Intelligent research and judgment method and system for network-related security check terms of network source based on large language model

Abstract

The invention provides an intelligent research and judgment method and system for network-related security check terms of a network source based on a large language model. The method comprises the following steps: S1, collecting network-related security evaluation terms and a basis file; s2, performing pre-training and fine tuning on the universal Embedding model by using a network-related security evaluation clause and a basis file so as to construct a network source special model; s3, carrying out preprocessing and text segmentation on the network-related security evaluation basis file, carrying out text vectorization processing through a network source special model, and storing vectorized text fragments and corresponding original texts into a database to construct a network source security special knowledge base; and S4, carrying out intelligent research and judgment on network-related security check terms by combining the large model and a network source security special knowledge base. According to the method, the advantages of the large language model in the aspect of natural language understanding are fully played, and the clause basis file is accurately positioned in combination with the network source security special model, so that a large number of unstructured network-related security check clauses can be efficiently processed, and intelligent and efficient research and judgment are realized.

Description

Technical Field

[0001] The present invention relates to the technical field of security assessment, and in particular to a method and system for intelligently analyzing network-source network-related security inspection clauses based on a large language model. Background Art

[0002] Traditional power plant grid-related safety inspections usually rely on the inspection team to manually check each item, compare the on-site situation with the specifications one by one, and record the problems. This method often requires 5 to 6 people to invest about 2 days, which is a large workload and is prone to human omissions affecting the inspection quality.

[0003] In addition, the security assessment technology based on general models or the combination of general models and professional models in the field of power grid equipment operation and maintenance is mainly based on general models or general models. Since network-related security inspection clauses are usually presented in an unstructured form with complex and diverse sentences, it is difficult for traditional artificial intelligence models, rule bases or knowledge graphs to achieve comprehensive and flexible intelligent judgment. In addition, the traditional rule base relies on manually set keyword templates to achieve semantic understanding by matching keywords entered by users. This method requires a lot of manual configuration and maintenance. At the same time, fine-tuning and training the professional monitoring model based on the general model not only consumes a lot of computing resources and has extremely high requirements on equipment performance, but also faces the problems of high hardware costs and long training time.

[0004] Large language models use deep learning methods, especially the Transformer architecture, and are trained on large amounts of text data to capture the underlying laws of language. These models can automatically learn and extract features without manual definition. And large language models have good generalization capabilities, which means they can handle different natural language processing tasks in a variety of scenarios, such as text classification, question answering, and conversations.

[0005] In order to improve the automation and intelligence level of network-source network-related security inspections, achieve accurate matching and intelligent analysis of security inspection clauses, promote the innovative development of network-source network-related security inspection technologies, and at the same time improve inspection efficiency and quality, reduce costs, and promote scientific and standardized security management, the present invention proposes a method and system for intelligent analysis of network-source network-related security inspection clauses based on a large language model. Summary of the invention

[0006] The purpose of the present invention is to propose a method and system for intelligent analysis of network-source network-related security inspection clauses based on a large language model, giving full play to the advantages of the large language model in natural language understanding, and combining the network-source security-specific model to accurately locate the clause basis files, and can efficiently process a large number of unstructured network-related security inspection clauses, thereby realizing intelligent and efficient analysis.

[0007] To achieve the above object, the technical solution of the present invention is as follows:

[0008] A method for intelligently analyzing network-source network-related security inspection clauses based on a large language model specifically includes the following steps:

[0009] S1. Collect network security assessment clauses and supporting documents;

[0010] S2. Use the network security assessment clauses and basis documents to pre-train and fine-tune the general Embedding model to build a network source-specific model;

[0011] S3. Preprocess and segment the network security assessment basis documents, and vectorize the segmented text segments using a network source-specific model, and store the vectorized text segments and the corresponding original text in a database to build a network source security-specific knowledge base;

[0012] S4. Combine the big model with the network source security-specific knowledge base to conduct intelligent analysis and judgment of network-related security inspection clauses.

[0013] Preferably, the construction of the network source dedicated model specifically includes the following steps:

[0014] S21. Based on the network security assessment clauses and the reference documents, a set of professional keywords related to network security assessment is screened, each keyword is defined as a single Token, and the embedded representation of each keyword is obtained by processing it through a general Embedding model;

[0015] S22. Add the embedding representation of the keyword set to the embedding layer of the general Embedding model, including expanding the word segmenter, adjusting the embedding layer size, and assigning the embedding representation of the keyword set to the embedding layer weight of the general Embedding model, completing the pre-training and fine-tuning of the general Embedding model, and obtaining a network source-specific model.

[0016] Preferably, the network security assessment basis file is preprocessed as follows: for the network security assessment basis file in PDF format, it is converted into editable text through OCR recognition, and the file content is automatically typeset into a Markdown format file using a general large language model.

[0017] Preferably, the text segmentation is specifically as follows:

[0018] Transform the tables and pictures in the text data; the tables are processed row by row in the manner of "table name header-horizontal header-vertical data value", and the pictures are replaced by generating a UID index;

[0019] Read and record the segment length X of each paragraph of the text data, and obtain a normal distribution by statistically analyzing the probability of segment length X appearing in different level intervals to determine the optimal block length μ;

[0020] The text data is divided into paragraphs; for paragraphs whose length exceeds the optimal block length μ, the part exceeding the optimal block length μ is cut out without splitting the sentence. If the cut-out part is still larger than the optimal block length μ, the part exceeding the optimal block length μ is continued to be cut out without splitting the sentence until all blocks do not exceed the optimal block length μ.

[0021] Preferably, the construction of the network source security-specific knowledge base is based on the Faiss vector database, and the vectorized text fragments are stored in the Faiss vector database.

[0022] Preferably, the deployment of the model in S4 is specifically as follows: selecting the open source big model Qwen2.5 as the core engine tool for inspection clause analysis and judgment, and using the open source reasoning engine vLLM as the startup tool of the big model.

[0023] Preferably, S4 is specifically:

[0024] S41, clause configuration: solidify the inspection clauses of the network source network security assessment into a program configuration file, and extract the clause content corresponding to the inspection item during the analysis and judgment as parameter 1;

[0025] S42, matching based on the file; extracting the source of the based file and its original text corresponding to parameter 1 through a hybrid positioning method of vector similarity and BM25 algorithm, and generating parameter 2;

[0026] S43, obtaining the inspected data as parameter 3; the inspected data includes test file data, equipment ledger data and on-site inspection data;

[0027] S44. Input parameters 1, 2 and 3 into the Qwen2.5 large model. The large model conducts comprehensive analysis and judgment on the input conditions according to the prompt template, and outputs the judgment results in the specified format.

[0028] Preferably, the S42 specifically includes the following steps:

[0029] S421, vector similarity calculation; parameter 1 is passed into the network source dedicated model for vectorization, and the similarity between the vectorized document fragments and the network source security dedicated knowledge base is calculated to generate a similarity ranking result set between the vectorized document fragments and parameter 1. The vector similarity is calculated using the cosine similarity algorithm:

[0030]

[0031] Where: A is the vector representation of parameter 1, and B is the vector representation of a document fragment in the network source security special knowledge base;

[0032] S422, BM25 relevance calculation; perform morpheme analysis on parameter 1 to generate a word set Q of parameter 1; for each document fragment original text D in the network source security dedicated knowledge base, calculate the relevance score of each word qi in Q with D, and generate a relevance ranking result set of the document fragment original text and parameter 1; the specific calculation is as follows:

[0033]

[0034] Where Q is the word set of parameter 1; D is the original text of a document fragment in the knowledge base; qi is a word in Q; TF(qi,D) is the word frequency of word qi in document D; IDF(qi) is the inverse document frequency of word qi; |D| is the length of document D; avgdl is the average length of the document set; k and b are adjustment parameters, which are the weights for controlling word frequency and document length respectively;

[0035] S423, using the RRF algorithm to fuse the vector similarity calculation results and the BM25 correlation calculation results according to the weights to generate the final document fragment ranking, the specific calculation is as follows:

[0036]

[0037] Where D is the original text of a document fragment in the knowledge base; n is the number of retrieval methods involved in the fusion, n = 2; Ranki (D) is the ranking position of document D in the i-th retrieval method, and k' is the smoothing parameter;

[0038] S424. According to the final document fragment ranking, the document source that best matches parameter 1 is obtained, and the original description fragment of the corresponding clause is obtained; and it is returned in the form of a json text string as parameter 2.

[0039] Preferably, the acquisition of the test file data, equipment ledger data and on-site inspection data is specifically as follows:

[0040] Test file data: The test files uploaded by each power plant, including test reports and setting sheets, are converted into machine-readable text formats through OCR recognition through the file library of the network source coordination platform data center, and the required parameter information is extracted through the configured template;

[0041] Equipment ledger data: The data of the network source coordination platform and other power grid platforms or systems can be connected through the control cloud platform to read the equipment ledger data of other power grid platforms or systems in real time;

[0042] On-site inspection data: On-site inspectors enter actual data of the on-site inspection through the entrance provided by the app.

[0043] A system for intelligently analyzing network-source security inspection clauses based on a large language model, comprising a processor, a memory, and a computer program stored in the memory. When the processor executes the computer program, it specifically performs the steps in the above-mentioned method for intelligently analyzing network-source security inspection clauses based on a large language model.

[0044] Compared with the prior art, the present invention has the following beneficial effects:

[0045] (1) Reduce training costs: Traditional professional large models require high-cost fine-tuning training to adapt to the needs of specific fields. Based on the universal capabilities of large language models, the present invention does not require complex fine-tuning processes. It can realize intelligent judgment in the field of network source security by combining network source-specific models and knowledge bases, significantly reducing computing resources and hardware costs. Existing servers can meet operating requirements without the need to purchase additional expensive equipment.

[0046] (2) Improve the efficiency of network security assessment: Through automated analysis and intelligent assessment, the big model can quickly process massive amounts of unstructured clause data, achieving accurate matching and rapid positioning. Compared with traditional manual verification methods, time consumption is greatly reduced, and assessment efficiency is increased several times, meeting the efficiency needs in actual work.

[0047] (3) Improve the accuracy and reliability of judgment: Relying on the construction and optimization of network-specific models and knowledge bases, the system has the ability to accurately locate reference files to ensure that the basis for judgment is clear and unambiguous. Combined with multi-source data input (such as test reports, equipment ledgers, on-site input data, etc.), the model can make scientific judgments based on information from multiple parties, thereby improving the credibility and operability of the judgment conclusions.

[0048] (4) Social and economic benefits: Reduce safety accidents. Through comprehensive network security assessment, potential security loopholes can be discovered and repaired in a timely manner, reducing power grid accidents caused by network security issues and ensuring the stable operation of the power system; reduce economic losses. Network security issues may cause huge economic losses, including direct maintenance costs and indirect economic losses (such as production suspension, compensation, etc.). Through network security assessment, these losses can be significantly reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 Construct a flow chart for the intelligent analysis system of the present invention;

[0050] Figure 2 A Markdown format file after file preprocessing in an embodiment of the present invention;

[0051] Figure 3 This is a flow chart of the text segmentation method of the present invention;

[0052] Figure 4This is a flow chart of the network source dedicated model pre-training method of the present invention;

[0053] Figure 5 This is a flow chart of the hybrid file positioning method of the present invention;

[0054] Figure 6 This is the overall architecture diagram of the vLLM of the present invention;

[0055] Figure 7 This is a diagram of the large model analysis results in one embodiment of the present invention. DETAILED DESCRIPTION

[0056] The technical solution of the present invention is described in detail below in conjunction with the accompanying drawings.

[0057] The present invention proposes an intelligent analysis method for network source related network security inspection clauses based on a large language model, such as Figure 1 , specifically including the following steps:

[0058] S1. Collect network security assessment clauses and supporting documents; collect supporting documents including relevant dispatching procedures, relevant laws and regulations, and relevant notification documents, etc.;

[0059] S2. Use the network security assessment clauses and basis documents to pre-train and fine-tune the general Embedding model to build a network source-specific model;

[0060] S3. Preprocess and segment the network security assessment basis documents, and vectorize the segmented text segments using a network source-specific model, and store the vectorized text segments and the corresponding original text in a database to build a network source security-specific knowledge base;

[0061] The vectorized fragments are stored in the vector database as the basis for large-scale model analysis, and the original text can be displayed to users as evidence for analysis, so that users can check the correctness of the analysis.

[0062] S4. Combine the big model with the network source security-specific knowledge base to conduct intelligent analysis and judgment of network-related security inspection clauses.

[0063] In this embodiment, the construction of the network source dedicated model specifically includes the following steps:

[0064] S21. Based on the network security assessment clauses and the reference documents, a set of professional keywords related to network security assessment is screened, each keyword is defined as a single Token, and the embedded representation of each keyword is obtained by processing it through a general Embedding model;

[0065] S22. Add the embedding representation of the keyword set to the embedding layer of the general Embedding model, including expanding the word segmenter to include the newly added keywords, adjusting the embedding layer size to accommodate these keywords, and assigning the embedding representation of the keyword set to the embedding layer weight of the general Embedding model, completing the pre-training and fine-tuning of the general Embedding model to obtain a network source-specific model.

[0066] Many Embedding models use subword decomposition strategies (such as BPE, WordPiece), which may cause domain-specific keywords to be incorrectly split, thereby affecting semantic consistency. In order to optimize the word segmentation effect of the Embedding model, the present invention directly defines relevant keywords such as "excitation system", "critical gain value", "load change" as a single Token, and pre-trains and fine-tunes the Embedding model. This process ensures that the model can understand and effectively process network source professional keywords in the file in subsequent use. The pre-trained network source-specific model will reduce positioning errors in the process of intelligent file positioning, accurately match user queries with document content, and significantly shorten the length of the text vector sequence, reduce computational complexity, and improve the overall efficiency of the model. The specific process is as follows: Figure 4 shown.

[0067] In this embodiment, the pre-processing of the network security assessment basis file is specifically as follows:

[0068] For the network security assessment basis documents in PDF format, they are converted into editable text through OCR recognition, and the general large language model is used to intelligently process the file content and automatically format it into Markdown format according to the key points. Figure 2 As shown in the figure, simple symbols in Markdown are used to mark the hierarchical relationship, list items and key contents of the text, so that it can be stored in the network source dedicated knowledge base with a clearer structure. This format not only improves the recall rate during intelligent analysis, but also significantly improves the accuracy of the analysis results.

[0069] In this embodiment, Figure 3 As shown, the text segmentation is specifically as follows:

[0070] Transform the tables and pictures in the text data; the tables are processed row by row in the manner of "table name header-horizontal header-vertical data value", and the pictures are replaced by generating a UID index;

[0071] Read and record the length X of each paragraph of the text data, and obtain a normal distribution by statistically analyzing the probability of the length X appearing in different level intervals [0, 50, 100, ...,] to determine the optimal block length μ;

[0072] The text data is divided into paragraphs; for paragraphs whose length exceeds the optimal block length μ, the part exceeding the optimal block length μ is cut out without splitting the sentence. If the cut-out part is still larger than the optimal block length μ, the part exceeding the optimal block length μ is continued to be cut out without splitting the sentence until all blocks do not exceed the optimal block length μ.

[0073] Text segmentation is an important step in natural language processing (NLP). It divides text data into smaller units to facilitate the location and recall of related documents. The processing of corpus is crucial. This paper provides a reasonable document content segmentation method to ensure the integrity of sentences, ensure that the same semantic unit will not be separated, avoid semantic loss, and flexibly and dynamically retain the distinction between paragraphs, thereby further improving the recall rate and improving the retrieval accuracy.

[0074] In this embodiment, text vectorization is to convert text content into vector form to facilitate file location and recall. Using the above-mentioned pre-trained and fine-tuned network source-specific model, the network security assessment basis file is vectorized to improve the efficiency and accuracy of subsequent intelligent judgment.

[0075] In this embodiment, the construction of a network source security-specific knowledge base is specifically to vectorize the network source-related network security assessment that has been processed by a special model according to the file content based on the Faiss vector database, and store the generated data in the database, thereby constructing a network source-specific knowledge base.

[0076] In this embodiment, the deployment of the model in S4 is as follows: select the open source large model Qwen2.5 as the core engine tool for inspection clause analysis and judgment, and use the open source reasoning engine vLLM as the startup tool of the large model. The overall architecture of vLLM is as follows Figure 6 As shown in the figure, the vLLM inference engine can significantly improve the reasoning efficiency of the model and effectively reduce resource consumption, which is particularly suitable for deployment and service scenarios.

[0077] In this embodiment, S4 is specifically:

[0078] S41, clause configuration; the inspection clauses of the network source network-related safety evaluation are solidified into a program configuration file, and the clause contents corresponding to the inspection items are extracted during the judgment as parameter 1; specifically, the network-related safety evaluation work of power plants under the jurisdiction of the provincial dispatching department mainly covers six major disciplines: dispatching operation and safety management, system operation, relay protection, dispatching automation, power system communication, hydropower and new energy. The clauses of each discipline are numbered, and the inspection template is fixed as the configuration file. During the judgment, the program reads the clause contents of the corresponding inspection items in the configuration template as parameter 1;

[0079] S42, based on file matching; by using a hybrid positioning method of vector similarity and BM25 algorithm, extract the source of the base file corresponding to parameter 1 and its original text, and generate parameter 2; Figure 5 As shown in the figure, vector similarity is a commonly used positioning method in RAG technology. It quantifies the similarity between the two by calculating the cosine similarity of the vectorized sentences. The BM25 algorithm starts from another dimension and evaluates based on the relevance between the search terms and the documents. Finally, the Reciprocal Ranking Fusion (RRF) algorithm is introduced to weightedly fuse the file relevance ranking results generated by the two methods to generate a unified result set, which can achieve more accurate file positioning.

[0080] S43, obtaining the inspected data as parameter 3; the inspected data includes test file data, equipment ledger data and on-site inspection data;

[0081] S44. Input parameters 1, 2 and 3 into the Qwen2.5 large model. The large model conducts comprehensive analysis and judgment on the input conditions according to the prompt template, and outputs the judgment results in the specified format.

[0082] In this embodiment, the S42 specifically includes the following steps:

[0083] S421, vector similarity calculation; parameter 1 (question statement) is passed into the network source dedicated model for vectorization, and the similarity between the vectorized document fragments in the network source security dedicated knowledge base is calculated to generate a similarity ranking result set between the vectorized document fragments and parameter 1. The vector similarity is calculated using the cosine similarity algorithm:

[0084]

[0085] Where: A is the vector representation of parameter 1, and B is the vector representation of a document fragment in the network source security special knowledge base;

[0086] S422, BM25 relevance calculation; perform morpheme analysis on parameter 1 to generate a word set Q of parameter 1; for each document fragment original text D in the network source security dedicated knowledge base, calculate the relevance score of each word qi in Q with D, and generate a relevance ranking result set of the document fragment original text and parameter 1; the specific calculation is as follows:

[0087]

[0088] Where Q is the word set of parameter 1; D is the original text of a document fragment in the knowledge base; qi is a word in Q; TF(qi,D) is the word frequency of word qi in document D; IDF(qi) is the inverse document frequency of word qi; |D| is the length of document D (in terms of words); avgdl is the average length of the document set; k and b are adjustment parameters, which are the weights for controlling word frequency and document length respectively;

[0089] The following is a partial explanation of the calculations in the BM25 formula:

[0090] Inverse Document Frequency (IDF) reflects the importance of a word in the entire document collection; if a word appears in most documents, its discrimination is low and its contribution to relevance is limited; if a word only appears in a few documents, it has higher importance. The calculation formula is as follows:

[0091]

[0092] Where N represents the total number of documents, n(qi): the number of documents containing the word qi;

[0093] Term frequency (TF) is defined as the number of times a term qi appears in document D. The more frequently a term appears in a document, the more important it is in describing the document. However, relying solely on term frequency may result in longer documents being more likely to get high scores, so it is necessary to normalize it based on document length;

[0094] Document length normalization: Since longer documents may contain more irrelevant information, while shorter documents are usually more focused on the topic, we need to normalize the document length. By introducing the normalization factor It can suppress the score bias of long documents and ensure that the model has good adaptability to documents of different lengths.

[0095] S423, using the RRF algorithm to fuse the vector similarity calculation results and the BM25 correlation calculation results according to the weights to generate the final document fragment ranking, the specific calculation is as follows:

[0096]

[0097] Where D is the original text of a document fragment in the knowledge base; n is the number of retrieval methods involved in the fusion (here it is 2, i.e. BM25 and vector retrieval); Ranki(D) is the ranking position of document D in the i-th retrieval method (starting from 1, the higher the correlation between the document and the question statement), and k' is a smoothing parameter; the RRF algorithm can comprehensively reflect the evaluation of document relevance by different retrieval methods by fusing the ranking positions of multiple retrieval methods;

[0098] S424. According to the final document fragment ranking, the document source that best matches parameter 1 is obtained, and the original description fragment of the corresponding clause is obtained; and it is returned in the form of a json text string as parameter 2.

[0099] In this embodiment, the acquisition of the test file data, equipment ledger data and on-site inspection data is specifically as follows:

[0100] Test file data: Through the file library of the network source coordination platform data center, the test reports, setting sheets and other files uploaded by each power plant are converted into machine-recognizable text formats through OCR recognition, and the required parameter information is extracted through the configured template;

[0101] Equipment ledger data: Through the control cloud platform, the network source platform realizes the data connection with other platforms, and can read the equipment ledger data of d5000, oms, water, electricity, new energy and other systems in real time;

[0102] On-site inspection data: Some inspection clauses require experts to go to the site and describe the actual situation of the on-site inspection. The app provides an entry for inspectors to describe and enter relevant information.

[0103] The information data obtained through the above three methods according to different inspection clauses is used as parameter 3.

[0104] In this embodiment, S44 is specifically:

[0105] Through the prompt project, we make prompt templates. Before asking questions to the big model, the program first reads the template content, and inputs the preconditions, expected goals, actual requirements, etc. of different inspection clauses into the big model to help it better understand the task and input. For parameters involving logical comparison and formula judgment, we formulate templates for specific tasks to guide the model to generate answers that meet the requirements of the question, so as to help the model better generate outputs that meet the requirements. Finally, parameters 1, 2, and 3 are passed to the big model Qwen2.5, which performs reasoning and gives the judgment results.

[0106] The present invention also proposes a system for intelligent analysis of network-source security inspection clauses based on a large language model, comprising a processor, a memory, and a computer program stored in the memory. When the processor executes the computer program, it specifically executes the steps in the above-mentioned method for intelligent analysis of network-source security inspection clauses based on a large language model.

[0107] A specific example is provided below:

[0108] 1) Before asking questions, inform the big model that it will be given a text of a network source network security assessment inspection content table and a text of a power plant test report, and it needs to judge whether the latter meets the specifications based on the former;

[0109] 2) Network source network security assessment inspection content table for PSS test requirements: During the test, the critical gain value is actually measured, and the gain setting value of PSS is generally within the range of 1 / 3 to 1 / 5 of the critical gain.

[0110] 3) OCR extracts relevant results from the test report of a power plant. The original text is as follows: Picture 4 is a recording of the PSS gain of Unit 4 of Tingxi Power Plant when it is Ks1=35. It can be seen that the excitation voltage of the exciter continues to fluctuate at this time. Based on this, it can be judged that this gain is the critical gain of PSS under this parameter. According to the "Power System Stabilizer Setting Test Guidelines", the PSS operating gain is Ks1=9. Picture 5 is a recording of the PSS gain of Unit 4 of Tingxi Power Plant when it is Ks1=9.

[0111] 4) The corresponding content is transferred to the big model to obtain the judgment results, such as Figure 7 shown.

[0112] The above are preferred embodiments of the present invention. Any changes made according to the technical solution of the present invention, as long as the resulting functions do not exceed the scope of the technical solution of the present invention, belong to the protection scope of the present invention.

Claims

1. A method for intelligent analysis of network-related security inspection clauses based on a large language model, characterized in that: The specific steps include: S1. Collect network security assessment clauses and supporting documents; S2. Use the network security assessment clauses and basis documents to pre-train and fine-tune the general Embedding model to build a network source-specific model; S3. Preprocess and segment the network security assessment basis documents, and vectorize the segmented text segments using a network source-specific model, and store the vectorized text segments and the corresponding original text in a database to build a network source security-specific knowledge base; S4. Combine the big model with the network source security-specific knowledge base to conduct intelligent analysis and judgment of network-related security inspection clauses.

2. According to claim 1, a method for intelligent analysis of network-related security inspection clauses based on a large language model, characterized in that: The construction of the network source dedicated model specifically includes the following steps: S21. Based on the network security assessment clauses and the reference documents, a set of professional keywords related to network security assessment is screened, each keyword is defined as a single Token, and the embedded representation of each keyword is obtained by processing it through a general Embedding model; S22. Add the embedding representation of the keyword set to the embedding layer of the general Embedding model, including expanding the word segmenter, adjusting the embedding layer size, and assigning the embedding representation of the keyword set to the embedding layer weight of the general Embedding model, completing the pre-training and fine-tuning of the general Embedding model, and obtaining a network source-specific model.

3. According to the method of intelligent analysis and judgment of network-source network-related security inspection clauses based on a large language model according to claim 1, it is characterized in that: The preprocessing of network security assessment basis documents is as follows: for network security assessment basis documents in PDF format, they are converted into editable text through OCR recognition, and the general large language model is used to automatically typeset the file content into Markdown format files.

4. According to claim 1, a method for intelligent analysis of network-related security inspection clauses based on a large language model, characterized in that: The text segmentation is specifically as follows: Transform the tables and pictures in the text data; the tables are processed row by row in the manner of "table name header-horizontal header-vertical data value", and the pictures are replaced by generating a UID index; Read and record the segment length X of each paragraph of the text data, and obtain a normal distribution by statistically analyzing the probability of segment length X appearing in different level intervals to determine the optimal block length μ; The text data is divided into paragraphs; for paragraphs whose length exceeds the optimal block length μ, the part exceeding the optimal block length μ is cut out without splitting the sentence. If the cut-out part is still larger than the optimal block length μ, the part exceeding the optimal block length μ is continued to be cut out without splitting the sentence until all blocks do not exceed the optimal block length μ.

5. According to claim 1, a method for intelligent analysis of network-related security inspection clauses based on a large language model, characterized in that: The construction of the network source security-specific knowledge base is based on the Faiss vector database, and the vectorized text fragments are stored in the Faiss vector database.

6. According to claim 1, a method for intelligently analyzing network-related security inspection clauses based on a large language model, characterized in that: The deployment of the model in S4 is specifically as follows: the open source big model Qwen2.5 is selected as the core engine tool for inspection clause analysis and judgment, and the open source reasoning engine vLLM is used as the startup tool of the big model.

7. According to claim 6, a method for intelligent analysis of network-related security inspection clauses based on a large language model, characterized in that: The S4 is specifically: S41, clause configuration: solidify the inspection clauses of the network source network security assessment into a program configuration file, and extract the clause content corresponding to the inspection item during the analysis and judgment as parameter 1; S42, matching based on the file; extracting the source of the based file and its original text corresponding to parameter 1 through a hybrid positioning method of vector similarity and BM25 algorithm, and generating parameter 2; S43, obtaining the inspected data as parameter 3; the inspected data includes test file data, equipment ledger data and on-site inspection data; S44. Input parameters 1, 2 and 3 into the Qwen2.5 large model. The large model conducts comprehensive analysis and judgment on the input conditions according to the prompt template, and outputs the judgment results in the specified format.

8. According to claim 6, a method for intelligently analyzing network-related security inspection clauses based on a large language model, characterized in that: The S42 specifically includes the following steps: S421, vector similarity calculation; parameter 1 is passed into the network source dedicated model for vectorization, and the similarity between the vectorized document fragments and the network source security dedicated knowledge base is calculated to generate a similarity ranking result set between the vectorized document fragments and parameter 1. The vector similarity is calculated using the cosine similarity algorithm: Where: A is the vector representation of parameter 1, and B is the vector representation of a document fragment in the network source security special knowledge base; S422, BM25 relevance calculation; perform morpheme analysis on parameter 1 to generate a word set Q of parameter 1; for each document fragment original text D in the network source security dedicated knowledge base, calculate the relevance score of each word qi in Q with D, and generate a relevance ranking result set of the document fragment original text and parameter 1; the specific calculation is as follows: Where Q is the word set of parameter 1; D is the original text of a document fragment in the knowledge base; qi is a word in Q; TF(qi,D) is the word frequency of word qi in document D; IDF(qi) is the inverse document frequency of word qi; |D| is the length of document D; avgdl is the average length of the document set; k and b are adjustment parameters, which are the weights for controlling word frequency and document length respectively; S423, using the RRF algorithm to fuse the vector similarity calculation results and the BM25 correlation calculation results according to the weights to generate the final document fragment ranking, the specific calculation is as follows: Where D is the original text of a document fragment in the knowledge base; n is the number of retrieval methods involved in the fusion, n = 2; Ranki (D) is the ranking position of document D in the i-th retrieval method, and k' is the smoothing parameter; S424. According to the final document fragment ranking, the document source that best matches parameter 1 is obtained, and the original description fragment of the corresponding clause is obtained; and it is returned in the form of a json text string as parameter 2.

9. According to claim 6, a method for intelligent analysis of network-related security inspection clauses based on a large language model, characterized in that: The acquisition of the test document data, equipment ledger data and on-site inspection data is specifically as follows: Test file data: The test files uploaded by each power plant, including test reports and setting sheets, are converted into machine-readable text formats through OCR recognition through the file library of the network source coordination platform data center, and the required parameter information is extracted through the configured template; Equipment ledger data: The data of the network source coordination platform and other power grid platforms or systems can be connected through the control cloud platform to read the equipment ledger data of other power grid platforms or systems in real time; On-site inspection data: On-site inspectors enter actual data of the on-site inspection through the entrance provided by the app.

10. An intelligent judgment system for network-related security inspection clauses based on a large language model, characterized in that: It includes a processor, a memory and a computer program stored in the memory. When the processor executes the computer program, it specifically executes the steps in the method for intelligent analysis of network-related security inspection clauses based on a large language model as described in any one of claims 1 to 9.

Images