Security scheme processing method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a guarantee scheme processing method and device, electronic equipment and a storage medium. The method comprises the steps of obtaining a user question, wherein the user question is used for describing an activity operation scheme and / or an activity scene; constructing a first prompt word based on the user question; the first prompt word is input into a pre-trained language model for reasoning, question reply corresponding to the user question is generated, and the question reply comprises potential faults related to the activity operation scheme and / or potential faults related to the activity scene and guarantee schemes corresponding to the potential faults. According to the method and the device, the potential faults related to the activity operation scheme and / or the potential faults related to the activity scene can be automatically analyzed, and the guarantee scheme corresponding to the potential faults can be automatically generated, so that the labor cost and the time cost of activity guarantee can be saved.

Description

Technical Field

[0001] The embodiments of the present disclosure relate to the field of artificial intelligence technology. More specifically, the embodiments of the present disclosure relate to a security solution processing method, device, electronic device and storage medium. Background Art

[0002] This section is intended to provide a background or context to the embodiments of the disclosure that are recited in the claims. No description herein is admitted to be prior art by inclusion in this section.

[0003] As products are updated and iterated, a large number of product functions, complex interaction scenarios, and changing activity operation methods are usually accumulated. This growing complexity not only increases the difficulty of product design and development, but also increases the risk of functional and performance problems in activity operations. Especially during activities with high user participation, once there are failures such as the inability to implement functions normally and insufficient performance, it will not only affect the user experience, but may also have a negative impact on the brand image. It can be seen that how to ensure the functional availability and performance stability in activities is a technical problem that needs to be solved urgently. Summary of the invention

[0004] In a first aspect of an embodiment of the present disclosure, a method for processing a security plan is provided, comprising: obtaining a user question, wherein the user question is used to describe an activity operation plan and / or an activity scenario; constructing a first prompt word based on the user question; inputting the first prompt word into a pre-trained language model for reasoning, and generating a question answer corresponding to the user question, wherein the question answer includes potential faults involved in the activity operation plan and / or potential faults involved in the activity scenario, and a security plan corresponding to the potential faults.

[0005] In a second aspect of the embodiments of the present disclosure, a security solution processing device is provided, including: a first acquisition module, used to obtain a user question, wherein the user question is used to describe an activity operation plan and / or an activity scenario; a first construction module, used to construct a first prompt word based on the user question; a first reasoning module, used to input the first prompt word into a pre-trained language model for reasoning, and generate a question answer corresponding to the user question, wherein the question answer includes potential faults involved in the activity operation plan and / or potential faults involved in the activity scenario, and a security solution corresponding to the potential faults.

[0006] In a third aspect of the embodiments of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to execute the security solution processing method.

[0007] In a fourth aspect of the embodiments of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the security solution processing method is implemented.

[0008] In a fifth aspect of the embodiments of the present disclosure, a program product is provided, including a program code. When the program code is run on an electronic device, the program code is used to enable the electronic device to execute the security solution processing method.

[0009] The above embodiments of the present disclosure have at least the following beneficial effects: based on LLM, it can understand and answer user questions, automatically analyze potential faults involved in the activity operation plan and / or potential faults involved in the activity scenario, and automatically generate a protection plan corresponding to the potential fault. Compared with the method of manually analyzing potential faults and manually searching for protection experience documents, it not only reduces the requirements for the user's technical level, but also shortens the overall time for analyzing potential faults and designing activity protection plans, and also reduces the risk of missing potential faults in manual analysis, which is conducive to saving labor costs and time costs, improving the efficiency and quality of activity protection, and effectively ensuring the functional availability and performance stability in subsequent activities. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The above and other objects, features and advantages of the exemplary embodiments of the present disclosure will become readily understood by reading the detailed description below with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present disclosure are shown in an exemplary and non-limiting manner, in which:

[0011] Figure 1 is a flow chart of a method for processing a security solution provided by an exemplary embodiment;

[0012] Figure 2 is a schematic diagram of a knowledge retrieval page provided by an exemplary embodiment;

[0013] Figure 3 is a schematic diagram of a knowledge retrieval page provided by an exemplary embodiment;

[0014] Figure 4 is a schematic diagram of a knowledge retrieval page provided by an exemplary embodiment;

[0015] Figure 5 is a schematic diagram of a knowledge retriever provided by an exemplary embodiment;

[0016] Figure 6 is a schematic diagram of a knowledge generator provided by an exemplary embodiment;

[0017] Figure 7 is a block diagram of a security solution processing device provided by an exemplary embodiment;

[0018] Figure 8 It is a schematic diagram of a readable storage medium corresponding to a security solution processing method provided by an exemplary embodiment;

[0019] Fig. 9 It is a schematic diagram of an electronic device capable of implementing the above method provided by an exemplary embodiment.

[0020] In the drawings, the same or corresponding reference numerals represent the same or corresponding parts. DETAILED DESCRIPTION

[0021] The principles and spirit of the present disclosure will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement the present disclosure, and are not intended to limit the scope of the present disclosure in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0022] Those skilled in the art will appreciate that the embodiments of the present disclosure may be implemented as a system, device, apparatus, method, computer-readable storage medium, or program product. Therefore, the present disclosure may be specifically implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0023] According to an embodiment of the present disclosure, a security solution processing method, device, electronic device and storage medium are proposed.

[0024] In this document, it should be understood that any number of elements in the drawings is for illustration and not limitation, and any naming is only for distinction and does not have any limiting meaning. In addition, the data involved in this disclosure may be data authorized by the user or fully authorized by all parties.

[0025] The principle and spirit of the present disclosure are explained in detail below with reference to several representative embodiments of the present disclosure.

[0026] Application Scenario Overview

[0027] In some embodiments, before the activity starts, the operations staff usually provides an activity operation plan, and then the technical staff manually analyzes the activity operation plan to extract the activity scenarios and user operation links that may be involved in the activity, and relies on manual experience to analyze the possible failures that may occur during the activity, and then further designs activity guarantee plans for these potential failures.

[0028] In some embodiments, staff can summarize the failures and support experiences that occurred in previous activities and accumulate them into a knowledge base. Subsequently, by manually searching the knowledge base for support experience documents related to the operation plan of this activity, it can help prevent and solve possible failures during the activity.

[0029] It can be seen that in the above embodiments, on the one hand, manually analyzing potential faults and manually searching for guarantee experience documents not only requires a high technical level of the staff, but also takes a long time overall, resulting in high manpower and time costs for activity guarantee, and it is easy to miss potential faults, so there will be no further search for guarantee experience documents related to these missed potential faults, resulting in the pre-designed activity guarantee plan being not comprehensive enough and unable to effectively guarantee the functional availability and performance stability in the activity. On the other hand, with the continuous precipitation of the knowledge base, the number of guarantee experience documents continues to increase, and it becomes increasingly difficult for staff to manually retrieve the information they actually need from the massive amount of knowledge.

[0030] It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principle of the present disclosure, and the embodiments of the present disclosure are not limited in this respect. On the contrary, the embodiments of the present disclosure can be applied to any applicable scenario. SUMMARY OF THE INVENTION

[0032] In view of this, this specification provides a technical solution for automatically analyzing potential faults and automatically generating protection solutions based on a large-scale language model (LLM).

[0033] Large Language Model (LLM) can also be called a large model, a large language model, a large pre-trained model, etc. Large-scale language models can usually be built based on deep neural networks with more than billions of parameters. They are trained through large-scale corpora (including but not limited to pre-training, supervised fine-tuning, reward modeling, reinforcement learning, etc.), learn and reason about the grammar and semantics of natural language, statistical information of big data, and generate human-readable text content. In recent years, large-scale language model technology has been developing rapidly, especially in natural language processing tasks such as question answering, text generation, text summarization, and text understanding.

[0034] The core concept of this manual is:

[0035] On the one hand, users only need to input the assurance knowledge file, and the knowledge generator of the activity assurance system can understand the user's intention based on LLM, extract key information from the assurance knowledge file and generate structured knowledge entries to build a knowledge base.

[0036] In some embodiments of the present disclosure, a security knowledge file is obtained, wherein the security knowledge file is used to describe historical failures involved in historical activity operation plans, historical failures involved in historical activity scenarios, and / or historical security plans corresponding to the historical failures; a fifth prompt word is constructed based on the security knowledge file and a fourth prompt word, wherein the fourth prompt word is used to describe a preset type of activity scenario, a structured format of a knowledge entry, and an example of a knowledge entry; the fifth prompt word is input into a pre-trained language model for reasoning to generate knowledge entries extracted from the security knowledge file; and a knowledge base is constructed based on the generated knowledge entries.

[0037] Through the above methods, based on LLM, unstructured security knowledge documents can be automatically converted into structured knowledge terms, and a knowledge base can be constructed based on structured knowledge terms. Compared with the method of directly storing unstructured security knowledge documents in the knowledge base, it can not only efficiently and cost-effectively build and expand the knowledge base, but also help improve the subsequent retrieval efficiency and improve the retrieval effect, which is conducive to improving the efficiency and quality of subsequent activity security.

[0038] On the other hand, the user only needs to input the activity operation plan and / or activity scenario, and the knowledge retriever of the activity assurance system can understand the user's intention based on LLM, infer the potential failures involved in the activity operation plan and / or the potential failures involved in the activity scenario, and automatically generate an assurance plan corresponding to the potential failures.

[0039] In some embodiments of the present disclosure, a user question is obtained, where the user question is used to describe an activity operation plan and / or an activity scenario; a first prompt word is constructed based on the user question; the first prompt word is input into a pre-trained language model for reasoning, and a question answer corresponding to the user question is generated, wherein the question answer includes potential failures involved in the activity operation plan and / or potential failures involved in the activity scenario, and a protection plan corresponding to the potential failures.

[0040] Through the above methods, LLM can understand and answer user questions, automatically analyze potential failures involved in the activity operation plan and / or potential failures involved in the activity scenario, and automatically generate protection plans corresponding to potential failures. Compared with the method of manually analyzing potential failures and manually searching for protection experience documents, it not only reduces the requirements for user technical level, but also shortens the overall time for analyzing potential failures and designing activity protection plans, and reduces the risk of missing potential failures in manual analysis, which is conducive to saving labor costs and time costs, improving the efficiency and quality of activity protection, and effectively ensuring functional availability and performance stability in subsequent activities.

[0041] Exemplary Methods

[0042] The technical concept of this specification is described in detail below through specific embodiments.

[0043] One or more embodiments shown in the present disclosure can be applied to a server, which can provide activity assurance services for terminals used by users. In this case, a pre-trained language model can be deployed on the server. For example, in response to a user inputting a user question on a terminal used by the user, the user question can describe an activity operation plan, and the terminal can send the user question to a server that provides activity assurance services; further, the server can first construct an input prompt word based on the user question, and then input the input prompt word into the pre-trained language model for reasoning to obtain potential faults involved in the activity operation plan and assurance plans corresponding to the potential faults; further, the server can send the inferred potential faults and assurance plans to the terminal as a question reply corresponding to the user question.

[0044] One or more embodiments shown in the present disclosure may be applied to a terminal. In this case, a pre-trained language model may be deployed in the terminal. For example, in response to obtaining a user question, the terminal may first construct an input prompt word based on the user question, and then input the input prompt word into the pre-trained language model for reasoning, to obtain potential faults involved in the activity operation plan and a safeguard plan corresponding to the potential faults as a question answer corresponding to the user question.

[0045] In some embodiments, the activity assurance service can also be described as an assurance solution processing service, a knowledge retrieval service, a knowledge generation service, a knowledge base optimization service, etc., which is not limited in this disclosure. For the specific content of the above services, please refer to one or more embodiments shown below, which will not be described in detail here.

[0046] In the embodiments of the present disclosure, the server may include a server, a server cluster formed by multiple servers, or a cloud server. The server may be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0047] In the embodiments of the present disclosure, the terminal may be an electronic device used by a user, and may specifically include but is not limited to a smart phone, a desktop computer, a tablet computer, a laptop computer, an e-book reader, a smart watch, a smart bracelet, and other electronic devices with certain computing capabilities.

[0048] In the implementation manner of the present disclosure, the terminal and the server may be directly or indirectly connected via wired communication or wireless communication, and the present disclosure does not impose any special limitation thereto.

[0049] The activity guarantee system involved in the present disclosure may include two parts: a knowledge generator and a knowledge retriever. The knowledge retriever will be described first, and then the knowledge generator.

[0050] See also Figure 1 , Figure 1 This is a flowchart of a method for processing a security solution provided by an exemplary embodiment. The method may include the following steps:

[0051] Step S101: Obtain user questions, where the user questions are used to describe activity operation plans and / or activity scenarios.

[0052] The user question can be described in at least one of the following ways: natural language; image file; audio file; text file. For ease of description, let's take the user question described in natural language as an example. Figure 2 , Figure 3 and Figure 4 Give an example.

[0053] For example, Figure 2 FIG. 1 is a schematic diagram of a knowledge search page provided by an exemplary embodiment. Figure 2 As shown, the obtained user questions can be the specific content of the activity operation plan based on the natural language description, which is "Album information: 32 yuan / copy, 13 songs (2 songs have been launched, 8 songs will be launched on June 14, 2 songs will be launched on June 25, and 1 song will be launched at a to-be-determined time). Operation gameplay: 1) Multiple versions: 3 versions; 2) Welfare unlocking: audio, video, pictures, avatar pendants, APP icons, exclusive skins; 3) Nameplate benefits: 5 pieces; 4) Exclusive record sharing card; 5) Lyrics sharing card; 6) Dynamic sales page".

[0054] For example, Figure 3 FIG. 1 is a schematic diagram of a knowledge search page provided by an exemplary embodiment. Figure 3 As shown, the obtained user question may be an activity scenario described based on natural language, which is a “digital album reservation scenario”.

[0055] For example, Figure 4 FIG. 1 is a schematic diagram of a knowledge search page provided by an exemplary embodiment. Figure 4 As shown, the obtained user question can be a flexible question based on natural language description, such as "How to ensure the digital college reservation scenario?" This flexible question describes the activity scenario of "reservation". It should be noted that Figure 4The user question shown in is only an exemplary description. The user can organize the language as needed. There is no special limitation on the format of the user question. For example, Figure 4 The user problem shown in can also be described as "I want to guarantee a digital appointment event, please give me some advice."

[0056] In some embodiments, in addition to describing user questions based on natural language, user questions can also be described based on image files. For example, the obtained user questions can be picture versions of operational activity plans. In this case, if LLM supports multimodal input, the image file can be directly input into LLM for reasoning; if LLM only supports text input, the user questions in text form can be extracted from the image file through image processing technology, and then the extracted text can be input into LLM for reasoning.

[0057] In some embodiments, the user problem may also be described based on an audio file. For example, the obtained user problem may be a recording of a meeting discussing an operation activity plan.

[0058] In some embodiments, the user problem may also be described based on a text file. For example, it supports uploading files in .doc, .txt and other formats, and the obtained user problem may be an activity operation plan document uploaded by the user.

[0059] In the above embodiment, when the user question is described based on an image file, an audio file or a text file, if the LLM supports multimodal input, the image file, the audio file or the text file can be directly input into the LLM for reasoning; if the LLM only supports text input, the user question in text form can be extracted from the image file, the audio file or the text file, and then the extracted text can be input into the LLM for reasoning, which will not be elaborated here.

[0060] Step S102: constructing a first prompt word based on the user question.

[0061] For example, after obtaining the user's question (recorded as "question"), the first prompt word prompt#1 can be constructed as "question".

[0062] In some possible implementations, the first prompt word input to the pre-trained language model may also include a second prompt word and / or a third prompt word.

[0063] In some possible implementations, in order to help LLM better understand user intentions and improve the reasoning efficiency of LLM, vectorization processing technology can be used to preliminarily screen knowledge terms that match user questions in the knowledge base. In this case, the knowledge base includes at least one knowledge term, and each knowledge term is used to describe at least one activity scenario, a potential fault involved in this activity scenario, and a protection plan corresponding to this potential fault. The semantic similarity between the user question and each knowledge term can be calculated separately; and a knowledge term whose semantic similarity reaches a preset threshold is selected from at least one knowledge term as the second prompt word. The first prompt word may also include a second prompt word. After obtaining the user question, the first prompt word can be constructed based on the user question and the second prompt word.

[0064] The vector distances between the feature vectors of the user question and the feature vectors of each knowledge term in the knowledge base may be calculated respectively as the semantic similarity between the user question and each knowledge term.

[0065] For example, the knowledge terms can be converted from text into feature vectors, and the feature vectors of the knowledge terms can be stored in the knowledge base. After obtaining the user question, the user question can be converted into a vector form, and the cosine similarity between the feature vector of the user question and the feature vector of each knowledge term can be calculated respectively as the semantic similarity between the user question and each knowledge term; based on the calculated semantic similarity, the knowledge terms whose semantic similarity reaches a preset threshold can be screened out from the knowledge base as the second prompt word prompt#2; further, the first prompt word prompt#1 can be constructed as "question+prompt#2". It should be noted that in the above embodiment, in addition to cosine similarity, vector distance can also be calculated based on other methods, and the present disclosure does not limit this.

[0066] In some possible implementations, in order to help the large-scale language model better understand the user's intention and improve the reasoning accuracy of the large-scale language model, the user can be guided to better describe the user's question with reference to the user's question example by providing a user's question example and / or a question answer example, and the LLM can be guided to better generate a question answer with reference to the question answer example. In this case, the first prompt word may also include a third prompt word, and the third prompt word is used to describe the user's question example that supports input and / or the question answer example corresponding to the user's question example. After obtaining the user's question, the first prompt word can be constructed based on the user's question and the third prompt word.

[0067] For example, the first prompt word prompt#1 may be constructed as "question+prompt#3".

[0068] In some possible implementations, after obtaining the user question, the first prompt word may be constructed based on the user question, the second prompt word, and the third prompt word.

[0069] For example, the first prompt word prompt#1 may be constructed as "question+prompt#2+prompt#3".

[0070] Step S103: input the first prompt word into the pre-trained language model for reasoning, and generate a question answer corresponding to the user's question, wherein the question answer includes potential failures involved in the activity operation plan and / or potential failures involved in the activity scenario, and a protection plan corresponding to the potential failures.

[0071] The pre-trained language model may be LLM. The present disclosure does not specifically limit the specific implementation of LLM, for example, ChatGPT, Meta's LLaMA, etc. may be used to reduce the number of manual interventions.

[0072] For example, after the first prompt word prompt#1 is input into LLM for reasoning, the following can be generated: Figure 2 Answer the questions shown. Figure 2 The activity scenarios involved in the operation activity plan shown include unlocking items, multiple covers, and pre-sales. The potential faults involved in the operation activity plan include unlocking item configuration problems, multiple cover fulfillment interactions, avatar pendant unlocking items, and single online. Among them, the potential faults involved in the activity scenario of "unlocking items" include unlocking item configuration problems and avatar pendant unlocking items. The potential faults involved in the activity scenario of "multiple covers" include multiple cover fulfillment interactions. The potential faults involved in the activity scenario of "pre-sale" include single online. The protection plan corresponding to the potential fault of "unlocking item configuration problem" is "before guaranteeing the album activity, check the function according to the configuration that is completely consistent with the online album", the protection plan corresponding to the potential fault of "multiple cover fulfillment interaction" is "multiple cover albums need to pay attention to various interactions and fulfillment, whether purchase and fulfillment can match", the protection plan corresponding to the potential fault of "avatar pendant unlocking items" is "when the album activity is equipped with avatar pendants, notify the member side in advance to do the guarantee and adjust the interface current limit", and the protection plan corresponding to the potential fault of "single online" is "for pre-sold albums, pay attention to whether the function is normal before and after the single status is switched".

[0073] For example, Figure 3 The potential failures involved in the activity scenario shown include the appointment resale transition experience and performance issues. Among them, the protection plan corresponding to the potential failure of "appointment resale transition experience" is "appointment scenario, consider the countdown accuracy, and refresh the page at the end of the appointment", and the protection plan corresponding to the potential failure of "performance issue" is "appointment scenario, pay attention to page performance, and estimate the traffic based on the appointment volume".

[0074] It should be noted that Figures 2 to 4 This is only an exemplary description, and the present disclosure does not specifically limit this. For example, a potential fault may have multiple corresponding protection solutions. For example, in addition to the activity scenario, potential faults and protection solutions, the answer to the question may also include but is not limited to the fault description of the potential fault, the source of the knowledge entry, the access link of the relevant protection knowledge file, etc., which are no longer shown one by one in the figure.

[0075] In some embodiments, the potential faults involved in the present disclosure may also be described as activity problems, activity defects, typical bugs, guarantee points, function points, failure points, etc., which are not limited in the present disclosure.

[0076] In some possible implementations, the potential problems and safeguards included in the question answers output by the pre-trained language model may be knowledge terms directly retrieved from the knowledge base based on the first prompt word, or may be question answers generated by further integrating the retrieved knowledge terms, or may be question answers automatically generated based on the advanced semantic understanding capabilities of LLM when no knowledge terms that fully match or are similar to the user's question can be retrieved from the knowledge base.

[0077] For example, the user question describes a new activity scenario, and the knowledge base has not yet stored any knowledge entries related to this new activity scenario. In this case, LLM can infer and generate potential faults involved in the new activity scenario and the protection plans corresponding to the potential faults based on the knowledge entries related to existing activity scenarios similar to the new activity scenario.

[0078] In the above embodiment, when the user problem involves a new activity scenario, compared with the method of manually analyzing potential faults and manually searching for protection solutions, the potential faults involved in the new activity scenario and the protection solutions corresponding to the potential faults are automatically generated based on LLM reasoning. This can help the staff to quickly analyze the potential faults involved in the new activity scenario, reduce the technical level requirements for the staff, and generate a backup protection solution when there is no relevant protection experience in the knowledge base, thereby ensuring the functional availability and performance stability of the activity.

[0079] In some possible implementations, after generating the answer to the question, the prediction results of the LLM can be formatted using JavaScript or Python scripts for easy front-end display.

[0080] In some possible implementations, after generating a question answer, a feedback score for the question answer can be obtained, where the feedback score is used to characterize the user's evaluation of the question answer's ability to solve the user's problem; and the recommendation priority of knowledge terms associated with the question answer is adaptively adjusted based on the feedback score.

[0081] For example, after generating an answer to a question, you can obtain a feedback score for the answer to the question; if the feedback score indicates that the user is satisfied with the ability of the answer to the question to solve the user's problem, the recommendation priority of the knowledge terms associated with the answer to the question can be increased; if the feedback score indicates that the user is dissatisfied with the ability of the answer to the question to solve the user's problem, the recommendation priority of the knowledge terms associated with the answer to the question can be decreased.

[0082] If the answer to the question is a knowledge term directly retrieved by LLM in the knowledge base, the knowledge terms associated with the answer to the question are the retrieved knowledge terms. If the answer to the question is generated by LLM based on some knowledge terms in the knowledge base, the knowledge terms associated with the answer to the question are these knowledge terms.

[0083] Among them, the feedback score of the answer to the question can be in the form of a score or a grade, and can also be in the form of positive or negative feedback, or whether it is adopted, which is not limited in this disclosure. For example, a positive integer of "1-10" can be used as the feedback score of the answer to the question, and the higher the score, the more satisfied the user is with the ability of the answer to the question to solve the user's problem. For example, the grades of "very satisfied, relatively satisfied, average, not very satisfied, very dissatisfied" can be used as the feedback score of the answer to the question. For example, the options of "thumbs-up" and "thumbs-down" can be used to indicate whether the user is satisfied or dissatisfied with the answer to the question. For example, the options of "adopt" and "disadvantage" can be used to indicate whether the user is satisfied or dissatisfied with the answer to the question.

[0084] Figure 5 FIG. 1 is a schematic diagram of a knowledge search engine provided by an exemplary embodiment. Figure 5 As shown, after obtaining the user question, the knowledge terms that match the user question can be preliminarily screened in the knowledge base as the second prompt word. Further, the first prompt word can be constructed based on the user question, the second prompt word and the third prompt word. Further, the first prompt word can be input into the LLM for reasoning, and the answer to the question corresponding to the user question can be output. The answer to the question can include potential faults involved in the activity operation plan and / or potential faults involved in the activity scenario, and the protection plan corresponding to the potential fault. Further, if positive feedback is obtained for the answer to the question, the recommendation priority of the knowledge terms associated with the answer to the question can be adaptively improved, or the answer to the question can be stored in the knowledge base as a new knowledge term; if negative feedback is obtained for the answer to the question, the recommendation priority of the knowledge terms associated with the answer to the question can be adaptively reduced, and the user can be prompted to adjust the first prompt word.

[0085] Next, we will continue to describe the knowledge generator of the activity support system.

[0086] In some possible implementations, since historical fault records, typical defect summaries, and assurance experience documents are usually unstructured assurance knowledge files, if these assurance knowledge files are directly stored in the knowledge base, it will be difficult for staff to quickly retrieve the required content from the massive assurance knowledge files. Therefore, the unstructured assurance knowledge files can be automatically converted into structured knowledge terms based on LLM, and the knowledge base can be constructed based on the structured knowledge terms, so that not only the knowledge base can be constructed and expanded efficiently and at low cost, but also it is conducive to improving the subsequent retrieval efficiency and improving the retrieval effect. In this case, an assurance knowledge file is obtained, and the assurance knowledge file is used to describe the historical faults involved in the historical activity operation plan, the historical faults involved in the historical activity scene, and / or the historical assurance plan corresponding to the historical fault; the fifth prompt word is constructed based on the assurance knowledge file and the fourth prompt word, wherein the fourth prompt word is used to describe the preset type of the activity scene, the structured format of the knowledge term, and the knowledge term example; the fifth prompt word is input into the pre-trained language model for reasoning to generate the knowledge term extracted from the assurance knowledge file; and the knowledge base is constructed based on the generated knowledge term.

[0087] The preset types of activity scenes can be pre-set by staff. Reasonable classification of activity scene types is directly related to the accuracy and practicality of subsequent knowledge entry generation, and relevant fields should be covered.

[0088] Among them, the structured format of the knowledge entry may include at least one of the following: activity scenario; potential fault; fault description; protection plan; source of the knowledge entry; access link to the protection knowledge file; importance level; the time when the knowledge entry is entered into the knowledge base; the time when the protection knowledge file is created.

[0089] The knowledge entry examples may be written by staff in the structured format of the knowledge entry. By inputting the knowledge entry examples into the LLM as part of the fifth prompt, it is helpful to guide the LLM to convert the security knowledge document into a structured knowledge entry in accordance with the structured format of the knowledge entry and with reference to the knowledge entry examples.

[0090] Among them, you can use Markdown, txt and other file formats to store knowledge terms and build a knowledge base as the basis for knowledge retrieval.

[0091] In some embodiments, with the continuous iteration of products and technologies, activity scenarios, potential failures, and safeguard solutions are constantly updated, and some old knowledge terms are no longer applicable to the current environment. Therefore, in the above embodiments, if LLM refers to these old knowledge terms to generate answers to questions, it may affect the judgment of the staff, resulting in the staff being unable to obtain new and frequently used knowledge terms in priority.

[0092] In some possible implementations, the recommendation priority of each knowledge term in the knowledge base can be dynamically adjusted through a keep-alive mechanism, so that the LLM preferentially refers to newer, more important, and frequently used knowledge terms to generate answers to questions.

[0093] In this case, the recommendation priority of any knowledge term may be adaptively adjusted according to the time when any knowledge term is entered into the knowledge base, and / or the recommendation priority of any knowledge term may be adaptively adjusted according to the creation time of the security knowledge file from which any knowledge term originates.

[0094] For example, due to the continuous iteration of products and technologies, the usability of old knowledge will usually decrease. Therefore, the recommendation priority of knowledge entries that were entered into the knowledge base earlier and / or used to record earlier assurance plans can be lowered, and vice versa.

[0095] In this case, the recommendation priority of any knowledge term can be adaptively adjusted according to the importance level of any knowledge term.

[0096] For example, when the same activity scenario involves multiple potential faults and the same potential fault corresponds to multiple protection plans, the recommendation priority of knowledge entries with a higher importance level can be increased, and vice versa.

[0097] In this case, the recommendation priority of any knowledge term may be adaptively adjusted according to the number of positive feedbacks obtained after any knowledge term is recommended. And / or, the recommendation priority of any knowledge term may be adaptively adjusted according to the number of negative feedbacks obtained after any knowledge term is recommended.

[0098] For example, for knowledge entries that receive more positive feedback after being recommended, the recommendation priority can be increased; for knowledge entries that receive more negative feedback after being recommended, the recommendation priority can be lowered.

[0099] In some possible implementations, through a keep-alive mechanism, a knowledge retriever may be used to dynamically adjust existing knowledge entries in a knowledge base, update content that is no longer accurate, or delete outdated content to avoid causing interference.

[0100] In this case, the content of the target knowledge term may be updated in response to an update operation on the target knowledge term in the knowledge base.

[0101] For example, the assurance knowledge file after the assurance plan is updated is input as a user question into the pre-trained language model for reasoning, and a question answer corresponding to the user question is generated. The question answer includes the potential faults involved in the assurance knowledge file and the assurance plan before the update corresponding to the potential faults; the knowledge entry associated with the question answer in the knowledge base is determined as the target knowledge entry, and the content of the assurance plan before the update contained in the target knowledge entry is updated based on the updated assurance plan.

[0102] Among them, the updated protection knowledge file of the protection plan may include but is not limited to new draft requirements, descriptions of significantly changed activity scenarios, etc.

[0103] In this case, the target knowledge term may be deleted in response to a deletion operation on the target term.

[0104] For example, the failed activity scenario is input as a user question into the pre-trained language model for reasoning, and a question answer corresponding to the user question is generated. The question answer includes the potential faults involved in the failed activity scenario and the protection plan corresponding to the potential faults; the knowledge entry associated with the question answer in the knowledge base is determined as the target knowledge entry, and the target knowledge entry is deleted.

[0105] Figure 6 FIG. 1 is a schematic diagram of a knowledge generator provided by an exemplary embodiment. Figure 6 As shown, after obtaining the security knowledge file, the fifth prompt word can be constructed based on the security knowledge file and the fourth prompt word. Further, the fifth prompt word can be input into the LLM for reasoning, and the structured knowledge terms extracted from the security knowledge file are output. Further, the structured knowledge terms can be stored in the knowledge base.

[0106] It should be noted that, in the above embodiment, embedding the intelligent subtitle elimination service in the intelligent video slicing service is merely an exemplary description. In addition, the intelligent subtitle elimination service can also be provided separately, which will not be elaborated here.

[0107] Exemplary Devices

[0108] In an exemplary embodiment of the present disclosure, a security solution processing device is also provided.

[0109] See also Figure 7 , Figure 7 It is a block diagram of a security solution processing device provided by an exemplary embodiment.

[0110] like Figure 7 As shown, the protection scheme processing device 700 may include: a first obtaining module 701, a first constructing module 702 and a first reasoning module 703. Among them:

[0111] In some embodiments, a first acquisition module is used to obtain a user question, wherein the user question is used to describe an activity operation plan and / or an activity scenario; a first construction module is used to construct a first prompt word based on the user question; and a first reasoning module is used to input the first prompt word into a pre-trained language model for reasoning to generate a question answer corresponding to the user question, wherein the question answer includes potential faults involved in the activity operation plan and / or potential faults involved in the activity scenario, and a protection plan corresponding to the potential faults.

[0112] In some embodiments, the first prompt word also includes a second prompt word; the knowledge base includes at least one knowledge entry, each knowledge entry is used to describe at least an activity scenario, a potential fault involved in the activity scenario, and a protection plan corresponding to the potential fault; the device also includes a second construction module; the second construction module is used to: calculate the semantic similarity between the user question and each knowledge entry respectively; select a knowledge entry whose semantic similarity reaches a preset threshold from the at least one knowledge entry as the second prompt word.

[0113] In some embodiments, the second construction module is used to respectively calculate the vector distance between the feature vector of the user question and the feature vector of each knowledge term as the semantic similarity.

[0114] In some embodiments, the first prompt word also includes a third prompt word; the third prompt word is used to describe a user question example that supports input and / or a question answer example corresponding to the user question example.

[0115] In some embodiments, the device also includes a first adjustment module; the first adjustment module is used to: obtain a feedback score for the answer to the question, the feedback score being used to characterize the user's evaluation of the ability of the answer to the question to solve the user's problem; and adaptively adjust the recommendation priority of the knowledge terms associated with the answer to the question based on the feedback score.

[0116] In some embodiments, the user question supports description in at least one of the following ways: natural language; image file; audio file; text file.

[0117] In some embodiments, the device also includes: a second acquisition module, used to obtain a security knowledge file, wherein the security knowledge file is used to describe historical failures involved in historical activity operation plans, historical failures involved in historical activity scenarios, and / or historical security plans corresponding to the historical failures; a third construction module, used to construct a fifth prompt word based on the security knowledge file and the fourth prompt word, wherein the fourth prompt word is used to describe a preset type of activity scenario, a structured format of a knowledge entry, and a knowledge entry example; a second reasoning module, used to input the fifth prompt word into a pre-trained language model for reasoning, and generate knowledge entries extracted from the security knowledge file; and a fourth construction module, used to construct a knowledge base based on the generated knowledge entries.

[0118] In some embodiments, the structured format of the knowledge entry includes at least one of the following: activity scenario; potential fault; fault description; assurance plan; source of the knowledge entry; access link to the assurance knowledge file; importance level; the time when the knowledge entry is entered into the knowledge base; the time when the assurance knowledge file is created.

[0119] In some embodiments, the device also includes a second adjustment module; the second adjustment module is used to adaptively adjust the recommendation priority of any knowledge term according to the time when any knowledge term is entered into the knowledge base; the second adjustment module is used to adaptively adjust the recommendation priority of any knowledge term according to the creation time of the security knowledge file from which any knowledge term originates; the second adjustment module is used to adaptively adjust the recommendation priority of any knowledge term according to the importance level of any knowledge term; the second adjustment module is used to adaptively adjust the recommendation priority of any knowledge term according to the number of positive feedbacks obtained after any knowledge term is recommended; the second adjustment module is used to adaptively adjust the recommendation priority of any knowledge term according to the number of negative feedbacks obtained after any knowledge term is recommended.

[0120] In some embodiments, the device also includes a third adjustment module; the third adjustment module is used to update the content of the target knowledge term in response to an update operation on the target knowledge term in the knowledge base; the third adjustment module is used to delete the target knowledge term in response to a delete operation on the target knowledge term.

[0121] In some embodiments, the third adjustment module is used to: input the assurance knowledge file after the assurance plan is updated as the user question into a pre-trained language model for reasoning, and generate a question answer corresponding to the user question, wherein the question answer includes the potential fault involved in the assurance knowledge file and the assurance plan before update corresponding to the potential fault; determine the knowledge entry associated with the question answer in the knowledge base as the target knowledge entry, and update the content of the assurance plan before update contained in the target knowledge entry based on the updated assurance plan.

[0122] In some embodiments, the third adjustment module is used to: input the failed activity scenario as the user question into a pre-trained language model for reasoning, generate a question answer corresponding to the user question, and the question answer includes the potential faults involved in the failed activity scenario and the protection plan corresponding to the potential faults; determine the knowledge entry associated with the question answer in the knowledge base as the target knowledge entry, and delete the target knowledge entry.

[0123] The specific details of each module of the above-mentioned protection scheme processing device 700 have been described in detail in the previous description of the protection scheme processing method flow, so they are not repeated here.

[0124] It should be noted that, although several modules or units of the protection scheme processing device 700 are mentioned in the above detailed description, such division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0125] Exemplary Media

[0126] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible embodiments, various aspects of the present disclosure can also be implemented in the form of a program product, which includes a program code, and when the program product is run on an electronic device, the program code is used to enable the electronic device to perform the steps according to various exemplary embodiments of the present disclosure described in the above "Exemplary Method" section of the present specification.

[0127] See also Figure 8 , Figure 8 It is a schematic diagram of a readable storage medium corresponding to a security solution processing method provided by an exemplary embodiment.

[0128] refer to Figure 8As shown, a readable storage medium 800 for implementing the above method according to an embodiment of the present disclosure is described, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the readable storage medium of the present disclosure is not limited thereto. In the present disclosure, the readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0129] The readable storage medium can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0130] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0131] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0132] Program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0133] Exemplary Electronic Devices

[0134] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above security solution processing method is also provided.

[0135] See also Fig. 9 , Fig. 9 It is a schematic diagram of an electronic device capable of implementing the above method provided by an exemplary embodiment.

[0136] Refer to the following Fig. 9 hereinafter describes an electronic device 900 according to such an embodiment of the present disclosure. Fig. 9 The electronic device 900 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0137] like Fig. 9 As shown, the electronic device 900 is in the form of a general computing device. The components of the electronic device 900 may include but are not limited to: at least one processing unit 901, at least one storage unit 902, and a bus 903 connecting different system components (including the storage unit 902 and the processing unit 901).

[0138] The storage unit stores program codes, and the program codes can be executed by the processing unit 901, so that the processing unit 901 executes the steps of the above-mentioned various embodiments of this specification.

[0139] The storage unit 902 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 9021 and / or a cache storage unit 9022 , and may further include a read-only storage unit (ROM) 9023 .

[0140] The storage unit 902 may also include a program / utility 9024 having a set (at least one) of program modules 9025, such program modules 9025 including but not limited to: an operating system, one or more application programs, other program modules and program data, each of which or some combination may include the reality of a network environment.

[0141] Bus 903 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0142] The electronic device 900 may also communicate with one or more external devices 904 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 900, and / or communicate with any device that enables the electronic device 900 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 905. Furthermore, the electronic device 900 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 906. As shown, the network adapter 906 communicates with other modules of the electronic device 900 via a bus 903. It should be understood that although Fig. 9 Not shown, other hardware and / or software modules may be used in conjunction with electronic device 900, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0143] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the embodiment of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the embodiment of the present disclosure.

[0144] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the disclosure disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The specification and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the claims.

[0145] It should be noted that, although several units / modules or subunits / modules of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more units / modules described above can be embodied in one unit / module. Conversely, the features and functions of one unit / module described above can be further divided into multiple units / modules to be embodied.

[0146] In addition, although the operations of the disclosed method are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0147] Although the spirit and principle of the present disclosure have been described with reference to several specific embodiments, it should be understood that the present disclosure is not limited to the disclosed specific embodiments, and the division of various aspects does not mean that the features in these aspects cannot be combined to benefit, and such division is only for the convenience of expression. The present disclosure is intended to cover various modifications and equivalent arrangements included in the spirit and scope of the attached claims.

Claims

1. A method for processing a security solution, the method comprising: Obtaining a user question, where the user question is used to describe an activity operation plan and / or an activity scenario; Constructing a first prompt word based on the user question; The first prompt word is input into a pre-trained language model for reasoning to generate a question answer corresponding to the user question, wherein the question answer includes potential failures involved in the activity operation plan and / or potential failures involved in the activity scenario, and a protection plan corresponding to the potential failures.

2. According to the method of claim 1, the first prompt word further includes a second prompt word; the knowledge base includes at least one knowledge entry, each knowledge entry is used to describe at least one activity scenario, a potential fault involved in the activity scenario, and a protection plan corresponding to the potential fault; The method further comprises: Calculating the semantic similarity between the user question and each knowledge entry respectively; A knowledge term whose semantic similarity reaches a preset threshold is selected from the at least one knowledge term as the second prompt word.

3. According to the method described in any one of claims 1 to 2, the first prompt word also includes a third prompt word; the third prompt word is used to describe a user question example that supports input and / or a question answer example corresponding to the user question example.

4. The method according to claim 1, further comprising: Obtaining a feedback score for the answer to the question, wherein the feedback score is used to represent a user's evaluation of the ability of the answer to the question to solve the user's problem; Adaptively adjust the recommendation priority of the knowledge terms associated with the question answer according to the feedback score.

5. The method according to claim 1, further comprising: Obtaining a guarantee knowledge file, where the guarantee knowledge file is used to describe historical failures involved in historical activity operation plans, historical failures involved in historical activity scenarios, and / or historical guarantee plans corresponding to the historical failures; Constructing a fifth prompt word based on the guarantee knowledge file and the fourth prompt word, wherein the fourth prompt word is used to describe the preset type of the activity scene, the structured format of the knowledge entry, and the knowledge entry example; Inputting the fifth prompt word into a pre-trained language model for inference to generate knowledge terms extracted from the security knowledge file; Build a knowledge base based on the generated knowledge terms.

6. The method according to claim 5, further comprising at least one of the following: In response to an update operation on a target knowledge term in the knowledge base, updating the content of the target knowledge term; In response to a deletion operation on the target knowledge term, the target knowledge term is deleted.

7. A security plan processing device, the device comprising: A first obtaining module is used to obtain user questions, where the user questions are used to describe an activity operation plan and / or an activity scenario; A first construction module, used to construct a first prompt word based on the user question; The first reasoning module is used to input the first prompt word into a pre-trained language model for reasoning, and generate a question answer corresponding to the user question, wherein the question answer includes potential failures involved in the activity operation plan and / or potential failures involved in the activity scenario, and a protection plan corresponding to the potential failures.

8. An electronic device comprising: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method according to any one of claims 1 to 6.

10. A program product, comprising a program code, wherein when the program code is run on an electronic device, the program code is used to enable the electronic device to execute any one of the methods of claims 1-6.

Images