End-to-end hybrid expert model training method and device and electronic equipment

Abstract

The invention discloses an end-to-end hybrid expert model training method and device and electronic equipment, and relates to the field of data processing. According to the method, input data are classified and subjected to confidence grading by adopting a preset traditional rule, and a preliminary classification result is obtained; performing anomaly detection on the input data based on a preset expert small model to obtain an anomaly detection result; inputting the preliminary classification result into a preset general recognition small model for analysis and correction to obtain a corrected classification result; inputting the anomaly detection result into a preset security domain model for analysis and correction to obtain a corrected anomaly result; fusing the corrected classification result and the corrected abnormal result to obtain a fusion result, and obtaining a manual auditing result for the fusion result according to a preset man-machine interaction rule to obtain a final auditing result; and taking the final auditing result as training data, and training a preset expert small model, a preset general recognition small model and a preset security domain model. By implementing the technical scheme, the accuracy of data security analysis is improved.

Description

Technical Field

[0001] The present application relates to the field of data processing, and specifically to an end-to-end hybrid expert model training method, device and electronic equipment. Background Art

[0002] With the rapid development of information technology, especially the widespread application of artificial intelligence technology in various fields, the importance of data security has become increasingly prominent. In the application field of data security, large language models (LLMs) such as SaaS-based security models, which use basic models plus RAGs of security domain knowledge, can be used to solve data security problems.

[0003] At present, although the SaaS form of large security models provides a convenient solution, it cannot be localized, which may lead to security risks when processing sensitive data. Although NER technology has been applied in the market, its effect in processing complex security data is still unsatisfactory and its accuracy is low. In addition, although local small models can be customized and quickly deployed, these models often lack sufficient on-site understanding and cannot fully respond to complex and changing security challenges. When understanding and analyzing refined security rules, security systems still require a lot of industry expert input and real-time data processing, showing that existing technologies are insufficient in terms of data processing accuracy.

[0004] Therefore, there is an urgent need for an end-to-end hybrid expert model training method, device and electronic equipment. Summary of the invention

[0005] The present application provides an end-to-end hybrid expert model training method, device and electronic device, which improves the accuracy of data security analysis.

[0006] In a first aspect of the present application, an end-to-end hybrid expert model training method is provided, the method comprising: obtaining input data; classifying and confidence grading the input data using preset traditional rules to obtain preliminary classification results, the preset traditional rules comprising preset data rules and preset confidence thresholds, the preset data rules being a set of rules for classifying data, and the preset confidence threshold being a threshold for judging the credibility of the classification results; performing anomaly detection on the input data based on a preset expert mini-model to obtain anomaly detection results; inputting the preliminary classification results into a preset general knowledge mini-model for analysis and correction to obtain a corrected classification result; inputting the anomaly detection results into a preset security domain model for analysis and correction to obtain a corrected anomaly result; fusing the corrected classification results with the corrected anomaly results to obtain a fusion result, and obtaining a manual review result for the fusion result according to preset human-computer interaction rules to obtain a final review result; using the final review result as training data to train the preset expert mini-model, the preset general knowledge mini-model and the preset security domain model.

[0007] By adopting the above technical solution, by obtaining input data, using preset traditional rules for preliminary classification and confidence grading, and based on the preset expert small model for anomaly detection, the preliminary classification results and anomaly detection results are respectively input into the preset general knowledge small model and the preset security domain model for analysis and correction, and then the corrected classification results and the corrected anomaly results are merged, and after manual review, the final review results are used as training data to train and optimize each model, thereby constructing an end-to-end hybrid expert model training method. This method can fully combine the capabilities of traditional rules, expert models, general knowledge models, security domain knowledge, and manual experience to conduct comprehensive, accurate, and reliable analysis and judgment of input data. At the same time, by feeding back the manual review results into model training, the continuous improvement and optimization of model performance is achieved. This end-to-end hybrid expert model training method can significantly improve the generalization ability and practical application effect of the model, and demonstrate strong adaptability in complex and changeable actual scenarios. The end-to-end hybrid expert model training method provided by this method effectively improves the accuracy and security of data processing by integrating multiple models and processing steps. It combines the intuitiveness of traditional rules, the deep learning capabilities of expert models, and the comprehensive judgment of manual review to form a highly accurate, reliable, and adaptive data security analysis system.

[0008] Optionally, the method of using preset traditional rules to classify and confidence grade the input data to obtain a preliminary classification result specifically includes: performing a multi-dimensional analysis on the input data according to the preset data rules to obtain a data analysis result, wherein the multi-dimensionality includes a data format dimension, a data type dimension, and a data content dimension; classifying the input data according to the data analysis result to obtain a classification label; calculating the confidence of each classification label, and comparing the confidence with the preset confidence threshold to obtain a comparison result; determining the confidence level corresponding to each classification label according to the comparison result to obtain a confidence grading result; and generating the preliminary classification result according to the classification label and the corresponding confidence grading result.

[0009] By adopting the above technical solution, the data analysis results are obtained by analyzing the format dimension, data type dimension, data content dimension and other dimensions of the input data, and classifying and confidence grading the data on this basis, which can fully explore the inherent characteristics and laws of the data, thereby obtaining more accurate and fine-grained preliminary classification results. At the same time, by calculating the confidence of the classification label and comparing it with the preset confidence threshold, the credibility of each classification result can be reasonably evaluated, and the confidence level can be generated accordingly. Combining the classification label with the corresponding confidence level can more completely and accurately characterize the characteristics of the preliminary classification results, providing an important reference for subsequent analysis and correction. This method of combining multi-dimensional analysis and confidence grading can maximize the classification ability of traditional rules, and also provide valuable prior knowledge and guidance for subsequent model analysis.

[0010] Optionally, the anomaly detection is performed on the input data based on the preset expert small model to obtain an anomaly detection result, which specifically includes: inputting the input data into the encoder of the preset expert small model for feature encoding to obtain encoding features; based on the encoding features, using the decoder of the preset expert small model to calculate the anomaly score; comparing the anomaly score with a preset anomaly threshold; if it is determined that the anomaly score is greater than the preset anomaly threshold, it is determined that abnormal data is detected; if it is determined that the anomaly score is less than or equal to the preset anomaly threshold, it is determined that no abnormal data is detected, and the anomaly detection result is obtained.

[0011] By adopting the above technical solution and using a preset expert small model to detect anomalies on the input data, the professional advantages of the preset expert small model in a specific field can be fully utilized to achieve accurate and efficient anomaly identification. By encoding the input data into a feature vector and calculating the anomaly score with the help of a decoder, the degree of anomaly of each data sample can be quantitatively evaluated. By comparing the anomaly score with the preset anomaly threshold, it is possible to automatically determine whether abnormal data is detected and give a clear detection result. This deep learning-based anomaly detection method can overcome the limitations of traditional rule-based methods and accurately identify various unknown abnormal patterns in massive, high-dimensional, and nonlinear data.

[0012] Optionally, before performing anomaly detection on the input data based on the preset expert mini-model and obtaining the anomaly detection result, the method also includes: acquiring historical sample data from multiple fields, the historical sample data including abnormal samples and normal samples; preprocessing the historical sample data to obtain training data for training the Transformer model; constructing a Transformer model, the Transformer model including an encoder and a decoder, the encoder being used to extract features from the input data, and the decoder being used to generate anomaly detection results; taking the training data as input, training the Transformer model through a preset loss function to obtain a trained Transformer model; and using the trained Transformer model as the preset expert mini-model.

[0013] By adopting the above technical solution, before performing anomaly detection of the preset expert small model, first obtain abnormal samples and normal samples from historical sample data, and perform preprocessing to obtain training data, then build and train the Transformer anomaly detection model based on the training data, and finally use the trained Transformer model as the preset expert small model for actual anomaly detection tasks. This method based on historical data and end-to-end training can make full use of existing anomaly detection knowledge and experience, and can also continuously learn and accumulate new anomaly patterns from actual data.

[0014] Optionally, the preliminary classification result is input into a preset general knowledge small model for analysis and correction to obtain a corrected classification result, which specifically includes: identifying and understanding the preliminary classification result through the preset general knowledge small model to obtain a data understanding result, and the data understanding result includes an intent recognition result, an entity recognition result, and a relationship extraction result; based on the data understanding result, the preliminary classification result is matched with a preset knowledge base to obtain background knowledge related to the preliminary classification result; the data understanding result and the background knowledge are integrated, and the preliminary classification result is corrected through a preset error correction strategy to obtain the corrected classification result.

[0015] By adopting the above technical solution, the preliminary classification results are input into the preset general knowledge small model for analysis and correction, which gives full play to the advantages of the preset general knowledge small model in semantic understanding and knowledge association. By performing multi-level semantic analysis on the preliminary classification results, such as intent recognition, entity recognition, and relationship extraction, the preset general knowledge small model can deeply understand the intrinsic meaning and association logic of the data. On this basis, by matching with the preset knowledge base, rich background knowledge can be introduced to provide a more comprehensive and accurate understanding and interpretation of the preliminary classification results. Finally, by combining the semantic analysis results and background knowledge, and with the help of the preset error correction strategy, the preset general knowledge small model can effectively discover and correct errors and deviations in the preliminary classification, thereby obtaining a more reasonable and credible corrected classification result.

[0016] Optionally, the inputting the anomaly detection result into a preset security domain model for analysis and correction to obtain a corrected anomaly result specifically includes: performing risk identification on the anomaly detection result through a preset security domain model to obtain a security analysis result, wherein the security analysis result includes a risk type, a risk level, and a risk description; based on the security analysis result, obtaining security knowledge related to the anomaly detection result in a preset security database; fusing the security analysis result and the security knowledge, and correcting the anomaly detection result through a preset anomaly correction strategy to obtain the corrected anomaly result.

[0017] By adopting the above technical solution, the anomaly detection results are input into the preset security domain model for analysis and correction, which can make full use of the professional knowledge and experience in the security field to conduct in-depth and comprehensive risk assessment of the detected anomalies. By performing multi-dimensional security analysis on the anomaly detection results, the preset security domain model can accurately identify the risk type, risk level and specific risk manifestation corresponding to each anomaly. On this basis, the preset security domain model can also obtain security information related to the current anomaly from the preset security knowledge base. Finally, by integrating the security analysis results and security knowledge, and using the preset anomaly correction strategy, the preset security domain model can optimize and correct the original anomaly detection results to obtain a more reliable anomaly analysis result. This analysis and correction method that integrates security domain intelligence and knowledge base can maximize the mining of security risks hidden in abnormal data, provide strong decision support for the accurate positioning and effective disposal of anomalies, and thus significantly improve security protection capabilities.

[0018] Optionally, the fusing the corrected classification result and the corrected exception result to obtain a fusion result specifically includes: structured representation of the corrected exception result to obtain structured exception information, wherein the exception information includes the exception type, the exception location and the exception level; mapping the exception information to the corrected classification result to obtain a target classification result, wherein the target classification result is an adjustment result of the original classification result according to the exception information; calculating the difference between the target classification result and the corrected classification result; if the difference is greater than or equal to a preset difference threshold, taking the target classification result as the fusion result; if the difference is less than or equal to the preset difference threshold, taking the corrected classification result as the fusion result.

[0019] By adopting the above technical solution, a method for fusing the corrected classification results and the corrected abnormal results is proposed, which can fully explore the correlation and complementarity between the two types of results, so as to obtain a more comprehensive, accurate and consistent comprehensive analysis result. First, by structurally representing the corrected abnormal results, the abnormal information is refined into key elements such as abnormal type, abnormal location and abnormal level, so that it can be effectively mapped with the classification system. Then, the extracted abnormal information is matched with the corrected classification results, and the original classification results are adjusted and optimized with the help of the abnormal information, so as to obtain a target classification result that integrates the abnormal factors. Next, by calculating the difference between the target classification result and the corrected classification result, and setting a preset difference threshold, it can be adaptively decided whether to use the adjusted target classification result or maintain the original corrected classification result, so as to achieve a balance between classification accuracy and abnormal coverage.

[0020] In a second aspect of the present application, an end-to-end hybrid expert model training device is provided, the device comprising: an acquisition module and a processing module, wherein: the acquisition module is used to acquire input data; the processing module is used to classify and grade the confidence of the input data using preset traditional rules to obtain a preliminary classification result, the preset traditional rules include preset data rules and preset confidence thresholds, the preset data rules are a set of rules for classifying data, and the preset confidence threshold is a threshold for judging the credibility of the classification result; the processing module is also used to perform anomaly detection on the input data based on a preset expert small model to obtain anomaly detection results; the processing module , and is also used to input the preliminary classification result into a preset general knowledge small model for analysis and correction to obtain a corrected classification result; the processing module is also used to input the abnormal detection result into a preset security field model for analysis and correction to obtain a corrected abnormal result; the processing module is also used to fuse the corrected classification result and the corrected abnormal result to obtain a fusion result, and obtain a manual review result for the fusion result according to a preset human-computer interaction rule to obtain a final review result; the processing module is also used to use the final review result as training data to train the preset expert small model, the preset general knowledge small model and the preset security field model.

[0021] In the third aspect of the present application, an electronic device is provided, including a processor, a memory, a user interface and a network interface, the memory is used to store instructions, the user interface and the network interface are both used to communicate with other devices, and the processor is used to execute the instructions stored in the memory so that the electronic device executes any one of the methods described above.

[0022] In a fourth aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores instructions, and when the instructions are executed, any of the methods described above is executed.

[0023] In summary, one or more technical solutions provided by this application have at least the following technical effects or advantages: 1. By obtaining input data, using preset traditional rules for preliminary classification and confidence grading, and performing anomaly detection based on a preset expert small model, the preliminary classification results and anomaly detection results are respectively input into the preset general knowledge small model and the preset security domain model for analysis and correction, and then the corrected classification results and corrected anomaly results are merged, and after manual review, the final review results are used as training data to train and optimize each model, thereby constructing an end-to-end hybrid expert model training method. This method can fully combine the capabilities of traditional rules, expert models, general knowledge models, security domain knowledge, and manual experience to conduct comprehensive, accurate, and reliable analysis and judgment of input data. At the same time, by feeding back the manual review results into model training, the continuous improvement and optimization of model performance is achieved. This end-to-end hybrid expert model training method can significantly improve the generalization ability and practical application effect of the model, and demonstrate strong adaptability in complex and changeable actual scenarios. The end-to-end hybrid expert model training method provided by this method effectively improves the accuracy and security of data processing by integrating multiple models and processing steps. It combines the intuitiveness of traditional rules, the deep learning capabilities of expert models, and the comprehensive judgment of manual review to form a highly accurate, reliable, and adaptive data security analysis system. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 It is a flowchart of an end-to-end hybrid expert model training method disclosed in an embodiment of the present application; Figure 2 It is a module schematic diagram of an end-to-end hybrid expert model training device disclosed in an embodiment of the present application; Figure 3 It is a structural schematic diagram of an electronic device disclosed in an embodiment of the present application.

[0025] Explanation of the reference numerals: 201, acquisition module; 202, processing module; 300, electronic device; 301, processor; 302, communication bus; 303, user interface; 304, network interface; 305, memory. DETAILED DESCRIPTION

[0026] In order to enable technicians in this field to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments.

[0027] In the description of the embodiments of the present application, words such as "for example" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "for example" or "for example" is intended to present related concepts in a specific way.

[0028] In the description of the embodiments of the present application, the meaning of the term "multiple" refers to two or more. For example, multiple systems refer to two or more systems, and multiple screen terminals refer to two or more screen terminals. In addition, the terms "first" and "second" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance or implicitly indicating the indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. The terms "include", "comprise", "have" and their variations all mean "including but not limited to", unless otherwise specifically emphasized.

[0029] This application provides an end-to-end hybrid expert model training method, referring to Figure 1 , Figure 1 1 is a flow chart of an end-to-end hybrid expert model training method provided in an embodiment of the present application. The method is applied to a server, which is a server that executes an end-to-end hybrid expert model training program. The server can be a single server, a server cluster consisting of multiple servers, or a cloud computing service center. The method includes steps S101 to S107, which are as follows: Step S101: Obtain input data.

[0030] In step S101, the process of the server obtaining input data can be implemented in a variety of ways, depending on the source, format and application scenario of the data. The server can obtain input data through API interface acquisition, database query, file upload and message queue.

[0031] Step S102: Use preset traditional rules to classify and grade the input data to obtain preliminary classification results. The preset traditional rules include preset data rules and preset confidence thresholds. The preset data rules are a set of rules for classifying data, and the preset confidence threshold is a threshold for judging the credibility of the classification results.

[0032] In step S102, the input data is classified and confidence graded using preset traditional rules to obtain preliminary classification results, which specifically include: according to the preset data rules, the input data is analyzed in multiple dimensions to obtain data analysis results, and the multiple dimensions include data format dimension, data type dimension and data content dimension; according to the data analysis results, the input data is classified to obtain classification labels; the confidence of each classification label is calculated, and the confidence is compared with the preset confidence threshold to obtain a comparison result; according to the comparison result, the confidence level corresponding to each classification label is determined to obtain a confidence grading result; according to the classification label and the corresponding confidence grading result, a preliminary classification result is generated.

[0033] Specifically, the server performs multi-angle and multi-level analysis on the input data according to the preset data rules. The multi-dimensionality here includes aspects such as data format, data type, and data content. In the data format dimension, the server analyzes the degree of structure of the input data, such as whether the data is stored in a table, JSON, XML, etc., whether the data field is complete, and whether it conforms to the predefined pattern. In the data type dimension, the server analyzes the data type of each field in the input data, such as numeric type, character type, enumeration type, date type, etc. It checks whether the value of each field conforms to the expected type and whether it is within a reasonable range. In the data content dimension, the server performs semantic analysis and keyword extraction on the actual content of the input data. It counts the frequency of occurrence of each keyword, determines the theme and category to which the data belongs, and extracts the emotional tendency contained in the data. The server uses a variety of data analysis technologies, such as regular expressions, text parsing, pattern matching, machine learning, etc., to analyze the input data and obtain data analysis results.

[0034] Based on the data analysis results obtained in the previous step, the server classifies the input data according to the preset classification rules. Classification rules are a set of IF-THEN statements that describe the correspondence between data features and categories. The server matches the data analysis results with the conditions in the preset classification rules. For each piece of data, it finds all the rules that meet the conditions and extracts the classification labels corresponding to these rules.

[0035] For each data classification label, the server will calculate a confidence score to indicate the credibility of the classification result. The calculation of confidence is mainly based on two factors: one is the number of classification rules matched, and the other is the credibility of each rule. If a piece of data can match multiple classification rules, and the credibility of these rules is relatively high, then the classification confidence of the data will be relatively high. Conversely, if a piece of data only matches one or two rules with low credibility, then its classification confidence will also be relatively low. The server will combine the above factors and calculate a confidence score between 0 and 1 through weighted average and Bayesian inference methods. The closer the confidence score is to 1, the higher the credibility of the classification result.

[0036] After obtaining the confidence of each classification label, the server will compare it with the preset confidence threshold to determine the confidence level of each classification label. The preset confidence threshold is a value between 0 and 1, which is used to divide the boundary between high confidence and low confidence. If the confidence of a classification label is greater than or equal to the preset confidence threshold, the server will set its confidence level to "high"; conversely, if the confidence is less than the preset confidence threshold, the confidence level will be set to "low".

[0037] Finally, the server will combine the classification labels and confidence levels of each piece of data to generate a complete preliminary classification result. The preliminary classification result can be presented in the form of lists, tables, etc. for subsequent storage and analysis.

[0038] Step S103: Perform anomaly detection on the input data based on the preset expert small model to obtain anomaly detection results.

[0039] In step S103, anomaly detection is performed on the input data based on the preset expert small model to obtain anomaly detection results, specifically including: inputting the input data into the encoder of the preset expert small model for feature encoding to obtain encoding features; based on the encoding features, using the decoder of the preset expert small model to calculate the anomaly score; comparing the anomaly score with the preset anomaly threshold; if it is determined that the anomaly score is greater than the preset anomaly threshold, it is determined that abnormal data is detected; if it is determined that the anomaly score is less than or equal to the preset anomaly threshold, it is determined that no abnormal data is detected, and an anomaly detection result is obtained.

[0040] Specifically, the server inputs the input data to be detected into the encoder of the preset expert model. The encoder is a neural network model based on the Transformer architecture, and its main function is to convert the input data into a high-dimensional feature vector, namely the encoding feature. During the encoding process, the encoder uses the self-attention mechanism and the feedforward neural network to extract features and fuse information from the input data. The self-attention mechanism can capture the dependencies between different positions in the input data, so that the model can better understand the contextual information of the data. The feedforward neural network is used to perform nonlinear transformation and information enhancement on the extracted features. Through these operations, the encoder finally encodes the input data into a feature vector.

[0041] Next, the server inputs the encoded features into the decoder of the preset expert model, and the decoder calculates the anomaly score. The decoder is also a neural network model based on the Transformer architecture, and its main function is to generate anomaly detection results based on the encoded features. Specifically, the decoder combines the encoded features with the prior knowledge of the anomaly detection task through the attention mechanism and feedforward neural network to calculate a score that represents the degree of data anomaly. This score is usually a real number between 0 and 1. The higher the score, the more likely the data is abnormal, and the lower the score, the more likely the data is normal.

[0042] After calculating the anomaly score, the server compares it with the preset anomaly threshold. The anomaly threshold is a critical value set based on historical experience and business needs to determine whether the data is abnormal. If the anomaly score is greater than the anomaly threshold, the server determines that the input data is abnormal and marks it as abnormal data; if the anomaly score is less than or equal to the preset anomaly threshold, the server determines that the input data is normal and marks it as normal data. Through the above steps, the server can obtain the anomaly detection results of the input data.

[0043] In a possible implementation, before step S103, the method further includes: acquiring historical sample data from multiple fields, the historical sample data including abnormal samples and normal samples; preprocessing the historical sample data to obtain training data for training the Transformer model; constructing a Transformer model, the Transformer model including an encoder and a decoder, the encoder being used to extract features from the input data, and the decoder being used to generate anomaly detection results; taking the training data as input, training the Transformer model through a preset loss function to obtain a trained Transformer model; and using the trained Transformer model as a preset expert small model.

[0044] Specifically, the server obtains a large amount of historical sample data from multiple fields. The historical sample data includes abnormal samples and normal samples, covering various possible abnormal and normal situations. Abnormal samples can be abnormal records in system logs, abnormal data packets in network traffic, abnormal transactions in business data, etc.; normal samples are normal records, normal data packets, normal transactions, etc. corresponding to abnormal samples. The server collects these sample data from different data sources to ensure the diversity and comprehensiveness of the data.

[0045] Next, the server preprocesses the acquired historical sample data and converts it into a format suitable for training the Transformer model. The preprocessing process includes steps such as data cleaning, feature extraction, and data labeling. The server first cleans the original data to remove noise, outliers, missing values, etc. to ensure the quality of the data. Then, the server extracts key features from the cleaned data, such as the timestamp, operation type, operation object, etc. in the log data, and the source IP address, destination IP address, protocol type, port number, etc. in the network traffic data. The extracted key features will be used as training data for the Transformer model. Finally, the server labels the sample data and assigns a label to each sample to indicate whether it is an abnormal sample or a normal sample.

[0046] After data preprocessing is completed, the server starts to build the Transformer model. The Transformer model adopts an encoder-decoder architecture. The encoder is responsible for feature extraction and encoding of the input data, and the decoder is responsible for generating anomaly detection results based on the encoded information. After the Transformer model is built, the server uses the preprocessed training data as input and trains the Transformer model through a preset loss function. The preset loss function is used to measure the gap between the prediction result of the Transformer model and the true label. The loss function can be a cross entropy loss function and a square error loss function. The server continuously adjusts the parameters of the Transformer model through the back-propagation algorithm and optimizers (such as Adam, SGD, etc.) to continuously reduce the loss function value on the training data, thereby improving the anomaly detection performance of the Transformer model.

[0047] After multiple rounds of iterative training, the server obtains a trained Transformer model. The server uses the trained Transformer model as a preset expert model to perform anomaly detection on new input data.

[0048] For example, suppose the server builds a preset expert small model for detecting network intrusions. The server first collects a large amount of network traffic data, including normal network communication data and data of various network attacks (such as DDoS attacks, port scanning, SQL injection, etc.). Then, the server preprocesses these data, extracts relevant features (such as source IP, destination IP, protocol type, packet size, etc.), and marks the samples as normal or abnormal. Next, the server builds a Transformer model and trains it using the preprocessed training data. During the training process, the server continuously adjusts the model parameters so that it can accurately distinguish between normal and abnormal traffic. Finally, the server deploys the trained Transformer model as a preset expert small model, which is used to detect anomalies in network traffic in real time and promptly discover and prevent network intrusions.

[0049] Step S104: input the preliminary classification result into a preset general knowledge small model for analysis and correction to obtain a corrected classification result.

[0050] In step S104, the preliminary classification results are input into a preset general knowledge small model for analysis and correction to obtain corrected classification results, which specifically include: identifying and understanding the preliminary classification results through the preset general knowledge small model to obtain data understanding results, and the data understanding results include intent recognition results, entity recognition results, and relationship extraction results; based on the data understanding results, matching the preliminary classification results with a preset knowledge base to obtain background knowledge related to the preliminary classification results; fusing the data understanding results and background knowledge, and correcting the preliminary classification results through a preset error correction strategy to obtain a corrected classification result.

[0051] Specifically, the server inputs the preliminary classification results into the preset general knowledge small model for recognition and understanding. The preset general knowledge small model is a language model trained based on large-scale general domain data. It has extensive knowledge representation and semantic understanding capabilities, and can perform semantic analysis and information extraction on the input text data. In the recognition and understanding process, the preset general knowledge small model first performs intent recognition on the preliminary classification results. It analyzes the features and rules based on the preliminary classification, and infers the intent and purpose reflected in the classification process. Next, the preset general knowledge small model performs entity recognition and extracts key entity objects from the preliminary classification results. In addition, the preset general knowledge small model also identifies the association relationship between entity objects through relationship extraction. Through analysis, the preset general knowledge small model obtains data understanding results containing multi-dimensional information such as intent, entity, and relationship.

[0052] After obtaining the data understanding result, the server matches it with the preset knowledge base to obtain background knowledge related to the preliminary classification result. The server compares the key elements in the data understanding result with the corresponding items in the preset knowledge base to find out the background knowledge related to the preliminary classification result, such as the attributes, categories, definitions, etc. related to the entity object, and the scenarios and behavior patterns related to the identified intent. Finally, the server integrates the data understanding result and the background knowledge, and corrects the preliminary classification result through the preset error correction strategy. The preset error correction strategy is a set of rules and algorithms summarized based on expert knowledge and machine learning, which are used to discover and correct errors and deviations in classification. For example, if the preliminary classification mistakenly classifies an entity into an irrelevant category, but the background knowledge finds that the entity is closely related to the correct category, the preset error correction strategy will reclassify it. Through the above steps, the server can finally obtain a corrected classification result based on the preliminary classification result.

[0053] Step S105: input the abnormality detection result into the preset security domain model for analysis and correction to obtain a corrected abnormality result.

[0054] In step S105, the anomaly detection result is input into the preset security domain model for analysis and correction to obtain a corrected anomaly result, which specifically includes: performing risk identification on the anomaly detection result through the preset security domain model to obtain a security analysis result, and the security analysis result includes risk type, risk level and risk description; based on the security analysis result, obtaining security knowledge related to the anomaly detection result in the preset security database; integrating the security analysis result and security knowledge, and correcting the anomaly detection result through the preset anomaly correction strategy to obtain a corrected anomaly result.

[0055] Specifically, after the server obtains the anomaly detection result using the preset expert model, it inputs the result into the preset security domain model for further risk analysis and result correction to obtain a more accurate and complete anomaly detection result. First, the server inputs the anomaly detection result into the preset security domain model for risk identification. The preset security domain model is a deep learning model for network security analysis. It is trained based on a large amount of security domain knowledge and practical experience, and has the ability to accurately identify and assess the risks of various network attacks and abnormal behaviors.

[0056] During the risk identification process, the preset security domain model performs multi-dimensional feature analysis on the abnormal detection results, such as analyzing the source address, target address, communication protocol, data content, etc. of the abnormal traffic to determine whether it conforms to the characteristic pattern of known attacks. At the same time, the model also considers the contextual information of the abnormal behavior, such as time, frequency, duration, etc., to assess its suspiciousness. Through comprehensive analysis, the preset security domain model will give a detailed security analysis result, including possible risk types (such as DDoS attacks, port scanning, SQL injection, etc.), risk levels (such as high risk, medium risk, low risk) and risk descriptions (such as attack paths, target assets, expected losses, etc.).

[0057] Next, based on the security analysis results, the server queries the preset security database for security knowledge related to the current abnormal behavior. The preset security database is a structured database that integrates knowledge in various network security fields, including information on known vulnerabilities, attack methods, defense measures, emergency plans, etc. By matching key information in the security analysis results (such as attack type, target assets, etc.) with the preset security database, the server can obtain background knowledge related to the current abnormal behavior, such as common methods of this type of attack, exploited vulnerabilities, possible preventive measures, etc. Finally, the server integrates the security analysis results with relevant security knowledge, and corrects and improves the original anomaly detection results through the preset anomaly correction strategy. The anomaly correction strategy is a set of rules and processes summarized based on expert experience and machine learning algorithms, which are used to identify and correct false positives, missed positives, and wrong positives in anomaly detection.

[0058] For example, if the original detection determines a certain flow as a SQL injection attack, but the security analysis finds that the flow is actually a normal database query, and the syntax and content of the query are in line with the legal pattern in the security knowledge base, the preset anomaly correction strategy will correct the anomaly judgment to normal behavior. For another example, if the original detection misses some suspicious traffic, but the security analysis finds that this traffic has a high degree of similarity with known attacks in the recent period, and there are related attack records in the security knowledge base, the correction strategy will re-mark this traffic as abnormal.

[0059] Step S106: Fusing the corrected classification result and the corrected abnormality result to obtain a fusion result, and obtaining a manual review result for the fusion result according to a preset human-computer interaction rule to obtain a final review result.

[0060] In step S106, the corrected classification result and the corrected abnormal result are fused to obtain a fusion result, which specifically includes: structured representation of the corrected abnormal result to obtain structured abnormality information, wherein the abnormality information includes the abnormality type, abnormality location and abnormality level; mapping the abnormality information to the corrected classification result to obtain a target classification result, wherein the target classification result is an adjustment result of the original classification result according to the abnormality information; calculating the difference between the target classification result and the corrected classification result; if the difference is greater than or equal to the preset difference threshold, the target classification result is used as the fusion result; if the difference is less than or equal to the preset difference threshold, the corrected classification result is used as the fusion result.

[0061] Specifically, the server structures the anomaly correction results and converts them into standardized anomaly information. This structured representation usually includes information on multiple dimensions, such as anomaly type (such as data error, format inconsistency, logical contradiction, etc.), anomaly location (such as specific fields in the data table, specific line numbers in the code, etc.), and anomaly level (such as severe, general, prompt, etc.). In this way, the originally unstructured anomaly detection results are converted into structured data that can be easily processed by computers.

[0062] Next, the server maps the structured exception information to the corrected classification results, adjusting and correcting the original corrected classification results. The mapping process associates specific types and levels of exception information with specific categories in the classification system based on preset mapping rules and logic. For example, if the exception information indicates that a certain data has a format error and the data was originally classified into the "qualified" category, the mapping rules may readjust it to the "unqualified" category. Through this mapping of exception information to classification results, the server obtains a target classification result calibrated according to the exception information.

[0063] In order to evaluate the reliability of the target classification result, the server calculates the difference between it and the corrected classification result. The difference reflects the degree of influence of the abnormal information on the original classification result. The server compares the calculated difference with a preset difference threshold to determine whether the target classification result should be adopted. If the difference is large and exceeds the preset difference threshold, it means that the abnormal information has a large correction effect on the classification result. At this time, the server uses the target classification result as the final fusion result. On the contrary, if the difference is small and does not exceed the preset difference threshold, it means that the abnormal information has limited influence on the classification result. At this time, the server continues to use the corrected classification result.

[0064] After obtaining the fusion results, the server will submit the results to manual review and confirmation according to the preset human-computer interaction rules. Manual reviewers will analyze and evaluate the fusion results, and give final review opinions based on their own professional knowledge and experience. The server will make necessary adjustments to the fusion results based on the manual review opinions and finally determine the final review results.

[0065] Step S107: Use the final audit results as training data to train the preset expert small model, the preset general knowledge small model and the preset security field model.

[0066] In step S107, the server uses the final audit result as training data to further train and optimize several previously constructed models (preset expert small model, preset general knowledge small model, preset security domain model) to continuously improve their performance and effect. By feeding the final audit result back into the closed-loop learning process of model training, the server can continuously optimize and upgrade each link of anomaly detection, so that the system can keep pace with the times, constantly adapt to new needs, and provide more intelligent and reliable support for abnormal data detection.

[0067] Reference Figure 2 The present application also provides an end-to-end hybrid expert model training device, which is a server, and the server includes an acquisition module 201 and a processing module 202, wherein: the acquisition module 201 is used to acquire input data; the processing module 202 is used to classify and grade the confidence of the input data using preset traditional rules to obtain a preliminary classification result, the preset traditional rules include preset data rules and preset confidence thresholds, the preset data rules are a set of rules for classifying data, and the preset confidence threshold is a threshold for judging the credibility of the classification result; the processing module 202 is also used to perform anomaly detection on the input data based on the preset expert small model to obtain anomaly detection results. The processing module 202 is also used to input the preliminary classification result into the preset general knowledge small model for analysis and correction to obtain a corrected classification result; the processing module 202 is also used to input the abnormal detection result into the preset security field model for analysis and correction to obtain a corrected abnormal result; the processing module 202 is also used to fuse the corrected classification result and the corrected abnormal result to obtain a fused result, and obtain a manual review result for the fused result according to the preset human-computer interaction rules to obtain a final review result; the processing module 202 is also used to use the final review result as training data to train the preset expert small model, the preset general knowledge small model and the preset security field model.

[0068] In a possible implementation, the processing module 202 uses preset traditional rules to classify and confidence grade the input data to obtain a preliminary classification result, which specifically includes: the processing module 202 performs a multi-dimensional analysis on the input data according to the preset data rules to obtain a data analysis result, and the multi-dimensionality includes a data format dimension, a data type dimension, and a data content dimension; the processing module 202 classifies the input data according to the data analysis result to obtain a classification label; the processing module 202 calculates the confidence of each classification label, and compares the confidence with a preset confidence threshold to obtain a comparison result; the processing module 202 determines the confidence level corresponding to each classification label according to the comparison result to obtain a confidence grading result; the processing module 202 generates a preliminary classification result based on the classification label and the corresponding confidence grading result.

[0069] In one possible implementation, the processing module 202 performs anomaly detection on the input data based on a preset expert small model to obtain anomaly detection results, specifically including: the processing module 202 inputs the input data into the encoder of the preset expert small model for feature encoding to obtain encoding features; the processing module 202 calculates the anomaly score based on the encoding features using the decoder of the preset expert small model; the processing module 202 compares the anomaly score with a preset anomaly threshold; if the processing module 202 determines that the anomaly score is greater than the preset anomaly threshold, it determines that abnormal data is detected; if the processing module 202 determines that the anomaly score is less than or equal to the preset anomaly threshold, it determines that no abnormal data is detected, and obtains an anomaly detection result.

[0070] In a possible implementation, the processing module 202 performs anomaly detection on the input data based on a preset expert small model, and before obtaining the anomaly detection result, it also includes: the acquisition module 201 obtains historical sample data in multiple fields, and the historical sample data includes abnormal samples and normal samples; the processing module 202 preprocesses the historical sample data to obtain training data for training the Transformer model; the processing module 202 constructs a Transformer model, and the Transformer model includes an encoder and a decoder, the encoder is used to extract features from the input data, and the decoder is used to generate anomaly detection results; the processing module 202 takes the training data as input, trains the Transformer model through a preset loss function, and obtains a trained Transformer model; the processing module 202 uses the trained Transformer model as the preset expert small model.

[0071] In one possible implementation, the processing module 202 inputs the preliminary classification result into a preset general knowledge small model for analysis and correction to obtain a corrected classification result, which specifically includes: the processing module 202 identifies and understands the preliminary classification result through the preset general knowledge small model to obtain a data understanding result, and the data understanding result includes an intent recognition result, an entity recognition result, and a relationship extraction result; the processing module 202 matches the preliminary classification result with a preset knowledge base based on the data understanding result to obtain background knowledge related to the preliminary classification result; the processing module 202 integrates the data understanding result and the background knowledge, and corrects the preliminary classification result through a preset error correction strategy to obtain a corrected classification result.

[0072] In one possible implementation, the processing module 202 inputs the anomaly detection result into a preset security domain model for analysis and correction to obtain a corrected anomaly result, specifically including: the processing module 202 identifies risks on the anomaly detection result through a preset security domain model to obtain a security analysis result, and the security analysis result includes a risk type, a risk level, and a risk description; the processing module 202 obtains security knowledge related to the anomaly detection result in a preset security database based on the security analysis result; the processing module 202 integrates the security analysis result and the security knowledge, and corrects the anomaly detection result through a preset anomaly correction strategy to obtain a corrected anomaly result.

[0073] In a possible implementation, the processing module 202 fuses the corrected classification result and the corrected exception result to obtain a fusion result, which specifically includes: the processing module 202 performs a structured representation on the corrected exception result to obtain structured exception information, and the exception information includes the exception type, the exception location, and the exception level; the processing module 202 maps the exception information to the corrected classification result to obtain a target classification result, and the target classification result is an adjustment result of the original classification result according to the exception information; the processing module 202 calculates the difference between the target classification result and the corrected classification result; if the difference is greater than or equal to the preset difference threshold, the processing module 202 uses the target classification result as the fusion result; if the difference is less than or equal to the preset difference threshold, the processing module 202 uses the corrected classification result as the fusion result.

[0074] It should be noted that: when the device provided in the above embodiment realizes its function, only the division of the above functional modules is used as an example. In actual application, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0075] The present application also provides an electronic device. Figure 3 , Figure 3 The electronic device 300 may include: at least one processor 301 , at least one network interface 304 , a user interface 303 , a memory 305 , and at least one communication bus 302 .

[0076] The communication bus 302 is used to realize the connection and communication between these components.

[0077] The user interface 303 may include a display screen (Display) and a camera (Camera). Optionally, the user interface 303 may also include a standard wired interface and a wireless interface.

[0078] The network interface 304 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface).

[0079] Among them, the processor 301 may include one or more processing cores. The processor 301 uses various interfaces and lines to connect various parts in the entire server, and executes various functions of the server and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 305, and calling data stored in the memory 305. Optionally, the processor 301 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 301 can integrate one or a combination of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 301, and it can be implemented separately through a chip.

[0080] Among them, the memory 305 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory). Optionally, the memory 305 includes a non-transitory computer-readable storage medium. The memory 305 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 305 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 305 may optionally also be at least one storage device located away from the aforementioned processor 301. Refer to Figure 3 , the memory 305 as a computer storage medium may include an operating system, a network communication module, a user interface module, and an application program of an end-to-end hybrid expert model training method.

[0081] exist Figure 3 In the electronic device 300 shown, the user interface 303 is mainly used to provide an input interface for the user and obtain the data input by the user; and the processor 301 can be used to call the application program storing an end-to-end hybrid expert model training method in the memory 305, and when executed by one or more processors 301, the electronic device 300 executes one or more of the methods described in the above embodiments. It should be noted that for the aforementioned method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited to the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required for the present application.

[0082] The present application also provides a computer-readable storage medium, which stores instructions. When executed by one or more processors 301, the electronic device 300 executes one or more of the methods described in the above embodiments.

[0083] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0084] In the several embodiments provided in this application, it should be understood that the disclosed devices can be implemented in other ways. For example, the device embodiments described above are only schematic, such as the division of units, which is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some service interfaces, and the indirect coupling or communication connection of devices or units can be electrical or other forms.

[0085] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0086] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0087] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a memory and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned memory includes: various media that can store program codes, such as USB flash drives, mobile hard drives, magnetic disks or optical disks.

[0088] The above is only an exemplary embodiment of the present disclosure and cannot be used to limit the scope of the present disclosure. That is, any equivalent changes and modifications made according to the teachings of the present disclosure are still within the scope of the present disclosure. After considering the disclosure of the specification and the truth of practice, those skilled in the art will easily think of other embodiments of the present disclosure.

[0089] This application is intended to cover any variation, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the art not described in the present disclosure. The description and examples are to be regarded as exemplary only, and the scope and spirit of the present disclosure are defined by the claims.

Claims

1. An end-to-end hybrid expert model training method, characterized in that: The method comprises: Get input data; The input data is classified and confidence graded using preset traditional rules to obtain a preliminary classification result, wherein the preset traditional rules include preset data rules and preset confidence thresholds, wherein the preset data rules are a set of rules for classifying data, and the preset confidence threshold is a threshold for judging the credibility of the classification result; Performing anomaly detection on the input data based on a preset expert small model to obtain an anomaly detection result; Inputting the preliminary classification result into a preset general knowledge small model for analysis and correction to obtain a corrected classification result; Inputting the abnormal detection result into a preset security domain model for analysis and correction to obtain a corrected abnormal result; The corrected classification result and the corrected abnormal result are merged to obtain a fusion result, and a manual review result for the fusion result is obtained according to a preset human-computer interaction rule to obtain a final review result; The final audit result is used as training data to train the preset expert small model, the preset general knowledge small model and the preset security field model.

2. The method according to claim 1, characterized in that: The input data is classified and confidence graded using preset traditional rules to obtain a preliminary classification result, specifically including: According to the preset data rules, the input data is analyzed in multiple dimensions to obtain data analysis results, wherein the multiple dimensions include a data format dimension, a data type dimension, and a data content dimension; Classify the input data according to the data analysis result to obtain a classification label; Calculating the confidence of each of the classification labels, and comparing the confidence with the preset confidence threshold to obtain a comparison result; Determine the confidence level corresponding to each of the classification labels according to the comparison result, and obtain a confidence grading result; The preliminary classification result is generated according to the classification label and the corresponding confidence grading result.

3. The method according to claim 1, characterized in that The performing anomaly detection on the input data based on the preset expert small model to obtain anomaly detection results specifically includes: Inputting the input data into the encoder of the preset expert small model for feature encoding to obtain encoding features; Based on the encoding features, using the decoder of the preset expert small model to calculate an anomaly score; Compare the anomaly score with a preset anomaly threshold; If it is determined that the anomaly score is greater than the preset anomaly threshold, it is determined that abnormal data is detected; if it is determined that the anomaly score is less than or equal to the preset anomaly threshold, it is determined that no abnormal data is detected, and the anomaly detection result is obtained.

4. The method according to claim 1, characterized in that: Before performing anomaly detection on the input data based on the preset expert small model to obtain anomaly detection results, the method further includes: Acquire historical sample data in multiple fields, wherein the historical sample data includes abnormal samples and normal samples; Preprocessing the historical sample data to obtain training data for training the Transformer model; Constructing a Transformer model, wherein the Transformer model includes an encoder and a decoder, wherein the encoder is used to extract features from input data, and the decoder is used to generate anomaly detection results; Taking the training data as input, training the Transformer model through a preset loss function to obtain a trained Transformer model; The trained Transformer model is used as the preset expert small model.

5. The method according to claim 1, characterized in that The inputting the preliminary classification result into a preset general knowledge small model for analysis and correction to obtain a corrected classification result specifically includes: The preliminary classification results are identified and understood by the preset general knowledge small model to obtain data understanding results, which include intent recognition results, entity recognition results, and relationship extraction results; Based on the data understanding result, the preliminary classification result is matched with a preset knowledge base to obtain background knowledge related to the preliminary classification result; The data understanding result and the background knowledge are integrated, and the preliminary classification result is corrected through a preset error correction strategy to obtain the corrected classification result.

6. The method according to claim 1, characterized in that The inputting the abnormal detection result into a preset security domain model for analysis and correction to obtain a corrected abnormal result specifically includes: Perform risk identification on the abnormal detection result through a preset security domain model to obtain a security analysis result, wherein the security analysis result includes a risk type, a risk level, and a risk description; Based on the security analysis result, obtaining security knowledge related to the abnormal detection result in a preset security database; The safety analysis result and the safety knowledge are integrated, and the abnormal detection result is corrected through a preset abnormal correction strategy to obtain the corrected abnormal result.

7. The method according to claim 1, characterized in that The fusing the corrected classification result and the corrected abnormal result to obtain a fusion result specifically includes: The abnormality correction result is structured to obtain structured abnormality information, wherein the abnormality information includes an abnormality type, an abnormality location, and an abnormality level; Mapping the abnormal information to the corrected classification result to obtain a target classification result, wherein the target classification result is an adjustment result of the original classification result according to the abnormal information; Calculating the difference between the target classification result and the corrected classification result; If the difference is greater than or equal to the preset difference threshold, the target classification result is used as the fusion result; if the difference is less than or equal to the preset difference threshold, the corrected classification result is used as the fusion result.

8. An end-to-end hybrid expert model training device, characterized in that: The device comprises an acquisition module (201) and a processing module (202), wherein: The acquisition module (201) is used to acquire input data; The processing module (202) is used to classify and grade the confidence of the input data using preset traditional rules to obtain a preliminary classification result, wherein the preset traditional rules include preset data rules and preset confidence thresholds, wherein the preset data rules are a set of rules for classifying data, and the preset confidence threshold is a threshold for judging the credibility of the classification result; The processing module (202) is further used to perform anomaly detection on the input data based on a preset expert small model to obtain anomaly detection results; The processing module (202) is further used to input the preliminary classification result into a preset general knowledge small model for analysis and correction to obtain a corrected classification result; The processing module (202) is further used to input the abnormal detection result into a preset security domain model for analysis and correction to obtain a corrected abnormal result; The processing module (202) is further used to fuse the corrected classification result and the corrected abnormal result to obtain a fused result, and obtain a manual review result for the fused result according to a preset human-computer interaction rule to obtain a final review result; The processing module (202) is also used to use the final audit result as training data to train the preset expert small model, the preset general knowledge small model and the preset security domain model.

9. An electronic device, characterized in that: The electronic device (300) comprises a processor (301), a memory (305), a user interface (303) and a network interface (304), wherein the memory (305) is used to store instructions, the user interface (303) and the network interface (304) are used to communicate with other devices, and the processor (301) is used to execute the instructions stored in the memory (305) so that the electronic device (300) executes the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed, the method according to any one of claims 1 to 7 is executed.

Images