Data security system compliance assessment method and related device

Abstract

The invention relates to the field of natural language processing, and discloses a compliance evaluation method of a data security system and a related device. The method comprises the following steps: extracting a word vector sequence of each system clause to construct a feature vector, and obtaining a semantic feature vector VRi of the system clause and a semantic feature vector set {VRi} of all system clauses; extracting a word vector sequence of each specified clause to construct a feature vector VSj, and obtaining a semantic feature vector set {VSj} of the specified clauses; and calculating the similarity between the semantic feature vector VRi of the system clauses and each feature vector VSj in the feature vector set {VSj} of the specified clauses by using a zoom dot product attention mechanism. And setting a similarity threshold value to judge the compliance and comprehensiveness of the system.

Description

Technical Field

[0001] The present application relates to the field of natural language processing, and specifically to a compliance assessment method for a data security system. Background Art

[0002] In recent years, data security incidents have occurred frequently, and the value of data elements has been continuously mined, becoming a key factor in the digital economy. Data classification and grading and corresponding protection and privacy protection are necessary guarantees for the healthy development of the digital economy. In order to protect the security of personal information and important data, countries have successively introduced a series of laws, regulations and standards, such as the United States' Privacy Act, the EU's GDPR (General Data Protection Regulation), my country's Data Security Law, Personal Information Protection Law, Critical Information Infrastructure Protection Regulations, Data Outbound Security Assessment Measures, Network Data Security Management Regulations and Personal Information Protection Specifications. These laws and regulations have made strict provisions on how organizations collect, store, transmit and process data from the aspects of data security and personal privacy protection (hereinafter referred to as regulations). The data security management system (hereinafter referred to as the system) formulated by the organization should be consistent with these regulations, so conducting compliance assessments of the system and regulations is a basic work for organizational data security.

[0003] The current data security system compliance assessment process usually involves manually comparing the organization's system clauses with the prescribed clauses one by one, identifying compliance situations, and writing a detailed assessment report containing problem descriptions and improvement suggestions, which is inefficient. Summary of the invention

[0004] The embodiment of the present application provides a compliance assessment method for a data security system, which performs a compliance assessment based on the semantic feature vector of the data security system document to be assessed, obtains a compliance assessment result, and improves the accuracy and efficiency of determining the compliance assessment result.

[0005] The embodiment of the present application provides a compliance assessment method for a data security system, which performs a compliance assessment based on the semantic feature vector of the data security system document to be assessed, obtains a compliance assessment result, and improves the accuracy and efficiency of determining the compliance assessment result.

[0006] A first aspect of an embodiment of the present application provides a data security system compliance assessment method, the method comprising: Extract the system documents to be evaluated and obtain the prescribed documents; Extract the text of each clause from the document of the system to be evaluated, and obtain m texts of clauses to be evaluated; For each clause text R to be evaluated i Construct a sequence of word vectors; K iThe word vector sequence is used to construct a feature vector, and the semantic feature vector VR of the text to be evaluated is obtained. i , and then get the semantic feature vector set of all institutional clauses {VR i}; Extract features from the text of the prescribed clauses in the prescribed document to obtain a semantic feature vector set of the prescribed clauses {VS j}, where the semantic feature vector set of the specified clause includes n elements; From {VR i} and}VS j}, and calculate the similarity Sim between each pair of feature vectors ij , get m*n similarity value sets {Sim ij}; {Sim ij The system clauses whose similarity values ​​in the set exceed the set threshold are considered to comply with the prescribed clauses S j ; will {Sim ij If the similarity values ​​in the set do not exceed the threshold or there are no corresponding provisions with similarity values, it is deemed that these provisions have no institutional provisions to correspond to and implement them, and do not meet the compliance requirements, thus obtaining a compliance assessment result.

[0007] In this example, the regulation document is obtained by extracting the system document to be evaluated; the text of each clause is extracted from the system document to be evaluated to obtain m clause texts to be evaluated; for each clause text R to be evaluated i Construct a sequence of word vectors; for k i The word vector sequence is used to construct a feature vector, and the semantic feature vector VR of the text to be evaluated is obtained. i , and then get the semantic feature vector set of all institutional clauses {VR i}; Extract features from the text of the prescribed clauses in the prescribed document to obtain a set of semantic feature vectors of the prescribed clauses {VS j}, where the semantic feature vector set of the specified clause includes n elements; from {VR i} and}VS j}, and calculate the similarity Sim between each pair of feature vectors ij , get m*n similarity value sets {Sim ij}; will {Sim ij The system clauses whose similarity values ​​in the set exceed the set threshold are considered to comply with the prescribed clauses S j ; will {Sim ijIf the similarity values ​​in the set do not exceed the threshold or there are no corresponding regulations with similarity values, it is deemed that these regulations have no institutional clauses to correspond to and implement, and do not meet the compliance requirements, thereby obtaining a compliance assessment result. Therefore, a compliance assessment can be performed based on the semantic feature vector of the institutional document to be evaluated to obtain a compliance assessment result, thereby improving the accuracy and efficiency of determining the compliance assessment result.

[0008] A second aspect of an embodiment of the present application provides a data security system compliance assessment device, the device comprising: A first acquisition unit is used to extract the system document to be evaluated and acquire the prescribed document; The first extraction unit is used to extract the text of each clause in the system document to be evaluated, and obtain m texts of the clauses to be evaluated; Building blocks for each clause text R to be evaluated i Construct a sequence of word vectors; for k i The word vector sequence is used to construct a feature vector, and the semantic feature vector VR of the text to be evaluated is obtained. i , and then get the semantic feature vector set of all institutional clauses {VR i}; The second extraction unit is used to extract features from the text of the prescribed clause in the prescribed document to obtain a semantic feature vector set {VS j}, where the semantic feature vector set of the specified clause includes n elements; The second acquisition unit is used to obtain the VR i} and}VS j}, and calculate the similarity Sim between each pair of feature vectors ij , get m*n similarity value sets {Sim ij}; Evaluation unit, used to convert {Sim ij The system clauses whose similarity values ​​in the set exceed the set threshold are considered to comply with the prescribed clauses S j ; will {Sim ij If the similarity values ​​in the set do not exceed the threshold or there are no corresponding provisions with similarity values, it is deemed that these provisions have no institutional provisions to correspond to and implement them, and do not meet the compliance requirements, thus obtaining a compliance assessment result.

[0009] A third aspect of an embodiment of the present application provides a terminal, comprising a processor, an input device, an output device and a memory, wherein the processor, input device, output device and memory are interconnected, wherein the memory is used to store a computer program, the computer program comprises program instructions, and the processor is configured to call the program instructions to execute the step instructions in the first aspect of the embodiment of the present application.

[0010] The fourth aspect of the embodiments of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for electronic data exchange, wherein the computer program enables a computer to execute part or all of the steps described in the first aspect of the embodiments of the present application.

[0011] A fifth aspect of the embodiments of the present application provides a computer program product, wherein the computer program product includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to execute some or all of the steps described in the first aspect of the embodiments of the present application. The computer program product may be a software installation package. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0013] Figure 1 A flowchart of a compliance assessment method for a data security system is provided for an embodiment of the present application; Figure 2 A schematic diagram of the structure of a server provided in an embodiment of the present application; Figure 3 A structural schematic diagram of a compliance assessment device for a data security system is provided for an embodiment of the present application. DETAILED DESCRIPTION

[0014] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0015] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0016] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments.

[0017] In order to better understand the compliance assessment method of a data security system provided in the embodiment of the present application, the following first briefly introduces the compliance assessment method of the existing data security system. In the existing scheme, the data security system compliance assessment method has low accuracy when dealing with complex provisions. For example, although there have been studies attempting to improve the level of automation of compliance reviews by combining natural language processing (NLP) technology and domain knowledge, the method can only parse a limited number of documents and cannot parse complex statements. Compliance identification methods for specific fields, such as compliance identification of marketing behaviors of bank employees, are not applicable in other fields. The intelligent compliance inspection method for contract texts does not analyze the deep semantics of the text, which makes the accuracy and efficiency of the compliance assessment of the above method low when it is applied in specific applications.

[0018] In order to solve the above-mentioned problems, an embodiment of the present application provides a compliance assessment method for a data security system, which can perform compliance assessment based on the semantic feature vector of the system document to be evaluated, obtain compliance assessment results, and improve the accuracy and efficiency of determining the compliance assessment results.

[0019] See also Figure 1 , Figure 1 A flow chart of a data security system compliance assessment method is provided for the present application embodiment. Figure 1 As shown, the method includes: 101. Extract the system documents to be evaluated and obtain the prescribed documents.

[0020] Among them, the system document to be evaluated can be a system document formulated by the enterprise or the user, which requires a compliance assessment.

[0021] Regulations are documents prepared in advance by industry management units, such as the Data Security Law, the Personal Information Protection Law, the Regulations on the Protection of Key Information Infrastructure, the Measures for the Assessment of Data Security Outbound Transmission, the Regulations on the Administration of Network Data Security, the Regulations on the Protection of Personal Information, etc. In the subsequent compliance assessment, the main focus is on assessing whether the system documents prepared by enterprises, users, etc. comply with the provisions in the regulations.

[0022] 102. Extract the text of each clause from the system document to be evaluated to obtain m clause texts to be evaluated.

[0023] A general text extraction method is used to extract text to obtain the text of the initial clause to be evaluated. After the text of the initial clause to be evaluated is extracted, the text of the initial clause to be evaluated can be structurally processed to obtain k clause texts to be evaluated. When performing structural processing, paragraph segmentation processing, title recognition, keyword extraction, etc. can be included.

[0024] 103. For each clause text to be evaluated R i Construct a sequence of word vectors.

[0025] Using the pre-trained language model BERT based on the Transformer architecture, we can get the word vector sequence BERT(Text) for any term. X ={ , ,..., }, thus obtaining k word vector sequences.

[0026] 104. K i The word vector sequence is used to construct a feature vector, and the semantic feature vector VR of the text to be evaluated is obtained. i , and then get the semantic feature vector set of all institutional clauses {VR i}.

[0027] Among them, the attention score of each word vector in the word vector sequence can be calculated, and the attention score can be used to determine the attention weight value corresponding to the word vector, and the attention weight value can be used to calculate the context representation information of the word vector. Finally, the feature vector is constructed based on the context representation information of the word vector and the corresponding word vector to obtain the feature vector of the system clause. Therefore, the feature vector of the system clause can be determined based on the attention score of the word vector, etc., which improves the accuracy of determining the feature vector of the system clause.

[0028] 105. Perform feature extraction on the text of the prescribed clauses in the prescribed document to obtain a semantic feature vector set of the prescribed clauses {VS j}, where the semantic feature vector set of the specified clause includes n elements.

[0029] Bidirectional recurrent neural network, long short-term memory model, etc. can be used to extract features of the prescribed clause text in the prescribed document using a general method to obtain a set of feature vectors of the prescribed clauses. These models can capture complex patterns and sequence dependencies in text data and provide rich feature representations for subsequent similarity calculations.

[0030] After calculating the feature vectors of the prescribed clauses in the prescribed document, the prescribed vectors are fused as follows: The similarity between the feature vectors of each specified clause is obtained, and fusion processing is performed according to the similarity. The feature vectors with similarity higher than the preset threshold are fused to enhance the generalization ability of the model. The similarity between the feature vectors of each specified clause is obtained through the following formula, specifically: , in, For vector and The similarity between Represents a specified vector and The dot product of and Respectively represent the specified vector and The Euclidean norm of . The vector is a feature vector of a specified term in the set of feature vectors of specified terms, is a feature vector of another specified term in the set of feature vectors of the specified terms.

[0031] Based on the calculated similarity, we will fuse the feature vectors whose similarity is higher than the preset threshold. The fusion strategy is to take the mean of the two corresponding feature vectors as the fused feature vector. This method is simple and effective, and can merge the information of similar feature vectors, reduce redundancy, and improve the representativeness of feature vectors.

[0032] 106. From {VR i} and}VS j}, and calculate the similarity Sim between each pair of feature vectors ij , get m*n similarity value sets {Sim ij}.

[0033] The similarity between the feature vector of the system clause and the feature vector of the regulation clause can be calculated by the method shown in the following formula, specifically: , in, is the characteristic vector of the system terms The feature vector with the specified terms The similarity between The feature vector representing the institutional terms and the feature vector of the specified terms The dot product of and Represents vectors and The Euclidean norm of .

[0034] 107. {Sim ij The system clauses whose similarity values ​​in the set exceed the set threshold are considered to comply with the prescribed clauses S j ; will {Sim ij If the similarity values ​​in the set do not exceed the threshold or there are no corresponding provisions with similarity values, it is deemed that these provisions have no institutional provisions to correspond to and implement them, and do not meet the compliance requirements, thus obtaining a compliance assessment result.

[0035] Get the maximum value in each similarity value set in the k similarity value sets to obtain k maximum similarity values; compare the k maximum similarity values ​​with the preset similarity threshold to obtain the comparison results; in order to improve the accuracy of the evaluation results, a dynamic threshold adjustment mechanism is adopted. If the similarity value is lower than the dynamically adjusted threshold range, it is marked as potentially non-compliant and further manual review is recommended. Otherwise, the clause is considered compliant under the current evaluation conditions. This method allows the threshold to be flexibly adjusted according to the specific application and risk level. When the evaluation results show that the document is non-compliant, we will record the text of the clauses to be evaluated whose maximum similarity value is lower than the threshold, and determine the subsequent compliance adjustment measures based on this information. This process ensures the accuracy and pertinence of the compliance assessment and provides organizations with a clear direction for improvement. With this approach, we can not only evaluate the compliance of the document, but also identify and solve specific compliance issues, thereby improving the overall compliance level.

[0036] In this example, the regulation document is obtained by extracting the system document to be evaluated; the text of each clause is extracted from the system document to be evaluated to obtain m clause texts to be evaluated; for each clause text R to be evaluated i Construct a sequence of word vectors; for k i The word vector sequence is used to construct a feature vector, and the semantic feature vector VR of the text to be evaluated is obtained. i, and then get the semantic feature vector set of all institutional clauses {VR i}; Extract features from the text of the prescribed clauses in the prescribed document to obtain a set of semantic feature vectors of the prescribed clauses {VS j}, where the semantic feature vector set of the specified clause includes n elements; from {VR i} and}VS j}, and calculate the similarity Sim between each pair of feature vectors ij , get m*n similarity value sets {Sim ij}; will {Sim ij The system clauses whose similarity values ​​in the set exceed the set threshold are considered to comply with the prescribed clauses S j ; will {Sim ij If the similarity values ​​in the set do not exceed the threshold or there are no corresponding regulations with similarity values, it is deemed that these regulations have no institutional clauses to correspond to and implement, and do not meet the compliance requirements, thereby obtaining a compliance assessment result. Therefore, a compliance assessment can be performed based on the semantic feature vector of the institutional document to be evaluated to obtain a compliance assessment result, thereby improving the accuracy and efficiency of determining the compliance assessment result.

[0037] In a specific implementation, the semantic feature vector can be constructed in combination with the attention score of the word vector. Specifically, a method for constructing a feature vector according to k word vector sequences to obtain feature vectors of k institutional clauses is provided, including: A1. Use the scaled dot product attention mechanism to obtain the attention score corresponding to each word vector in the word vector sequence of clause i and obtain a set of attention scores; A2. Determine the attention weight value corresponding to each word vector in the target word vector sequence according to the attention score set to obtain an attention weight value set; A3. Determine the context representation information corresponding to each word vector in the word vector sequence according to the attention weight value set, and obtain a context representation information set; A4, constructing a semantic feature vector according to the context representation information in the context representation information set and the corresponding word vector, to obtain the semantic feature vector of the system clause i; A5. Repeat the above steps to obtain the attention score corresponding to each word vector in the word vector sequence, and obtain a set of attention scores. The word vector sequence is k. i Any one of the word vector sequences is used to construct a semantic feature vector according to the context representation information in the context representation information set and the corresponding word vector, until the semantic feature vectors of m clauses of the system are obtained.

[0038] Among them, the attention score set can be obtained by calculating the attention score of each word vector in the target word vector sequence through the dimension information of the word vector in the target word vector sequence and the word vector in the target word vector sequence.

[0039] After calculating the attention score set, the softmax function is used to normalize the attention scores to effectively highlight the weights of important words while ensuring that the sum of all attention scores is equal to 1. This processing method helps to improve the semantic expression ability of the feature vector. The normalized attention score is determined as the attention weight value of the corresponding word vector. The attention score can be normalized using the method shown in the following formula to obtain the corresponding attention weight value, specifically: , in, is the i-th word vector relative to other word vectors The attention weight value, is the i-th word vector, and the other word vectors in the target word vector sequence , is the softmax function.

[0040] The method shown in the following formula can be used to determine the context representation information corresponding to the word vector in the target word vector sequence, specifically: , in, is the context representation information of the i-th word vector, is the i-th word vector relative to other word vectors The attention weight value of the target word vector sequence is .

[0041] The semantic feature vector is constructed based on the context representation information and the corresponding word vector by the method shown in the following formula to obtain the feature vector of the system clause, which is: , in, is the semantic feature vector of the i-th word vector in the feature vector of the institutional clause. Function f Representing information in context And the corresponding word vector Combined together, a comprehensive semantic feature vector is generated, which can more comprehensively represent the semantic content of the word vector.

[0042] In this example, the feature vector of the system clause can be determined based on the attention score of the word vector, thereby improving the accuracy of determining the feature vector of the system clause.

[0043] In a specific implementation, a method for obtaining an attention score corresponding to each word vector in a target word vector sequence to obtain an attention score set includes: B1. Obtain the dimension information corresponding to each word vector in the target word vector sequence; B2. Use the scaled dot product attention mechanism to calculate the dot product of each pair of word vectors in the word vector sequence of clause i, and then scale them by a scaling factor (usually the inverse of the word vector dimension) to obtain the scaled dot product. Apply the softmax function to calculate the attention score of each word vector to form a set of attention scores.

[0044] In order to obtain the dimensionality information corresponding to each word vector in the target word vector sequence, we use a standard dimensionality information extraction method. This method ensures that we can accurately identify the location of each word vector in the high-dimensional space.

[0045] The attention score can be calculated using the following formula: , in, for Relative to The attention score, is a vector and The dimensional range of is the i-th word vector, and the other word vectors in the target word vector sequence .

[0046] In a specific implementation, after the compliance evaluation of the to-be-evaluated policy document is performed based on the k similarity value sets to obtain the compliance evaluation result, the method further includes: C1. If the compliance assessment result includes that the target clause to be assessed is a non-compliant clause, extracting a similarity value set corresponding to the clause; C2. Sorting the similarity values ​​in the similarity value set from high to low to obtain a first similarity value sequence; C3. Extracting the first n similarity values ​​from the first similarity sequence to obtain a target similarity value set; C4. Obtaining a feature vector of a system clause corresponding to each similarity value in the target similarity value set to form a target feature vector set; C5. Extracting difference information based on the semantic feature vector corresponding to the target item to be evaluated and the target feature vector set to obtain a first difference information set; C6. extracting key difference information from the first difference information set; C7. Generate compliance adjustment information based on the key difference information; C8. Display the compliance adjustment information.

[0047] The similarity value set corresponding to the target to-be-evaluated clause can be extracted from the similarity set calculated in the above-mentioned embodiment. The first n similarity values ​​can be extracted to obtain the target similarity value set. For example, n can be 3, 5, 8, etc., and n is set by empirical value or historical data.

[0048] The feature vector of the specified clause corresponding to each similarity value can be extracted according to the calculation process during the similarity calculation to obtain a target feature vector set.

[0049] When performing difference information extraction, the semantic feature vectors corresponding to the target to-be-evaluated clauses are respectively subjected to difference extraction with the target feature vectors in the target feature vector set to obtain a first difference information set.

[0050] Specifically, the word vectors whose similarity between the semantic feature vector and the target feature vector is lower than a preset similarity threshold are extracted to obtain the difference information. The preset similarity threshold is set by experience value or historical data.

[0051] The first difference information of the first difference information set can be evaluated for importance to obtain an importance score; the first difference information with an importance score higher than a preset importance score threshold can be determined as key difference information. When evaluating importance, the first difference information and the preset key difference information can be extracted for similarity to obtain similarity. The higher the similarity, the higher the importance score, and the lower the similarity, the lower the importance score. Thus, the key difference information can be quickly obtained. A compliance adjustment information generation template corresponding to the key difference information can be obtained, and compliance adjustment information can be generated by inputting the key difference information into the generation template.

[0052] In this example, when the compliance assessment result is non-compliant, the non-compliant target terms to be assessed are extracted, and key difference information is extracted based on the target terms to be assessed. Finally, compliance adjustment information is generated based on the key difference information, thereby improving the accuracy of determining the compliance adjustment information.

[0053] This application uses automated assessment, which uses text data vectorization technology to automatically convert data security regulations and system documents into vector representations, making the compliance assessment process more efficient and accurate. Compared with traditional manual assessment methods, it saves a lot of time and manpower.

[0054] This application improves the objective accuracy of compliance assessment. Based on the vectorized assessment method, it reduces the interference of subjective factors and makes the assessment results more objective and accurate. By quantifying the similarity and matching degree between documents, the compliance level of data security system documents can be better judged.

[0055] This application improves the existing compliance assessment method: this method is not simply based on keyword matching or simple rule judgment, but through semantic analysis and feature extraction of text, comprehensive consideration of factors such as the structure, content and context of the document, and the use of new natural language processing technology to provide more comprehensive and in-depth compliance assessment results.

[0056] This application proposes to integrate multiple standards to form a unified regulation vector, which greatly reduces the repetitive work of compliance assessment.

[0057] This application provides the entire process and corresponding methods of compliance assessment, in which the clause sentence representation is scalable and can be dynamically updated with the development of natural language processing technology to achieve the best effect.

[0058] For the above embodiments, please refer to Figure 2 , Figure 2 A schematic diagram of the structure of a server provided in an embodiment of the present application, such as Figure 2 As shown, it includes a processor, an input device, an output device and a memory, which are connected to each other, wherein the memory is used to store a computer program, the computer program includes program instructions, the processor is configured to call the program instructions, and the program includes instructions for executing the following steps; Extract the system documents to be evaluated and obtain the prescribed documents; Extract the text of each clause from the document of the system to be evaluated, and obtain m texts of clauses to be evaluated; For each clause text R to be evaluated i Construct a sequence of word vectors; K i The word vector sequence is used to construct a feature vector, and the semantic feature vector VR of the text to be evaluated is obtained. i , and then get the semantic feature vector set of all institutional clauses {VR i}; Extract features from the text of the prescribed clauses in the prescribed document to obtain a semantic feature vector set of the prescribed clauses {VS j}, where the semantic feature vector set of the specified clause includes n elements; From {VR i} and}VS j}, and calculate the similarity Sim between each pair of feature vectorsij , get m*n similarity value sets {Sim ij}; {Sim ij The system clauses whose similarity values ​​in the set exceed the set threshold are considered to comply with the prescribed clauses S j ; will {Sim ij If the similarity values ​​in the set do not exceed the threshold or there are no corresponding provisions with similarity values, it is deemed that these provisions have no institutional provisions to correspond to and implement them, and do not meet the compliance requirements, thus obtaining a compliance assessment result.

[0059] The above mainly introduces the scheme of the embodiment of the present application from the perspective of the execution process on the method side. It is understandable that in order to realize the above functions, the terminal includes a hardware structure and / or software module corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments provided herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0060] The embodiment of the present application can divide the terminal into functional units according to the above method example. For example, each functional unit can be divided according to each function, or two or more functions can be integrated into one processing unit. The above integrated unit can be implemented in the form of hardware or in the form of software functional units. It should be noted that the division of units in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0061] In line with the above, see Figure 3 , Figure 3 The present invention provides a schematic diagram of a data security compliance assessment device. Figure 3 As shown, the device comprises: The first acquisition unit 301 is used to extract the system document to be evaluated and obtain the prescribed document; The first extraction unit 302 is used to extract the text of each clause in the system document to be evaluated, and obtain m texts of clauses to be evaluated; The construction unit 303 is used to evaluate each clause text R i Construct a sequence of word vectors; for k i The word vector sequence is used to construct a feature vector, and the semantic feature vector VR of the text to be evaluated is obtained. i, and then get the semantic feature vector set of all institutional clauses {VR i}; The second extraction unit 304 is used to extract features from the text of the specified clause in the specified document to obtain a semantic feature vector set {VS j}, where the semantic feature vector set of the specified clause includes n elements; The second acquisition unit 305 is used to obtain the i} and}VS j}, and calculate the similarity Sim between each pair of feature vectors ij , get m*n similarity value sets {Sim ij}; Evaluation unit 306, used to ij The system clauses whose similarity values ​​in the set exceed the set threshold are considered to comply with the prescribed clauses S j ; will {Sim ij If the similarity values ​​in the set do not exceed the threshold or there are no corresponding provisions with similarity values, it is deemed that these provisions have no institutional provisions to correspond to and implement them, and do not meet the compliance requirements, thus obtaining a compliance assessment result.

[0062] In a specific implementation, when k i The word vector sequence is used to construct a feature vector, and the semantic feature vector VR of the text to be evaluated is obtained. i , and then get the semantic feature vector set of all institutional clauses {VR i} aspect, the construction unit is specifically used for: Obtain an attention score corresponding to each word vector in a target word vector sequence to obtain a set of attention scores, wherein the target word vector sequence is any one of the k word vector sequences; Use the scaled dot product attention mechanism to obtain the attention score corresponding to each word vector in the word vector sequence of clause i and obtain a set of attention scores; Determine the attention weight value corresponding to each word vector in the word vector sequence according to the attention score set, and obtain an attention weight value set; Determine, according to the attention weight value set, the context representation information corresponding to each word vector in the word vector sequence, and obtain a context representation information set; Constructing a semantic feature vector according to the context representation information in the context representation information set and the corresponding word vector to obtain a semantic feature vector of the system clause i; Repeat the above to obtain the attention score corresponding to each word vector in the word vector sequence, and obtain a set of attention scores. The word vector sequence is k iAny one of the word vector sequences is used to construct a semantic feature vector according to the context representation information in the context representation information set and the corresponding word vector, until the semantic feature vectors of m clauses of the system are obtained.

[0063] In a specific implementation, in the aspect of adopting the scaled dot product attention mechanism to obtain the attention score corresponding to each word vector in the word vector sequence of clause i and obtain the attention score set, the construction unit is specifically used to: Get the dimension information corresponding to each word vector in the target word vector sequence; The scaled dot product attention mechanism is used to calculate the dot product of each pair of word vectors in the word vector sequence of clause i, and then scale them by a scaling factor (usually the inverse of the word vector dimension) to obtain the scaled dot product. The softmax function is applied to calculate the attention score of each word vector to form a set of attention scores.

[0064] In a specific implementation, when {Sim ij The system clauses whose similarity values ​​in the set exceed the set threshold are considered to comply with the prescribed clauses S j ; will {Sim ij If the similarity values ​​in the set do not exceed the threshold or there are no corresponding provisions with similarity values, it is deemed that these provisions have no system provisions to correspond to and implement, and do not meet the compliance requirements. After obtaining the compliance assessment result, the device is also used to: If the compliance assessment result includes that the target clause to be assessed is a non-compliant clause, extracting a similarity value set corresponding to the clause; Sorting the similarity values ​​in the similarity value set from high to low to obtain a first similarity value sequence; Extracting first n similarity values ​​from the first similarity sequence to obtain a target similarity value set; Obtaining a feature vector of a system clause corresponding to each similarity value in the target similarity value set to form a target feature vector set; Extracting difference information based on the semantic feature vector corresponding to the target item to be evaluated and the target feature vector set to obtain a first difference information set; Extracting key difference information from the first difference information set; generating compliance adjustment information according to the key difference information; The compliance adjustment information is displayed.

[0065] An embodiment of the present application also provides a computer storage medium, wherein the computer storage medium stores a computer program for electronic data exchange, and the computer program enables a computer to execute part or all of the steps of any data security system compliance assessment method recorded in the above method embodiments.

[0066] An embodiment of the present application also provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program enables a computer to execute part or all of the steps of any data security system compliance assessment method recorded in the above method embodiments.

[0067] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0068] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0069] In the several embodiments provided in the present application, it should be understood that the disclosed device can be implemented in other ways. For example, the device embodiments described above are only schematic, such as the division of the units, which is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces or units, which can be electrical or other forms.

[0070] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0071] In addition, the functional units in the various embodiments of the application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware or in the form of software program modules.

[0072] If the integrated unit is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a memory and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned memory includes: U disk, read-only memory (ROM), random access memory (RAM), mobile hard disk, magnetic disk or optical disk, etc., and other media that can store program codes.

[0073] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable memory, which can include: a flash drive, a read-only memory, a random access memory, a magnetic disk or an optical disk, etc.

[0074] The embodiments of the present application are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core idea of ​​the present application. At the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A data security system compliance assessment method, characterized in that: The method comprises: Extract the system documents to be evaluated and obtain the prescribed documents; Extract the text of each clause from the document of the system to be evaluated, and obtain m texts of clauses to be evaluated; For each clause text R to be evaluated i Construct a sequence of word vectors; K i The word vector sequence is used to construct a feature vector, and the semantic feature vector VR of the text to be evaluated is obtained. i , and then get the semantic feature vector set of all institutional clauses {VR i }; Extract features from the text of the prescribed clauses in the prescribed document to obtain a semantic feature vector set of the prescribed clauses {VS j }, where the semantic feature vector set of the specified clause includes n elements; From {VR i } and}VS j }, and calculate the similarity Sim between each pair of feature vectors ij , get m*n similarity value sets {Sim ij }; {Sim ij The system clauses whose similarity values ​​in the set exceed the set threshold are considered to comply with the prescribed clauses S j ; will {Sim ij If the similarity values ​​in the set do not exceed the threshold or there are no corresponding provisions with similarity values, it is deemed that these provisions have no institutional provisions to correspond to and implement them, and do not meet the compliance requirements, thus obtaining a compliance assessment result.

2. The compliance assessment method of the system according to claim 1 is characterized in that: K i The word vector sequence is used to construct a feature vector, and the semantic feature vector VR of the text to be evaluated is obtained. i , and then get the semantic feature vector set of all institutional clauses {VR i },include: Use the scaled dot product attention mechanism to obtain the attention score corresponding to each word vector in the word vector sequence of clause i and obtain a set of attention scores; Determine the attention weight value corresponding to each word vector in the word vector sequence according to the attention score set, and obtain an attention weight value set; Determine, according to the attention weight value set, the context representation information corresponding to each word vector in the word vector sequence, and obtain a context representation information set; Constructing a semantic feature vector according to the context representation information in the context representation information set and the corresponding word vector to obtain a semantic feature vector of the system clause i; Repeat the above to obtain the attention score corresponding to each word vector in the word vector sequence, and obtain a set of attention scores. The word vector sequence is k i Any one of the word vector sequences is used to construct a semantic feature vector according to the context representation information in the context representation information set and the corresponding word vector, until the semantic feature vectors of m clauses of the system are obtained.

3. The compliance assessment method of the system according to claim 2 is characterized in that: The scaled dot product attention mechanism is used to obtain the attention score corresponding to each word vector in the word vector sequence of clause i, and obtain an attention score set, including: Get the dimension information corresponding to each word vector in the target word vector sequence; The scaled dot product attention mechanism is adopted to calculate the dot product of each pair of word vectors in the word vector sequence of clause i, and then scale them by the scaling factor to obtain the scaled dot product. The softmax function is applied to calculate the attention score of each word vector to form a set of attention scores. The scaling factor includes the inverse of the word vector dimension.

4. The data security system compliance assessment method according to any one of claims 1 to 3, characterized in that: In the {Sim ij The system clauses whose similarity values ​​in the set exceed the set threshold are considered to comply with the prescribed clauses S j ; will {Sim ij If the similarity values ​​in the set do not exceed the threshold or there are no corresponding provisions with similarity values, it is deemed that these provisions have no system provisions to correspond to and implement them, and do not meet the compliance requirements. At the same time, the compliance of the system provisions with similarity values ​​less than the threshold is verified, so as to obtain the compliance assessment results, the method further includes: If the compliance assessment result includes that the target clause to be assessed is a non-compliant clause, extracting a similarity value set corresponding to the clause; Sorting the similarity values ​​in the similarity value set from high to low to obtain a first similarity value sequence; Extracting first n similarity values ​​from the first similarity sequence to obtain a target similarity value set; Obtaining a feature vector of a system clause corresponding to each similarity value in the target similarity value set to form a target feature vector set; Extracting difference information based on the semantic feature vector corresponding to the target item to be evaluated and the target feature vector set to obtain a first difference information set; Extracting key difference information from the first difference information set; generating compliance adjustment information according to the key difference information; The compliance adjustment information is displayed.

5. A data security system compliance assessment device, characterized in that: The device comprises: A first acquisition unit is used to extract the system document to be evaluated and acquire the prescribed document; The first extraction unit is used to extract the text of each clause in the system document to be evaluated, and obtain m texts of the clauses to be evaluated; Building blocks for each clause text R to be evaluated i Construct a sequence of word vectors; for k i The word vector sequence is used to construct a feature vector, and the semantic feature vector VR of the text to be evaluated is obtained. i , and then get the semantic feature vector set of all institutional clauses {VR i }; The second extraction unit is used to extract features from the text of the prescribed clause in the prescribed document to obtain a semantic feature vector set {VS j }, where the semantic feature vector set of the specified clause includes n elements; The second acquisition unit is used to obtain the VR i } and}VS j }, and calculate the similarity Sim between each pair of feature vectors ij , get m*n similarity value sets {Sim ij }; Evaluation unit, used to convert {Sim ij The system clauses whose similarity values ​​in the set exceed the set threshold are considered to comply with the prescribed clauses S j ; will {Sim ij If the similarity values ​​in the set do not exceed the threshold or there are no corresponding provisions with similarity values, it is deemed that these provisions have no institutional provisions to correspond to and implement them, and do not meet the compliance requirements, thus obtaining a compliance assessment result.

6. The data security system compliance assessment device according to claim 5, characterized in that: In the k i The word vector sequence is used to construct a feature vector, and the semantic feature vector VR of the text to be evaluated is obtained. i , and then get the semantic feature vector set of all institutional clauses {VR i } aspect, the construction unit is specifically used for: Obtain an attention score corresponding to each word vector in a target word vector sequence to obtain a set of attention scores, wherein the target word vector sequence is any one of the k word vector sequences; Use the scaled dot product attention mechanism to obtain the attention score corresponding to each word vector in the word vector sequence of clause i and obtain a set of attention scores; Determine the attention weight value corresponding to each word vector in the word vector sequence according to the attention score set, and obtain an attention weight value set; Determine, according to the attention weight value set, the context representation information corresponding to each word vector in the word vector sequence, and obtain a context representation information set; Constructing a semantic feature vector according to the context representation information in the context representation information set and the corresponding word vector to obtain a semantic feature vector of the system clause i; Repeat the above to obtain the attention score corresponding to each word vector in the word vector sequence, and obtain a set of attention scores. The word vector sequence is k i Any one of the word vector sequences is used to construct a semantic feature vector according to the context representation information in the context representation information set and the corresponding word vector, until the semantic feature vectors of m clauses of the system are obtained.

7. The data security system compliance assessment device according to claim 6, characterized in that: In the aspect of adopting the scaled dot product attention mechanism to obtain the attention score corresponding to each word vector in the word vector sequence of clause i and obtain the attention score set, the construction unit is specifically used for: Get the dimension information corresponding to each word vector in the target word vector sequence; The scaled dot product attention mechanism is adopted to calculate the dot product of each pair of word vectors in the word vector sequence of clause i, and then scale them by the scaling factor to obtain the scaled dot product. The softmax function is applied to calculate the attention score of each word vector to form a set of attention scores. The scaling factor includes the inverse of the word vector dimension.

8. The data security system compliance assessment device according to any one of claims 5 to 7, characterized in that: In the {Sim ij The system clauses whose similarity values ​​in the set exceed the set threshold are considered to comply with the prescribed clauses S j ; will {Sim ij If the similarity values ​​in the set do not exceed the threshold or there are no corresponding provisions with similarity values, it is deemed that these provisions have no system provisions to correspond to and implement, and do not meet the compliance requirements. After obtaining the compliance assessment result, the device is also used to: If the compliance assessment result includes that the target clause to be assessed is a non-compliant clause, extracting a similarity value set corresponding to the clause; Sorting the similarity values ​​in the similarity value set from high to low to obtain a first similarity value sequence; Extracting first n similarity values ​​from the first similarity sequence to obtain a target similarity value set; Obtaining a feature vector of a system clause corresponding to each similarity value in the target similarity value set to form a target feature vector set; Extracting difference information based on the semantic feature vector corresponding to the target item to be evaluated and the target feature vector set to obtain a first difference information set; Extracting key difference information from the first difference information set; generating compliance adjustment information according to the key difference information; The compliance adjustment information is displayed.

9. A server, characterized in that: It includes a processor, an input device, an output device and a memory, which are interconnected, wherein the memory is used to store a computer program, the computer program includes program instructions, and the processor is configured to call the program instructions to execute the compliance assessment method of the data security system as described in any one of claims 1 to 4.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes the compliance assessment method for a data security system according to any one of claims 1 to 4.

Images