A method and system for intelligent research and judgment of network source network security inspection clauses based on a large language model

Abstract

The application provides a network source network security inspection clause intelligent research and judgment method and system based on a large language model, the method comprises the following steps: S1, collecting network security evaluation clauses and basis files; S2, pre-training and fine-tuning a general Embedding model using network security evaluation clauses and basis files to construct a network source special model; S3, preprocessing and text segmentation are performed on the network security evaluation basis files, and text vectorization processing is performed through the network source special model, the vectorized text segments and the corresponding original text are stored in a database to construct a network source security special knowledge base; S4, intelligent research and judgment of network security inspection clauses are combined with a large model and the network source security special knowledge base. The application fully utilizes the advantages of the large language model in natural language understanding, and accurately locates the clause basis files in combination with the network source security special model, can efficiently process a large number of non-structured network security inspection clauses, so as to realize intelligent and efficient research and judgment.

Description

Technical Field

[0001] This invention relates to the field of security assessment technology, specifically to a method and system for intelligent analysis of network source security inspection clauses based on a large language model. Background Technology

[0002] Traditional power plant grid connection safety inspections typically rely on inspection teams manually checking each item one by one, comparing and analyzing the on-site situation with the regulations, and recording any problems. This method often requires 5 to 6 people and takes about 2 days, which is a large workload and is prone to affecting the quality of the inspection due to human error.

[0003] Furthermore, security assessment technologies based on general models or a combination of general models and specialized models in the field of power grid equipment operation and maintenance face challenges. Because grid security inspection clauses are typically presented in unstructured form with complex and diverse sentence structures, traditional artificial intelligence models, rule bases, or knowledge graphs struggle to achieve comprehensive and flexible intelligent judgment. Moreover, traditional rule bases rely on manually set keyword templates, achieving semantic understanding by matching user-input keywords; this method requires extensive manual configuration and maintenance. Additionally, fine-tuning and training specialized monitoring models based on general models not only consumes significant computing resources and places extremely high demands on equipment performance but also faces issues of high hardware costs and lengthy training times.

[0004] Large language models, on the other hand, employ deep learning methods, particularly the Transformer architecture, training on massive amounts of text data to capture the underlying patterns of language. These models can automatically learn and extract features without manual definition. Furthermore, large language models have good generalization capabilities, meaning they can handle various natural language processing tasks in diverse scenarios, such as text classification, question answering, and dialogue.

[0005] To improve the automation and intelligence of network source security inspections, achieve accurate matching and intelligent judgment of security inspection clauses, promote the innovative development of network source security inspection technology, and improve inspection efficiency and quality, reduce costs, and promote the scientific and standardized management of security, this invention proposes a method and system for intelligent judgment of network source security inspection clauses based on a large language model. Summary of the Invention

[0006] The purpose of this invention is to propose an intelligent analysis method and system for network source security inspection clauses based on a large language model. This method fully leverages the advantages of the large language model in natural language understanding and combines it with a dedicated network source security model to accurately locate the supporting documents for the clauses. It can efficiently process a large number of unstructured network security inspection clauses, thereby achieving intelligent and efficient analysis.

[0007] To achieve the above objectives, the technical solution of the present invention is as follows:

[0008] A method for intelligently judging network source security inspection clauses based on a large language model, specifically including the following steps:

[0009] S1. Collect relevant cybersecurity assessment clauses and supporting documents;

[0010] S2. Use the relevant cybersecurity assessment clauses and supporting documents to pre-train and fine-tune the general embedding model in order to construct a network source-specific model;

[0011] S3. Preprocess and segment the documents that support the cybersecurity assessment, and use a dedicated network source model to vectorize the segmented text. Store the vectorized text segments and the corresponding original text in the database to build a dedicated network source security knowledge base.

[0012] S4. Intelligent analysis and judgment of network security inspection clauses by combining large models with a dedicated network source security knowledge base.

[0013] Preferably, the construction of the network source-specific model specifically includes the following steps:

[0014] S21. Based on the provisions and supporting documents of cybersecurity assessment, select a set of professional keywords for cybersecurity assessment, define each keyword as a single token, process them through a general embedding model, and obtain the embedded representation of each keyword.

[0015] S22. Add the embedding representation of the keyword set to the embedding layer of the general embedding model, including expanding the word segmenter, adjusting the size of the embedding layer, and assigning the embedding representation of the keyword set to the embedding layer weights of the general embedding model. This completes the pre-training and fine-tuning of the general embedding model and obtains the network source-specific model.

[0016] Preferably, the preprocessing of the cybersecurity assessment basis documents specifically involves: for PDF format cybersecurity assessment basis documents, converting them into editable text through OCR recognition, and automatically formatting the document content into Markdown format using a general large language model.

[0017] Preferably, the text segmentation specifically includes:

[0018] The tables and images in the text data are transformed and processed; the tables are processed row by row according to the format of "table name and header - horizontal header - vertical data value", and the images are replaced with a UID index generated;

[0019] Read and record the paragraph length X of each paragraph of the text data. Obtain the normal distribution by statistically analyzing the probability of paragraph length X appearing in different level intervals, and use it to determine the optimal block length μ.

[0020] The text data is segmented into paragraphs. For paragraphs whose length exceeds the optimal block length μ, the portion exceeding the optimal block length μ is cut out without splitting the sentence. If the cut-out portion is still larger than the optimal block length μ, the portion exceeding the optimal block length μ is cut out again without splitting the sentence, until all blocks do not exceed the optimal block length μ.

[0021] Preferably, the construction of the dedicated knowledge base for network source security is based on the Faiss vector database, and the vectorized text fragments are stored in the Faiss vector database.

[0022] Preferably, the deployment of the model in S4 is as follows: the open-source large model Qwen2.5 is selected as the core engine tool for checking clause analysis and judgment, and the open-source inference engine vLLM is used as the startup tool for the large model.

[0023] Preferably, S4 specifically comprises:

[0024] S41, Clause Configuration; The inspection clauses for network source security assessment are solidified into a program configuration file. During the analysis, the clause content corresponding to the inspection item is extracted and used as parameter 1.

[0025] S42. Based on file matching; using a hybrid localization method combining vector similarity and BM25 algorithm, extract the source and original text of the file corresponding to parameter 1, and generate parameter 2;

[0026] S43. Obtain the data to be inspected as parameter 3; the data to be inspected includes test document data, equipment ledger data, and on-site inspection data;

[0027] S44. Input parameters 1, 2 and 3 into the Qwen2.5 large model. The large model will perform comprehensive analysis and judgment on the input conditions according to the prompt template, and output the judgment results in the specified format.

[0028] Preferably, step S42 specifically includes the following steps:

[0029] S421, Vector Similarity Calculation: Input parameter 1 into the network source-specific model for vectorization, and calculate the similarity between it and the vectorized document fragments in the network source security-specific knowledge base. Generate a similarity ranking result set between the vectorized document fragments and parameter 1. The vector similarity is calculated using the cosine similarity algorithm.

[0030]

[0031] Where: A is the vector representation of parameter 1, and B is the vector representation of a document fragment in the NetSource Security Knowledge Base;

[0032] S422 and BM25 relevance calculation; perform morpheme parsing on parameter 1 to generate the word set Q of parameter 1; for each document fragment D in the network source security knowledge base, calculate the relevance score of each word qi in Q with D, and generate a relevance ranking result set of the document fragment original text and parameter 1; the specific calculation is as follows:

[0033]

[0034] Where Q is the word set of parameter 1; D is the original text of a document fragment in the knowledge base; qi is a word in Q; TF(qi,D) is the word frequency of word qi in document D; IDF(qi) is the inverse document frequency of word qi; |D| is the length of document D; avgdl is the average length of the document set; k and b are adjustment parameters, which are the weights for controlling word frequency and document length, respectively;

[0035] S423. Using the RRF algorithm, the vector similarity calculation results and the BM25 relevance calculation results are fused according to weights to generate the final document fragment ranking. The specific calculation is as follows:

[0036]

[0037] Where D is a document fragment in the knowledge base; n is the number of retrieval methods involved in the fusion, n = 2; Rangi(D) is the ranking position of document D in the i-th retrieval method, and k' is the smoothing parameter;

[0038] S424. Based on the final document fragment ranking, obtain the source of the document that best matches parameter 1, and obtain the original text description fragment of the corresponding clause; return it as parameter 2 in the form of a JSON text string.

[0039] Preferably, the acquisition of the test document data, equipment ledger data, and on-site inspection data specifically involves:

[0040] Test document data: Test documents uploaded by each power plant, including test reports and setting sheets, are converted into machine-readable text format through OCR recognition via the data center file library of the network source coordination platform, and the required parameter information is extracted through the configured template;

[0041] Equipment ledger data: Through the control cloud platform, the data connection between the grid-source coordination platform and other power grid platforms or systems is realized, so as to read the equipment ledger data of other power grid platforms or systems in real time;

[0042] On-site inspection data: On-site inspectors enter actual data from on-site inspections through the entry point provided by the app.

[0043] A network source security inspection clause intelligent judgment system based on a large language model includes a processor, a memory, and a computer program stored in the memory. When the processor executes the computer program, it specifically performs the steps in the above-mentioned network source security inspection clause intelligent judgment method based on a large language model.

[0044] Compared with the prior art, the present invention has the following beneficial effects:

[0045] (1) Reduced training costs: Traditional large-scale professional models require costly fine-tuning training to adapt to the needs of specific domains. However, this invention, based on the general capabilities of large language models, eliminates the need for complex fine-tuning processes. By combining network source-specific models and knowledge bases, intelligent assessment in the field of network source security can be achieved, significantly reducing computing resources and hardware costs. Existing servers can meet the operational requirements, eliminating the need to purchase additional expensive equipment.

[0046] (2) Improve the efficiency of cybersecurity assessment: Through automated analysis and intelligent judgment, the large model can quickly process massive amounts of unstructured clause data, achieving accurate matching and rapid location. Compared with traditional manual verification methods, the time consumption is greatly reduced, and the assessment efficiency is improved several times, meeting the high-efficiency needs in actual work.

[0047] (3) Improve the accuracy and reliability of the assessment: Based on the construction and optimization of the network source-specific model and knowledge base, the system has the ability to accurately locate the supporting documents, ensuring that the basis for the assessment is clear and unambiguous. Combined with multi-source data input (such as test reports, equipment ledgers, on-site data, etc.), the model can make scientific judgments by integrating information from multiple sources, thereby improving the credibility and operability of the assessment conclusions.

[0048] (4) Socioeconomic benefits: Reduced safety incidents: Through comprehensive cybersecurity assessments, potential security vulnerabilities can be identified and repaired in a timely manner, reducing power grid accidents caused by cybersecurity issues and ensuring the stable operation of the power system; Reduced economic losses: Cybersecurity issues can lead to huge economic losses, including direct maintenance costs and indirect economic losses (such as production stoppages and compensation). Cybersecurity assessments can significantly reduce these losses. Attached Figure Description

[0049] Figure 1 This is a flowchart illustrating the construction process of the intelligent judgment system of this invention.

[0050] Figure 2 This is a Markdown format file after preprocessing, as described in one embodiment of the present invention.

[0051] Figure 3 This is a flowchart of the text segmentation method of the present invention;

[0052] Figure 4This is a flowchart of the pre-training method for the network source-specific model of the present invention;

[0053] Figure 5 This is a flowchart of the hybrid file location method of the present invention;

[0054] Figure 6 This is a diagram of the overall architecture of the vLLM of this invention;

[0055] Figure 7 This is a diagram showing the large model analysis results in one embodiment of the present invention. Detailed Implementation

[0056] The technical solution of the present invention will now be described in detail with reference to the accompanying drawings.

[0057] This invention proposes an intelligent judgment method for network source security inspection clauses based on a large language model, such as... Figure 1 Specifically, it includes the following steps:

[0058] S1. Collect relevant cybersecurity assessment clauses and supporting documents; collect relevant supporting documents including relevant dispatch procedures, relevant laws and regulations, and relevant notification documents, etc.

[0059] S2. Use the relevant cybersecurity assessment clauses and supporting documents to pre-train and fine-tune the general embedding model in order to construct a network source-specific model;

[0060] S3. Preprocess and segment the documents that support the cybersecurity assessment, and use a dedicated network source model to vectorize the segmented text. Store the vectorized text segments and the corresponding original text in the database to build a dedicated network source security knowledge base.

[0061] Among them, the vectorized fragments are stored in the vector database as the basis for large model analysis, while the original text is stored in the database and can be displayed to users as evidence for analysis, so that users can easily verify the correctness of the analysis.

[0062] S4. Intelligent analysis and judgment of network security inspection clauses by combining large models with a dedicated network source security knowledge base.

[0063] In this embodiment, the construction of the dedicated network source model specifically includes the following steps:

[0064] S21. Based on the provisions and supporting documents of cybersecurity assessment, select a set of professional keywords for cybersecurity assessment, define each keyword as a single token, process them through a general embedding model, and obtain the embedded representation of each keyword.

[0065] S22. Add the embedding representation of the keyword set to the embedding layer of the general embedding model, including expanding the word segmenter to include the new keywords, adjusting the size of the embedding layer to accommodate these keywords, and assigning the embedding representation of the keyword set to the embedding layer weights of the general embedding model. This completes the pre-training and fine-tuning of the general embedding model and obtains the network source-specific model.

[0066] Many embedding models employ word segmentation strategies (such as BPE and WordPiece), which can lead to incorrect segmentation of domain-specific keywords, thus affecting semantic consistency. To optimize the word segmentation performance of embedding models, this invention directly defines relevant keywords such as "excitation system," "critical gain value," and "load variation" as individual tokens and pre-trains and fine-tunes the embedding model. This process ensures that the model can understand and effectively process domain-specific keywords in files during subsequent use. The pre-trained domain-specific model will reduce positioning errors during intelligent file location analysis, accurately match user queries with document content, significantly shorten the text vector sequence length, reduce computational complexity, and improve the overall efficiency of the model. The specific process is as follows: Figure 4 As shown.

[0067] In this embodiment, the preprocessing of the cybersecurity assessment documents specifically involves:

[0068] For PDF-format cybersecurity assessment documents, OCR is used to convert them into editable text, and a general large language model is used to intelligently process the document content, automatically formatting it into Markdown format according to key points. For example... Figure 2 As shown, simple symbols in Markdown are used to identify the hierarchical relationships, list items, and key content of the text, thus storing it in the dedicated knowledge base of web sources with a clearer structure. This format not only improves the recall rate during intelligent analysis but also significantly enhances the accuracy of the analysis results.

[0069] In this embodiment, as Figure 3 As shown, the text segmentation specifically involves:

[0070] The tables and images in the text data are transformed and processed; the tables are processed row by row according to the format of "table name and header - horizontal header - vertical data value", and the images are replaced with a UID index generated;

[0071] Read and record the paragraph length X of each paragraph of the text data. Obtain a normal distribution by statistically analyzing the probability of paragraph length X appearing in different level intervals [0, 50, 100, ...,], and use this to determine the optimal block length μ.

[0072] The text data is segmented into paragraphs. For paragraphs whose length exceeds the optimal block length μ, the portion exceeding the optimal block length μ is cut out without splitting the sentence. If the cut-out portion is still larger than the optimal block length μ, the portion exceeding the optimal block length μ is cut out again without splitting the sentence, until all blocks do not exceed the optimal block length μ.

[0073] Text segmentation is a crucial step in Natural Language Processing (NLP), dividing text data into smaller units to facilitate the location and recall of relevant documents. Corpus processing is of paramount importance. This paper presents a reasonable document content segmentation method that ensures sentence integrity, prevents the same semantic unit from being separated, avoids semantic loss, and flexibly and dynamically preserves the distinguishability between paragraphs, thereby further improving recall and retrieval accuracy.

[0074] In this embodiment, text vectorization processing converts text content into vector form to facilitate file location and retrieval. Using the pre-trained and fine-tuned network source-specific model described above, the documents used for network security assessment are vectorized, improving the efficiency and accuracy of subsequent intelligent analysis.

[0075] In this embodiment, the construction of the dedicated knowledge base for network source security specifically involves using the Faiss vector database as a foundation, vectorizing the content of network source cybersecurity assessment documents processed by a dedicated model, and storing the generated data in the database, thereby constructing the dedicated knowledge base for network sources.

[0076] In this embodiment, the deployment of the model in S4 specifically involves selecting the open-source large model Qwen2.5 as the core engine tool for clause analysis and judgment, and simultaneously using the open-source inference engine vLLM as the startup tool for the large model. The overall architecture of vLLM is as follows: Figure 6 As shown, the vLLM inference engine can significantly improve the inference efficiency of the model and effectively reduce resource consumption, making it particularly suitable for deployment and service-oriented scenarios.

[0077] In this embodiment, S4 specifically refers to:

[0078] S41, Clause Configuration; The inspection clauses for the grid-related security assessment of power plants under the jurisdiction of the provincial dispatch center are solidified into a program configuration file. During the assessment, the clause content corresponding to the inspection item is extracted as parameter 1. Specifically, the grid-related security assessment work of power plants under the jurisdiction of the provincial dispatch center mainly covers six major specialties: dispatch operation and safety management, system operation, relay protection, dispatch automation, power system communication, hydropower and new energy. The clauses of each specialty are numbered, and a fixed inspection template is used as a configuration file. During the assessment, the program reads the clause content of the corresponding inspection item in the configuration template as parameter 1.

[0079] S42. Based on file matching; using a hybrid localization method combining vector similarity and the BM25 algorithm, extract the source and original text of the file corresponding to parameter 1, and generate parameter 2; such as Figure 5 As shown, vector similarity is a commonly used localization method in RAG technology. It quantifies the degree of similarity between two statements by calculating the cosine similarity after vectorization. The BM25 algorithm, on the other hand, takes a different approach, evaluating the relevance between search terms and documents. Finally, the Reverse Rank Fusion (RRF) algorithm is introduced to weight and fuse the file relevance ranking results generated by the two methods, generating a unified result set, which can achieve more accurate file localization.

[0080] S43. Obtain the data to be inspected as parameter 3; the data to be inspected includes test document data, equipment ledger data, and on-site inspection data;

[0081] S44. Input parameters 1, 2 and 3 into the Qwen2.5 large model. The large model will perform comprehensive analysis and judgment on the input conditions according to the prompt template, and output the judgment results in the specified format.

[0082] In this embodiment, step S42 specifically includes the following steps:

[0083] S421, Vector Similarity Calculation: Parameter 1 (question statement) is input into the NetSource dedicated model for vectorization, and the similarity between it and the vectorized document fragments in the NetSource security dedicated knowledge base is calculated. A similarity ranking result set between the vectorized document fragments and parameter 1 is generated. The vector similarity is calculated using the cosine similarity algorithm.

[0084]

[0085] Where: A is the vector representation of parameter 1, and B is the vector representation of a document fragment in the NetSource Security Knowledge Base;

[0086] S422 and BM25 relevance calculation; perform morpheme parsing on parameter 1 to generate the word set Q of parameter 1; for each document fragment D in the network source security knowledge base, calculate the relevance score of each word qi in Q with D, and generate a relevance ranking result set of the document fragment original text and parameter 1; the specific calculation is as follows:

[0087]

[0088] Where Q is the word set of parameter 1; D is the original text of a document fragment in the knowledge base; qi is a word in Q; TF(qi,D) is the word frequency of word qi in document D; IDF(qi) is the inverse document frequency of word qi; |D| is the length of document D (in terms of word count); avgdl is the average length of the document set; k and b are adjustment parameters, which are the weights for controlling word frequency and document length, respectively.

[0089] The following are some calculation explanations from the BM25 formula:

[0090] Inverse document frequency (IDF) reflects the importance of a word within a collection of documents. If a word appears in most documents, its discriminative power is low, and its contribution to relevance is limited; conversely, if a word appears only in a few documents, it has higher importance. The calculation formula is as follows:

[0091]

[0092] Where N represents the total number of documents, and n(qi): the number of documents containing the word qi;

[0093] Term frequency (TF) is defined as the number of times a word qi appears in document D. The more frequently a word appears in a document, the more important the word is to the document. However, relying solely on term frequency may lead to longer documents scoring higher, so normalization based on document length is necessary.

[0094] Document length normalization: Since longer documents may contain more irrelevant information, while shorter documents are usually more focused on the topic, we need to normalize the document length. This is done by introducing a normalization factor. It can suppress scoring bias for long documents, ensuring that the model has good adaptability to documents of different lengths.

[0095] S423. Using the RRF algorithm, the vector similarity calculation results and the BM25 relevance calculation results are fused according to weights to generate the final document fragment ranking. The specific calculation is as follows:

[0096]

[0097] Where D is the original text of a document fragment in the knowledge base; n is the number of retrieval methods involved in the fusion (2 in this case, i.e., BM25 and vector retrieval); Ranki(D) is the ranking position of document D in the i-th retrieval method (starting from 1, the earlier the document is, the higher the relevance between the document and the query statement); k' is a smoothing parameter; the RRF algorithm can comprehensively reflect the evaluation of the relevance of documents by merging the ranking positions of multiple retrieval methods.

[0098] S424. Based on the final document fragment ranking, obtain the source of the document that best matches parameter 1, and obtain the original text description fragment of the corresponding clause; return it as parameter 2 in the form of a JSON text string.

[0099] In this embodiment, the acquisition of test document data, equipment ledger data, and on-site inspection data specifically involves:

[0100] Test document data: Through the data center file library of the network source coordination platform, test reports, setting sheets and other documents uploaded by various power plants are converted into machine-readable text format by OCR recognition, and the required parameter information is extracted by using the configured template;

[0101] Equipment ledger data: Through the control cloud platform, the network source platform has achieved data integration with other platforms, and can read equipment ledger data of D5000, OMS, and hydropower and new energy systems in real time;

[0102] On-site inspection data: Some inspection clauses require experts to go to the site and describe the actual situation of the on-site inspection. The app provides an entry point for inspectors to describe and enter relevant information.

[0103] The information and data obtained through the above three methods according to different inspection clauses are used as parameter 3.

[0104] In this embodiment, S44 specifically refers to:

[0105] Through the prompting project, we created prompt templates. Before asking questions to the large model, the program first reads the template content, including the preconditions, expected goals, and actual requirements for different inspection clauses. This information is then input into the large model to help it better understand the task and input. For parameters involving logical comparison and formula judgment, task-specific templates are created to guide the model in generating answers that meet the question requirements, thus helping the model generate more compliant outputs. Finally, parameters 1, 2, and 3 are passed to the large model Qwen2.5, which then performs reasoning and provides its judgment results.

[0106] This invention also proposes an intelligent judgment system for network source security inspection clauses based on a large language model, including a processor, a memory, and a computer program stored in the memory. When the processor executes the computer program, it specifically performs the steps in the above-mentioned intelligent judgment method for network source security inspection clauses based on a large language model.

[0107] The following is a specific example:

[0108] 1) Before asking the question, inform the large model that it will be given the original text of a network source network security assessment inspection content table and the original text of a power plant test report. It needs to judge whether the latter complies with the standard based on the former.

[0109] 2) The requirements for PSS test in the Network Source Security Assessment Inspection Content Table are as follows: During the test, the critical gain value should be measured. The gain setting value of PSS is generally taken in the range of 1 / 3 to 1 / 5 of the critical gain.

[0110] 3) OCR was used to extract relevant results from a power plant's test report. The original text is as follows: Image 4 is a waveform recording of Unit 4 of Tingxi Power Plant when the PSS gain is Ks1 = 35. It can be seen that the exciter excitation voltage fluctuates continuously at this time, which indicates that this gain is the critical PSS gain under this parameter. According to the "Guidelines for Power System Stabilizer Setting Tests", the PSS operating gain is taken as Ks1 = 9. Image 5 is a waveform recording of Unit 4 of Tingxi Power Plant when the PSS gain is Ks1 = 9.

[0111] 4) Input the corresponding content into the large model to obtain the judgment result, such as Figure 7 As shown.

[0112] The above are preferred embodiments of the present invention. Any changes made to the technical solution of the present invention that do not exceed the scope of the technical solution of the present invention shall fall within the protection scope of the present invention.

Claims

1. A method for intelligent analysis of network source security inspection clauses based on a large language model, characterized in that, Specifically, the following steps are included: S1. Collect cybersecurity inspection clauses and cybersecurity assessment basis documents; S2. Use the cybersecurity inspection clauses and cybersecurity assessment basis documents to pre-train and fine-tune the general embedding model in order to build a network source-specific model; S3. Preprocess and segment the documents that support the cybersecurity assessment, and use a dedicated network source model to vectorize the segmented text. Store the vectorized text segments and the corresponding original text in the database to build a dedicated network source security knowledge base. S4. Intelligent analysis and judgment of network security inspection clauses by combining large models with a dedicated network source security knowledge base; The construction of the dedicated network source model specifically includes the following steps: S21. Based on the provisions of cybersecurity inspection and the documents on cybersecurity assessment, a set of professional keywords for cybersecurity assessment is selected. Each keyword is defined as a single token. The general embedding model is used to process the tokens and obtain the embedded representation of each keyword. S22. Add the embedding representation of the keyword set to the embedding layer of the general embedding model, including expanding the word segmenter, adjusting the size of the embedding layer, and assigning the embedding representation of the keyword set to the embedding layer weights of the general embedding model. This completes the pre-training and fine-tuning of the general embedding model and obtains the network source-specific model. The text segmentation specifically refers to: The tables and images in the text data are transformed; for the images, a UID index is generated and replaced. Read and record the paragraph length X of each paragraph of the text data. Obtain the normal distribution by statistically analyzing the probability of paragraph length X appearing in different level intervals, and use it to determine the optimal block length μ. The text data is segmented into paragraphs. For paragraphs whose length exceeds the optimal block length μ, the portion exceeding the optimal block length μ is cut out without splitting the sentence. If the cut-out portion is still larger than the optimal block length μ, the portion exceeding the optimal block length μ is cut out again without splitting the sentence, until all blocks do not exceed the optimal block length μ. Specifically, S4 is: S41, Clause Configuration; The clauses for network source security checks are solidified into a program configuration file. During the analysis, the clause content corresponding to the check item is extracted and used as parameter 1. S42. Matching of cybersecurity assessment documents: Using a hybrid positioning method combining vector similarity and BM25 algorithm, the source and original text of the cybersecurity assessment documents corresponding to parameter 1 are extracted, and parameter 2 is generated. S43. Obtain the data to be inspected as parameter 3; the data to be inspected includes test document data, equipment ledger data, and on-site inspection data; S44. Input parameters 1, 2 and 3 into the Qwen2.5 large model. The large model will perform comprehensive analysis and judgment on the input conditions according to the prompt template, and output the judgment results in the specified format.

2. The intelligent judgment method for network source security inspection clauses based on a large language model according to claim 1, characterized in that, The preprocessing of cybersecurity assessment documents specifically involves: converting PDF cybersecurity assessment documents into editable text using OCR recognition, and automatically formatting the document content into Markdown format using a general large language model.

3. The intelligent judgment method for network source security inspection clauses based on a large language model according to claim 1, characterized in that, The construction of the dedicated knowledge base for network source security is based on the Faiss vector database, which stores vectorized text fragments into the Faiss vector database.

4. The intelligent judgment method for network source security inspection clauses based on a large language model according to claim 1, characterized in that, The deployment of the model in S4 is as follows: the open-source large model Qwen2.5 is selected as the core engine tool for checking clause analysis and judgment, while the open-source inference engine vLLM is used as the startup tool for the large model.

5. The intelligent judgment method for network source security inspection clauses based on a large language model according to claim 1, characterized in that, S42 specifically includes the following steps: S421, Vector Similarity Calculation: Input parameter 1 into the network source-specific model for vectorization, and calculate the similarity between it and the vectorized text fragments in the network source security-specific knowledge base. Generate a similarity ranking result set between the vectorized text fragments and parameter 1. The vector similarity is calculated using the cosine similarity algorithm. Where: A is the vector representation of parameter 1, and B is the vector representation of a text fragment in the Network Source Security Dedicated Knowledge Base; S422 and BM25 relevance calculation; perform morpheme parsing on parameter 1 to generate the word set Q of parameter 1; for each text fragment D in the network source security knowledge base, calculate the relevance score of each word qi in Q with D, and generate a ranking result set of the relevance between the original text fragment and parameter 1; the specific calculation is as follows: Where Q is the word set of parameter 1; qi is a word in Q; TF(qi,D) is the word frequency of word qi in D; IDF(qi) is the inverse document frequency of word qi; |D| is the length of D; k and b are adjustment parameters; S423. Using the RRF algorithm, the vector similarity calculation results and the BM25 relevance calculation results are fused according to weights to generate the final text segment ranking. The specific calculation is as follows: Where n is the number of retrieval methods participating in the fusion, n=2; Rank i (D) represents the rank of D in the i-th retrieval method, and k' is the smoothing parameter; S424. Based on the final text fragment ranking, obtain the source of the document that best matches the cybersecurity assessment in parameter 1, and obtain the original text description fragment of the corresponding clause; and return it as parameter 2 in the form of a JSON text string.

6. The intelligent judgment method for network source security inspection clauses based on a large language model according to claim 1, characterized in that, The acquisition of the test document data, equipment ledger data, and on-site inspection data is specifically as follows: Test document data: Test documents uploaded by each power plant, including test reports and setting sheets, are converted into machine-readable text format through OCR recognition via the data center file library of the network source coordination platform, and the required parameter information is extracted through the configured template; Equipment ledger data: Through the control cloud platform, the data connection between the grid-source coordination platform and other power grid platforms or systems is realized, so as to read the equipment ledger data of other power grid platforms or systems in real time; On-site inspection data: On-site inspectors enter actual data from on-site inspections through the entry point provided by the app.

7. A smart judgment system for network source security inspection clauses based on a large language model, characterized in that, It includes a processor, a memory, and a computer program stored in the memory. When the processor executes the computer program, it specifically performs the steps in the intelligent judgment method for network source security inspection clauses based on a large language model as described in any one of claims 1-6.

Images