, and training a static classification branch of the large information asset model according to the multimodal information asset data and the corresponding static classification labels; Acquire historical communication frequency, historical operation status, historical dynamic log and dynamic classification label of historical information assets, create a first data set according to the historical communication frequency, historical operation status and historical dynamic log, and train the dynamic classification branch of the information asset big model according to the first data set and the dynamic label; Acquire historical information asset logs, historical performance indicators, historical business requirements, and resource allocation of historical information assets, create a second data set based on the historical information asset logs, historical performance indicators, and historical business requirements, and annotate a resource allocation tag of the second data set based on the resource allocation; Acquire historical information asset logs, historical performance indicators, historical business requirements, and historical resource allocation suggestions for resource allocation, create a third data set based on the historical information asset logs, historical performance indicators, and historical business requirements for resource allocation, and annotate the third data set with an allocation suggestion tag based on the historical resource allocation suggestions; Training a resource allocation branch of the information asset big model according to the second data set, the corresponding resource allocation tag, the third data set, and the corresponding allocation suggestion tag; Acquire historical normal behaviors and historical abnormal behaviors of historical information assets, and acquire historical traffic data, historical information asset metadata, historical information asset logs, and historical trend information of historical normal behaviors, create a fourth data set based on the historical traffic data, historical information asset metadata, and historical information asset logs of historical normal behaviors, and annotate the fourth data set with a normal behavior label and a trend information label based on the historical normal behaviors and historical trend information; Acquire historical traffic data, historical information asset metadata, historical information asset logs, historical classification labels, and historical decision results of historical abnormal behaviors, create a fifth data set based on the historical traffic data, historical information asset metadata, and historical information asset logs of the historical abnormal behaviors, and annotate the abnormal behavior labels, classification labels, and decision result labels of the fifth data set based on the historical abnormal behaviors, historical classification labels, and historical abnormal decision results; The behavior prediction branch of the information asset large model is trained according to the fourth data set, the corresponding normal behavior label and the trend information label, the fifth data set, the corresponding abnormal behavior label, the classification label and the decision result label; Acquire historical usage data, historical status data, historical performance degradation data, and corresponding historical health status scores of historical information assets, create a sixth data set based on the historical usage data, historical status data, and historical performance degradation data, and annotate a health status score label of the sixth data set based on the historical health status score; Determine an abnormal health status score according to the historical health status score and a preset health threshold, obtain historical usage data, historical status data, historical performance degradation data, and historical optimization suggestions corresponding to the abnormal health status score, create a seventh data set according to the historical usage data, historical status data, and historical performance degradation data corresponding to the abnormal health status score, and annotate the seventh data set with an optimization suggestion tag according to the historical optimization suggestion; The scoring branch of the information asset big model is trained according to the sixth data set, the corresponding health status scoring label, the seventh data set and the corresponding optimization suggestion label.

[0068] In this solution, the historical multimodal information asset data may be data from a variety of sources or formats.

[0069] Static classification tags can represent fixed attribute classifications of information assets.

[0070] The static classification branch may be a static category branch of a predictive information asset, used to analyze fixed attributes of the asset.

[0071] The historical communication frequency may be the frequency of communication between the asset and other nodes.

[0072] Health status can be a history of whether an asset is operating normally.

[0073] Dynamic logs can be records of dynamic events, such as alarms and abnormal activities.

[0074] A dynamic category label may be a category label that reflects a dynamic attribute.

[0075] The first data set may include dynamic data (communication frequency, operating status, dynamic log) and its corresponding dynamic classification labels, which are used to train the dynamic classification branch.

[0076] The dynamic classification branch can be used to predict the dynamic classification of information assets.

[0077] Historical information assets can be usage records and metadata during the asset life cycle.

[0078] Historical information asset logs can be detailed records of events, errors, or actions.

[0079] Historical performance indicators can be CPU, memory, network latency, etc.

[0080] Historical business requirements can be demands or dependencies on resources.

[0081] The historical resource allocation situation may be the actual allocated resource quantity and configuration.

[0082] The second data set may include logs, performance indicators, business requirements, and corresponding resource allocation tags.

[0083] The resource allocation tag may be a tag indicating a resource allocation situation.

[0084] The third data set may be data focused on historical resource allocation recommendations for improving allocation strategies.

[0085] The allocation suggestion tag may be a recommended resource allocation operation plan.

[0086] The resource allocation branch can be used to predict the optimal resource allocation strategy.

[0087] Historical normal behavior can be a running record without abnormal situations.

[0088] Historical abnormal behaviors can be abnormal events such as traffic surges and operation interruptions.

[0089] Historical traffic data can be the network communication traffic of an asset.

[0090] Historical information asset metadata can be asset attributes (such as type, location).

[0091] Historical information asset logs can be detailed records of abnormal behavior.

[0092] Historical trend information can be a trend of changes in behavior or performance.

[0093] The fourth data set may be a combination of normal behavior and related data for training a behavior prediction model.

[0094] The normal behavior label may be a label used to mark the fourth data set, describing whether the asset is normal.

[0095] The trend information tag may be a tag used to mark the fourth data set and describe the asset change trend.

[0096] The fifth data set may include relevant data and labels of abnormal behaviors for use in anomaly detection.

[0097] Abnormal behavior labels can mark whether it is abnormal.

[0098] Classification labels can mark abnormal categories.

[0099] Decision result labels can mark the processing results taken on abnormal behaviors.

[0100] The behavior prediction branch can be used to predict asset behavior and classify abnormal situations.

[0101] Historical usage data can be the frequency and duration of resource usage.

[0102] The historical status data may be the equipment operation status (normal / faulty).

[0103] Historical performance degradation data can be a trend of performance degradation.

[0104] The historical health score can be a score of the health of an asset, usually a numerical value based on a combination of indicators (such as performance, failure rate).

[0105] The sixth data set may include health status related data and scoring labels.

[0106] The health status score tag can describe the score of the asset's health status.

[0107] An abnormal health status score may be when the health score is below a threshold.

[0108] Historical optimization recommendations can be improvement measures provided in response to abnormal health scores.

[0109] The seventh data set may include abnormal health status and its corresponding optimization suggestions.

[0110] The optimization suggestion label can describe the specific optimization plan.

[0111] The scoring branch can be used to predict the health score and output optimization suggestions.

[0112] Multimodal data can be obtained from the asset management system. Each data set is generated based on historical records. Then, labels are generated. Specifically, static classification and dynamic classification can include asset type and importance level. Resource allocation can include allocation labels and recommendation labels. Behavior prediction can include normal / abnormal behavior labels. Health scores can include scoring labels and optimization suggestions. Then, six main data sets are constructed, corresponding to static classification, dynamic classification, resource allocation, behavior prediction and health scoring. Use the above data sets to train the static classification branch, dynamic classification branch, resource allocation branch, behavior prediction branch and scoring branch respectively. Finally, verify the performance indicators of each branch, adjust the model parameters, and improve the prediction accuracy.

[0113] In this solution, the big model significantly improves the efficiency, accuracy and security of information asset management through intelligence, real-time and multi-branch collaboration, bringing higher resource utilization and lower operating costs to the organization.

[0114] Embodiment 2 Figure 2 This is a schematic diagram of the structure of the information asset large model automated decision-making system provided in Example 2 of this application. Figure 2 As shown, specifically including the following: The system further includes an abnormality determination module 104, wherein the abnormality determination module 104 is used to: Acquire the flow data and information asset metadata of each information asset in the information asset list in real time, and acquire the external threat database, input the flow data, information asset metadata, information asset log and external threat database into the preset information asset macro model, and determine whether each information asset has abnormal behavior; If there are information assets with abnormal behavior, the prediction label of the information asset is re-output through the preset information asset big model, and the decision result on the abnormal behavior is output.

[0115] In this embodiment, traffic data may refer to the communication data characteristics of each information asset in the network, such as: the number, size, and flow direction of data packets. Communication frequency, protocol type (such as HTTP, TCP / IP). Performance indicators such as network delay and throughput. It is used to analyze the interaction mode between information assets and the external environment or internal assets.

[0116] Information asset metadata can be static attributes and identification information that describe information assets, including: asset type (such as server, device, application). Asset ID, IP address, MAC address. Configuration attributes (such as operating system, version information). Used to model asset characteristics and provide a basis for static classification.

[0117] External threat databases can be data sets containing known security threats and attack patterns, usually maintained by security vendors or organizations, including: malicious IP lists, known attack features, vulnerability libraries (such as CVE databases), threat intelligence (such as APT attack methods, phishing website domain names), and external risk factors used to compare and identify abnormal behaviors.

[0118] Abnormal behavior can refer to the deviation of the operation or communication mode of information assets from the normal range, including: sudden increase in data traffic or abnormal protocol usage. Unauthorized access attempts, high or low communication frequency. Communication with external malicious IP or domain names. Through large model detection, it is determined whether there is a deviation from historical behavior or expected patterns.

[0119] The decision result can be a processing suggestion or operation output for the detected abnormal behavior, including: whether to isolate abnormal assets, whether to update security policies, and specific protective measures (such as blocking traffic, triggering alarms, and performing patch updates).

[0120] Network monitoring tools (such as NetFlow, sFlow) can be used to collect communication flow data of information assets in real time. The data processing module extracts key features (such as packet size, flow direction, communication frequency, etc.). Synchronize asset metadata from information asset management systems (such as CMDB). Dynamically update newly added asset information (such as IP address, operating system version). Pull updates from threat intelligence providers (such as VirusTotal, AlienVault) in real time. Includes the latest vulnerabilities, malicious IP addresses and domain names. Use flow data, information asset metadata, information asset logs and external threat databases as multimodal inputs. The large model analyzes multi-dimensional information and combines historical behavior data to determine whether there is abnormal behavior. Specifically, the large model can classify input data through the behavior prediction branch and mark whether the asset is abnormal. For abnormal information assets, the dynamic classification branch of the large model re-outputs the prediction label. Update the classification information of the asset in the information asset list. Finally, the behavior prediction branch of the large model outputs processing suggestions based on historical decision results.

[0121] In this embodiment, by acquiring traffic data, metadata, logs and external threat information in real time, it is possible to quickly detect and identify abnormal behavior of information assets and prevent potential security threats from expanding. Combined with the input of the external threat database, it is possible to more comprehensively evaluate and match abnormal behavior and identify known and unknown security risks.

[0122] On the basis of the above technical solution, optionally, the system further includes a trend prediction module, and the trend prediction module is used to: If there is no abnormal behavior, the trend prediction information is output through the preset information asset big model, and the trend prediction information is sent to the control center.

[0123] In this solution, trend prediction information can be the result of predicting the future status and behavior trends of information assets based on historical and real-time data combined with machine learning models. Specifically, it can include performance trends: predicting performance changes of information assets, such as bandwidth utilization, processing power, storage capacity changes, etc. Health status trends: predicting whether the health score of information assets has a downward trend or may be close to a threshold. Security threat trends: predicting the increase or decrease trend of potential risks based on the dynamic changes of the external threat database. Usage demand trends: predicting resource allocation that may need to be adjusted in the future, such as traffic peak time, workload changes, etc. Behavior change trends: predicting whether information assets will have possible abnormalities or functional deviations after a period of time.

[0124] If the prediction branch determines that there is no abnormal behavior, it can analyze real-time data and historical data to predict the future operating status and change trends of information assets: Performance trend: resource utilization, load changes. Health trend: health score changes. Business demand trend: request volume, peak load time. Potential risk trend: evaluate changes in security risks based on threat intelligence. Send trend prediction results to the control center in a structured format (such as JSON or XML).

[0125] In this solution, based on trend forecasting, resource allocation can be adjusted according to demand to avoid excessive waste or shortage of resources and optimize operating costs.

[0126] Embodiment 3 Figure 3 This is a schematic diagram of the structure of the information asset large model automated decision-making system provided in Example 3 of this application. Figure 3 As shown, specifically including the following: The system further comprises an encryption module 105, wherein the encryption module 105 is used for: Generate a symmetric encryption key according to a preset key generation rule, and store the symmetric encryption key in a key management system; According to a preset encryption algorithm selection rule, the information asset list is encrypted according to the symmetric encryption key to obtain encrypted data.

[0127] In this embodiment, the preset key generation rules can be a set of algorithms or logic for generating symmetric encryption keys, including key length, generation method, entropy source, etc. For example, common rules can be included: Key length: follow security standards (such as AES uses 128, 192 or 256-bit keys). Randomness: Generate keys through a hardware random number generator or a secure pseudo-random number generator (such as CSPRNG). Use a secure algorithm: such as PBKDF2, HKDF, or a generation mechanism based on a password seed. Update mechanism: including key rotation cycle and expiration handling method.

[0128] A symmetric encryption key may be a core key in an encryption method that uses the same key for both encryption and decryption.

[0129] A key management system can be a secure system for generating, storing, distributing, rotating, and managing cryptographic keys.

[0130] The preset encryption algorithm selection rules can be standards or logic that determine which symmetric encryption algorithm to use (such as AES, DES, or ChaCha20). The selection criteria can include data type and sensitivity: choose a stronger algorithm (such as AES-256) for highly sensitive data. Performance requirements: For low-resource devices, a more efficient encryption algorithm (such as ChaCha20) may be selected. Industry standards: follow industry or regulatory recommended algorithms, such as AES. Compatibility: be consistent with existing systems or protocols.

[0131] Encrypted data can be the ciphertext form of original data (such as information asset list) processed by a symmetric encryption algorithm, which cannot be directly restored to plain text.

[0132] You can use the key generation rule to call a secure random number generator (such as OpenSSL, JavaSecureRandom). Generate a random key based on the required key length (such as 256 bits). Store the key in a key management system (such as AWS KMS, AzureKeyVault) and set access permissions. Then select the rule based on the preset encryption algorithm (such as using AES-256). Set the algorithm parameters (such as encryption mode: CBC or GCM; padding method: PKCS#7). Then obtain the plaintext data to be encrypted (such as an information asset list). Then import the symmetric encryption key and generate the necessary initial vector (IV) or random number. Call the encryption library (such as Python's PyCrypto, Java's javax.crypto). Store the encrypted data as a ciphertext file or database record.

[0133] In this embodiment, encryption protection ensures that only authorized users with keys can access the information asset list, and even if the encrypted data is intercepted, the attacker cannot restore the original information. It can also prevent sensitive data from being leaked due to system vulnerabilities or malicious attacks.

[0134] On the basis of the above technical solution, optionally, the system further includes a decryption module, and the decryption module is used to: If a decryption request is received, verifying the user authority according to the decryption request; If the user authority verification is passed, the symmetric encryption key is obtained from the key management system, and the decryption algorithm is determined according to the preset encryption algorithm; The encrypted data is decrypted according to the decryption algorithm and the symmetric encryption key to obtain the plaintext data of the encrypted data.

[0135] In this solution, a decryption request can be an operation request sent by a user or system to a server, requesting the decryption of specific encrypted data. Specifically, it can include user identity information (such as user name, ID). The identifier of the encrypted data (such as data file ID or resource path). The reason or purpose of decryption (optional, used for log auditing).

[0136] User permissions can refer to the legitimacy of a user's access to encrypted data and decryption. Verification methods can include user identity verification (such as passwords, two-factor authentication), role or permission checks (such as administrators, data owners, specific access groups), and permission approval processes for decryption operation records.

[0137] A decryption algorithm is a mathematical method used to restore encrypted data, usually symmetric to the encryption algorithm.

[0138] Plaintext data can be the original information content restored after the encrypted data is decrypted and can be used directly by users.

[0139] The system can listen to the interface (API or other services) of the decryption request. Parse the request content and extract parameters such as user information, target data identifier, decryption reason, etc. Then call the authentication service to verify the user identity and authentication information (such as username + password, fingerprint, etc.). Check user permissions (role permission table in the permission management system). Record the decryption request and verification results. If the user does not have sufficient permissions, reject the request and record the reason, which can trigger an alarm or notify the administrator. If the user permission verification passes, the key retrieval interface of the key management system (KMS) can be called. Obtain the corresponding symmetric encryption key through the data identifier. Ensure the security of the key transmission process (such as using HTTPS or end-to-end encryption). Then determine the corresponding decryption algorithm according to the preset encryption algorithm selection rules. Finally, load the decryption algorithm and symmetric encryption key. Use the decryption algorithm to decrypt the encrypted data and restore it to plaintext data.

[0140] In this solution, it can be ensured that only authenticated and authorized users can access encrypted data, thus preventing unauthorized access.

[0141] Embodiment 4 Figure 4 Schematic diagram of the process of the information asset large model automated decision-making method provided in the fourth embodiment of the present application. Figure 4 As shown, the specific steps include: S401, obtain multimodal information asset data corresponding to the information asset, input the multimodal information asset data into a preset information asset macro model, obtain a predicted label of the information asset, and update the predicted label to the information asset list; wherein the multimodal information asset data includes an information asset description, an information asset log, and an information asset picture.

[0142] S402, if the label classification error information transmitted by the control center is not received, the communication frequency, operation status and dynamic log of the information asset are obtained in real time, and the communication frequency, operation status and dynamic log are input into the preset information asset model to determine whether the information asset needs to be updated.

[0143] S403, if the information asset needs to be updated, the predicted label of the information asset is re-output according to the communication frequency, operation status and dynamic log through the preset information asset macro model, and the predicted label is updated to the information asset list.

[0144] In this embodiment, the multimodal information asset data corresponding to the information asset is obtained, the multimodal information asset data is input into the preset information asset big model, the prediction label of the information asset is obtained, and the prediction label is updated to the information asset list; wherein, the multimodal information asset data includes information asset description, information asset log and information asset picture; if the label classification error information transmitted by the control center is not received, the communication frequency, operation status and dynamic log of the information asset are obtained in real time, and the communication frequency, operation status and dynamic log are input into the preset information asset big model to determine whether the information asset needs to be updated; if the information asset needs to be updated, the prediction label of the information asset is re-output according to the communication frequency, operation status and dynamic log through the preset information asset big model, and the prediction label is updated to the information asset list. Through the above-mentioned information asset big model automated decision-making method, by combining multimodal information and dynamic status, the model can comprehensively analyze the current status of the information asset, and the system can automatically re-evaluate the label when dynamic changes are detected, reducing the frequency and workload of manual inspections, and reducing operation and maintenance costs.

[0145] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0146] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0147] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

[0148] The above are only preferred embodiments of the present application and the technical principles used. The present application is not limited to the specific embodiments described herein, and various obvious changes, readjustments and substitutions that can be made by those skilled in the art will not deviate from the scope of protection of the present application. Therefore, although the present application is described in more detail through the above embodiments, the present application is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present application, and the scope of the present application is determined by the scope of the claims.

Claims

1. An information asset large model automated decision-making system, characterized in that: The system comprises: A classification module, used to obtain multimodal information asset data corresponding to information assets, input the multimodal information asset data into a preset information asset macro model, obtain a predicted label of the information asset, and update the predicted label to the information asset list; wherein the multimodal information asset data includes information asset descriptions, information asset logs, and information asset images; An update confirmation module is used to obtain the communication frequency, operation status and dynamic log of the information asset in real time if the tag classification error information transmitted by the control center is not received, and input the communication frequency, operation status and dynamic log into the preset information asset macro model to determine whether the information asset needs to be updated; The update module is used to re-output the prediction label of the information asset according to the communication frequency, operation status and dynamic log through the preset information asset big model if the information asset needs to be updated, and update the prediction label to the information asset list.

2. The information asset large model automated decision-making system according to claim 1 is characterized in that: The system further comprises an information asset updating module, wherein the information asset updating module is used to: Acquire network traffic data in the system in real time, and determine whether there are new information assets based on the network traffic data; If there are new information assets, the multimodal information asset data corresponding to the new information assets is obtained, the multimodal information asset data is input into the preset information asset macro model, the prediction label of the new information assets is obtained, and the prediction label is updated to the information asset list.

3. The information asset large model automated decision-making system according to claim 1 is characterized in that: The system further comprises a resource allocation module, wherein the resource allocation module is configured to: Update the information asset log of each information asset in the information asset list in real time, obtain the performance indicators and business requirements of each information asset in real time, input the information asset log, performance indicators and business requirements into the preset information asset macro model, and determine whether resource allocation is required; If resource allocation is required, a resource allocation suggestion is output through a preset information asset macro model, and the resource allocation suggestion is sent to a control center.

4. The information asset large model automated decision-making system according to claim 1, characterized in that: The system further includes an abnormality determination module, which is used to: Acquire the flow data and information asset metadata of each information asset in the information asset list in real time, and acquire the external threat database, input the flow data, information asset metadata, information asset log and external threat database into the preset information asset macro model, and determine whether each information asset has abnormal behavior; If there are information assets with abnormal behavior, the prediction label of the information asset is re-output through the preset information asset big model, and the decision result on the abnormal behavior is output.

5. The information asset large model automated decision-making system according to claim 4 is characterized in that: The system further comprises a trend prediction module, wherein the trend prediction module is used to: If there is no abnormal behavior, the trend prediction information is output through the preset information asset big model, and the trend prediction information is sent to the control center.

6. The information asset large model automated decision-making system according to claim 1, characterized in that: The system further comprises a health status determination module, wherein the health status determination module is used to: Obtaining historical usage data, real-time status data, and performance degradation data of each information asset in the information asset list, inputting the historical usage data, real-time status data, and performance degradation data into a preset information asset macro model, and determining a health status score of each information asset; If there is an information asset whose health status score is lower than a preset health threshold, optimization suggestions for the information asset are output through a preset information asset macro model.

7. The information asset large model automated decision-making system according to claim 1 is characterized in that: The system further comprises an encryption module, wherein the encryption module is used to: Generate a symmetric encryption key according to a preset key generation rule, and store the symmetric encryption key in a key management system; According to a preset encryption algorithm selection rule, the information asset list is encrypted according to the symmetric encryption key to obtain encrypted data.

8. The information asset large model automated decision-making system according to claim 7, characterized in that: The system further comprises a decryption module, wherein the decryption module is used to: If a decryption request is received, verifying the user authority according to the decryption request; If the user authority verification is passed, the symmetric encryption key is obtained from the key management system, and the decryption algorithm is determined according to the preset encryption algorithm; The encrypted data is decrypted according to the decryption algorithm and the symmetric encryption key to obtain the plaintext data of the encrypted data.

9. The information asset large model automated decision-making system according to claim 1, characterized in that: The training process of the preset information asset large model includes: Constructing a large information asset model, obtaining historical multimodal information asset data and corresponding static classification labels, and training a static classification branch of the large information asset model according to the multimodal information asset data and the corresponding static classification labels; Acquire historical communication frequency, historical operation status, historical dynamic log and dynamic classification label of historical information assets, create a first data set according to the historical communication frequency, historical operation status and historical dynamic log, and train the dynamic classification branch of the information asset big model according to the first data set and the dynamic label; Acquire historical information asset logs, historical performance indicators, historical business requirements, and resource allocation of historical information assets, create a second data set based on the historical information asset logs, historical performance indicators, and historical business requirements, and annotate a resource allocation tag of the second data set based on the resource allocation; Acquire historical information asset logs, historical performance indicators, historical business requirements, and historical resource allocation suggestions for resource allocation, create a third data set based on the historical information asset logs, historical performance indicators, and historical business requirements for resource allocation, and annotate the third data set with an allocation suggestion tag based on the historical resource allocation suggestions; Training a resource allocation branch of the information asset big model according to the second data set, the corresponding resource allocation tag, the third data set, and the corresponding allocation suggestion tag; Acquire historical normal behaviors and historical abnormal behaviors of historical information assets, and acquire historical traffic data, historical information asset metadata, historical information asset logs, and historical trend information of historical normal behaviors, create a fourth data set based on the historical traffic data, historical information asset metadata, and historical information asset logs of historical normal behaviors, and annotate the fourth data set with a normal behavior label and a trend information label based on the historical normal behaviors and historical trend information; Acquire historical traffic data, historical information asset metadata, historical information asset logs, historical classification labels, and historical decision results of historical abnormal behaviors, create a fifth data set based on the historical traffic data, historical information asset metadata, and historical information asset logs of the historical abnormal behaviors, and annotate the abnormal behavior labels, classification labels, and decision result labels of the fifth data set based on the historical abnormal behaviors, historical classification labels, and historical abnormal decision results; The behavior prediction branch of the information asset large model is trained according to the fourth data set, the corresponding normal behavior label and the trend information label, the fifth data set, the corresponding abnormal behavior label, the classification label and the decision result label; Acquire historical usage data, historical status data, historical performance degradation data, and corresponding historical health status scores of historical information assets, create a sixth data set based on the historical usage data, historical status data, and historical performance degradation data, and annotate a health status score label of the sixth data set based on the historical health status score; Determine an abnormal health status score according to the historical health status score and a preset health threshold, obtain historical usage data, historical status data, historical performance degradation data, and historical optimization suggestions corresponding to the abnormal health status score, create a seventh data set according to the historical usage data, historical status data, and historical performance degradation data corresponding to the abnormal health status score, and annotate the seventh data set with an optimization suggestion tag according to the historical optimization suggestion; The scoring branch of the information asset big model is trained according to the sixth data set, the corresponding health status scoring label, the seventh data set and the corresponding optimization suggestion label.

10. An automated decision-making method for a large information asset model, characterized in that: The method comprises: Obtain multimodal information asset data corresponding to the information asset, input the multimodal information asset data into a preset information asset macro model, obtain a predicted label of the information asset, and update the predicted label to the information asset list; wherein the multimodal information asset data includes an information asset description, an information asset log, and an information asset picture; If the label classification error information transmitted by the control center is not received, the communication frequency, operation status and dynamic log of the information asset are obtained in real time, and the communication frequency, operation status and dynamic log are input into the preset information asset macro model to determine whether the information asset needs to be updated; If it is necessary to update the information asset, the prediction label of the information asset is re-output according to the communication frequency, operation status and dynamic log through the preset information asset macro model, and the prediction label is updated to the information asset list.

Images