Network security level protection management system and method based on risk guidance

Abstract

The invention discloses a network security level protection management system and method based on risk guidance, and relates to the technical field of network security level protection management, and the system comprises a module 100 which carries out the multi-channel semantic coding of a level protection requirement and equipment evidence, and generates a vector set. The module 200 constructs a semantic interaction relationship, calculates a matching score and outputs a score vector in a standardized manner. And the module 300 fuses the score vector, the risk weight and the prediction grade label, and triggers a correction mechanism when the score is abnormal. According to the network security level protection management system based on risk guidance provided by the invention, parallel modeling is carried out on network security level protection requirements and evaluation evidence information by adopting a multi-channel semantic coding structure, and deep semantic features, statistical keyword features and structural grammar features are integrated; and the adaptability and distinction degree of semantic representation to different types of input texts are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security level protection management, and specifically to a network security level protection management system and method based on risk guidance. Background Art

[0002] With the deepening implementation of the cybersecurity multi-level protection system, network information system level assessment has become an important component of the information security management system. To meet regulatory compliance requirements, different types of industry entities are required to regularly conduct conformity assessments on the technical and management measures of information systems. Traditional level assessment methods rely on experts to manually compare the level protection requirements with evidence materials such as system configuration files, equipment lists, and operation logs. This has problems such as low efficiency, strong subjectivity, and difficulty in standardization. In recent years, with the development of artificial intelligence and natural language processing technologies, researchers have begun to explore the introduction of semantic matching algorithms into level protection assessments to improve automation and intelligence. However, this is still in the initial exploratory stage and lacks mature engineering systems and model integration solutions.

[0003] The existing technologies have the following main limitations in the intelligent assessment of network security level protection: First, most methods use a single-channel semantic encoding model (such as BERT or bag-of-words model) to process evaluation evidence information and level protection requirement text, and fail to fully integrate multiple semantic feature levels, resulting in limited semantic matching accuracy; second, the matching method is usually based on bidirectional sentence vector similarity or sentence pair classifier, ignoring the association modeling problem between "local control points and overall strategic goals", making it difficult to achieve refined and structured evaluation; third, in the level label output stage, most systems use static scoring rules or directly use classification models, which cannot dynamically adjust the scoring results according to different risk dimensions, and lack the ability to perceive the strategy of key control items; in addition, current systems generally lack a unified model training module, and fail to establish a closed-loop optimization mechanism from original sample construction, model training to evaluation result feedback, which limits the model's migration and generalization capabilities between different industries and system types. In comparison, the present invention achieves structured understanding and precise matching between network equipment evaluation items and level protection requirements by constructing a full-process system of "multi-channel semantic modeling - scoring-based semantic matching - risk-guided level assessment - training feedback optimization", significantly improving the efficiency of intelligent evaluation and the accuracy of level labels, which is difficult to achieve with existing technologies. Summary of the Invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problems solved by the present invention are: the existing network security level protection assessment method has the problems of single semantic coding that makes it difficult to cover different types of evidence texts, the matching process lacks structured understanding capabilities, and the scoring output lacks a dynamic risk perception mechanism, as well as how to achieve systematic modeling and optimization closed-loop of the entire process of network security level assessment based on semantic intelligent analysis.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: a risk-guided network security level protection management system, including a network security semantic coding module, which is used to perform multi-channel semantic coding on the basic requirements information of network security level protection and the evidence information of network equipment evaluation items, and output a high-dimensional semantic feature vector in a unified format. The multi-channel semantic coding includes context modeling, statistical feature extraction and structural semantic modeling.

[0007] The cross-matching analysis module is used to receive the semantic feature vector set, construct a semantic interaction matrix between the grade requirements and the evaluation evidence, calculate the matching score through a multi-channel scoring function, aggregate based on the multi-dimensional scoring results, and output a grade matching score vector.

[0008] The feature fusion and grade scoring module is used to fuse the matching scoring vector with the preset grade requirement risk weight, generate a fusion feature vector through the fusion strategy, and input it into the grade prediction model to output the network security grade label.

[0009] As a preferred solution of the risk-guided network security level protection management system described in the present invention, the network security semantic coding module includes a deep semantic coding subunit, a statistical semantic coding subunit, a structural semantic coding subunit, and a channel fusion subunit.

[0010] As a preferred solution of the risk-guided network security level protection management system described in the present invention, the network security semantic coding module also includes a deep semantic coding sub-unit that performs context modeling on the text based on a pre-trained language model and extracts high-dimensional embedding vectors with word order dependency and syntactic structure.

[0011] The statistical semantic encoding subunit calculates the importance of keywords based on the TF-IDF or word frequency model and generates a sparse vector representation.

[0012] The structural semantic encoding subunit constructs a syntactic dependency graph, uses graph neural networks to model the structural relationships and logical dependencies in the text, and extracts structural feature vectors.

[0013] The channel fusion subunit fuses the semantic vectors output by the three encoding subunits and dynamically adjusts the fusion strategy according to the characteristics of the input data to generate a set of semantic representation vectors in a unified format.

[0014] As a preferred solution of the risk-guided network security level protection management system described in the present invention, the cross-matching analysis module includes an interactive relationship construction subunit, a scoring function integration subunit, a scoring aggregation subunit, and a scoring vector normalization subunit.

[0015] As a preferred solution of the risk-guided network security level protection management system described in the present invention, the cross-matching analysis module also includes an interactive relationship construction sub-unit that combines the level requirement semantic vectors and the device evidence semantic vectors in pairs to construct interaction pairs and generate an interaction vector matrix.

[0016] The scoring function integration subunit calculates the matching score for each group of interaction vectors through the scoring channel.

[0017] The scoring aggregation subunit aggregates the scoring results in the scoring matrix by rows or columns to generate an overall matching scoring vector for each level protection requirement.

[0018] The score vector normalization subunit normalizes and range compresses the matching score vector generated after aggregation, and outputs a score feature vector in a unified format.

[0019] As a preferred solution of the risk-guided network security level protection management system described in the present invention, the feature fusion and level scoring module includes a feature fusion subunit, a level prediction subunit, and a decision rule coordination subunit.

[0020] As a preferred solution of the risk-guided network security level protection management system described in the present invention, the feature fusion and level scoring module also includes a feature fusion sub-unit that receives a matching score vector and performs weighted fusion or gating mechanism fusion operations in combination with the risk factor vector required by the level protection.

[0021] The level prediction subunit inputs the fusion features into the classification model and outputs the corresponding level protection level label, supporting single-label and multi-label output forms.

[0022] The decision rule coordination subunit makes label corrections when the model output is inconsistent with the rule system.

[0023] Another object of the present invention is to provide a risk-guided network security level protection management method, which can solve the problems of single semantic representation, rough matching relationship modeling and lack of risk adjustment ability in level prediction in the current network security level protection intelligent assessment technology by introducing multi-channel semantic coding and scoring semantic matching path, integrating level requirement risk factors and constructing an interactive scoring matrix.

[0024] As a preferred solution of the risk-guided network security level protection management method described in the present invention, it includes: when the system receives a network security level protection assessment task, the network security semantic coding module receives the basic requirements information of the level protection and the evidence information of the network equipment assessment items, which are encoded in sequence by the deep semantic coding subunit, the statistical semantic coding subunit and the structural semantic coding subunit, and the channel fusion and control subunit fuses each channel vector to generate a set of semantic feature vectors in a unified format. The cross-matching analysis module receives the above-mentioned semantic feature vectors, the interaction relationship construction subunit generates interaction pairs, the scoring function integration subunit calculates the matching score for the interaction pair, the scoring aggregation subunit aggregates the scoring results, and the scoring vector normalization subunit generates a unified scoring vector. In the feature fusion and grade scoring module, the feature fusion subunit fuses the scoring vector with the grade risk weight, the grade prediction subunit generates the grade label, and the decision rule coordination subunit corrects the result.

[0025] Beneficial effects of the present invention: The risk-guided network security level protection management system provided by the present invention adopts a multi-channel semantic coding structure to perform parallel modeling of network security level protection requirements and evaluation evidence information, integrates deep semantic features, statistical keyword features and structural grammatical features, and improves the adaptability and discrimination of semantic representation to different types of input texts. A semantic interaction matrix is constructed and a multi-channel scoring function and aggregation mechanism are introduced to perform fine-grained modeling of the semantic association between level requirements and evaluation evidence, and realize semantic alignment and matching strength quantification at the control point level. The risk factor-guided fusion mechanism and decision rule coordination module are introduced in the level scoring process to realize the responsiveness of the level label output to changes in the weights of key control items and enhance the sensitivity of the evaluation results. The present invention achieves better results in terms of accuracy and flexibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0027] Figure 1 A framework diagram of a risk-guided network security level protection management system provided for the first embodiment of the present invention.

[0028] Figure 2 A framework diagram of a network security semantic coding module of a risk-guided network security level protection management system provided in the first embodiment of the present invention.

[0029] Figure 3A framework diagram of a cross-matching analysis module of a risk-guided network security level protection management system provided in the first embodiment of the present invention.

[0030] Figure 4 A framework diagram of a feature fusion and grade scoring module of a risk-guided network security grade protection management system provided in the first embodiment of the present invention. DETAILED DESCRIPTION

[0031] To make the above-mentioned objects, features, and advantages of the present invention more clearly understood, the following detailed description of the specific embodiments of the present invention is given in conjunction with the accompanying drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in this field without creative work should fall within the scope of protection of the present invention.

[0032] Example 1, with reference to Figure 1 , as an embodiment of the present invention, provides a risk-based network security level protection management system, including: The network security semantic encoding module 100, as the system's input processing module, receives information on the basic requirements of network security multi-level protection and evidence information for network equipment evaluation items, performs multi-channel semantic feature encoding on each, and outputs a set of semantic vectors in a unified format. This set of semantic vectors serves as input to the subsequent cross-matching analysis module 200.

[0033] After receiving the semantic vector set, the cross-matching analysis module 200 generates an interaction feature matrix through the interaction relationship construction submodule, and calculates the semantic matching score through the scoring function integration submodule. Then, through score aggregation and standardization operations, it outputs a matching score vector.

[0034] The feature fusion and grade scoring module 300 receives the matching score vector, combines it with the risk weights of the pre-set graded protection requirements, generates a fusion vector, and outputs a grade label through the grade prediction submodule. If any values in the matching score vector fall within the grade boundary or if the key requirement score is low, the rule coordination submodule in this module triggers a correction mechanism.

[0035] S1: Cybersecurity semantic coding module 100.

[0036] The cybersecurity semantic encoding module 100 performs semantic vector encoding on the basic requirements of cybersecurity level protection and evidence information for network equipment evaluation items. This module, through a multi-channel semantic expression structure, converts input text into a unified, high-dimensional semantic feature vector, providing the input basis for matching calculations in subsequent modules. This module plays a leading role in the system architecture and directly impacts the quality of semantic matching and the accuracy of level assessments.

[0037] Further, refer to Figure 2 The network security semantic coding module 100 includes a depth semantic coding subunit 101, a statistical semantic coding subunit 102, a structural semantic coding subunit 103, and a channel fusion subunit 104.

[0038] It should be noted that the network security semantic coding module 100 also includes a deep semantic coding sub-unit 101 that performs context modeling on the text based on a pre-trained language model and extracts a high-dimensional embedding vector with word order dependency and syntactic structure. This unit uses a language modeler based on the Transformer architecture to embed the complete input text and extract a semantic vector with context dependency characteristics. The original text is segmented and positionally encoded. The encoding result is input into a multi-layer Transformer network for multi-head attention calculation. The [CLS] bit or the average vector of the entire sentence in the Transformer output is extracted as the semantic representation vector.

[0039] The statistical semantic coding subunit 102 calculates the importance of keywords based on the TF-IDF or word frequency model, generates a sparse vector representation, receives the input basic requirements information of network security level protection and network equipment evaluation item evidence information, and performs deep semantic modeling on it. The input text is subjected to shallow semantic modeling based on the word statistical model. This unit does not consider the context order of the word, but counts indicators such as word frequency and inverse document frequency to construct a sparse vector representation of the input text. Its processing process includes word segmentation and stop word filtering of the text. Count the frequency of the word in the current text and document collection. Construct a sparse vector according to rules such as TF-IDF. Perform vector normalization and dimension alignment.

[0040] The structural semantic encoding subunit 103 constructs a syntactic dependency graph, uses a graph neural network to model the structural relationships and logical dependencies in the text, and extracts structural feature vectors. The input text is structurally modeled, and by extracting grammatical dependencies, semantic connections, or logical combination patterns in the text, a graph structure representation is constructed and the corresponding structural embedding is generated. The syntactic analyzer is used to identify structural grammatical relationships between words, such as subject-predicate, verb-object, modification, and parallelism. With terms as nodes and dependencies as edges, a labeled directed graph structure is formed. The constructed graph structure is embedded and calculated using a graph convolutional network or a message passing mechanism to generate a structural semantic vector representation.

[0041] The channel fusion subunit 104 fuses the semantic vectors output by the three encoding subunits and dynamically adjusts the fusion strategy based on the characteristics of the input data to generate a set of semantic representation vectors in a unified format. Dynamic fusion weights are set for the deep semantic channel, statistical semantic channel, and structural semantic channel based on attributes such as the length, syntactic structure complexity, and keyword ratio of the input text. Strategies such as weighted fusion, attention fusion, or splicing-projection fusion are implemented to combine the multi-channel semantic vectors into a single unified vector. This operator ensures that the output vector meets the input dimension and format requirements of subsequent modules.

[0042] S2: Cross-matching analysis module 200.

[0043] Cross-match analysis module 200 performs matching analysis between the semantic vector set of network security level protection basic requirements and the semantic vector set of network device evaluation item evidence. Based on a scoring matching architecture, this module constructs an interactive feature matrix, generates a matching score vector through multiple scoring factor calculations, and generates a final semantic matching score vector through multi-stage aggregation for use by subsequent scoring modules.

[0044] The core design of this module is to decompose the semantic relationship modeling process of two vector sets into multiple scoring paths and perform multi-dimensional scoring fusion processing at the vector level.

[0045] Further, refer to Figure 3 It can be seen that the cross-matching analysis module 200 includes an interactive relationship construction subunit 201 , a scoring function integration subunit 202 , a scoring aggregation subunit 203 , and a scoring vector normalization subunit 204 .

[0046] It should be noted that the cross-matching analysis module 200 also includes an interaction relationship construction sub-unit 201 that combines the level requirement semantic vectors with the device evidence semantic vectors in pairs to construct interaction pairs and generate an interaction vector matrix. The semantic coding vector set of the basic requirements for network security level protection is

[0047] Network equipment evaluation item evidence semantic encoding vector set

[0048] Pair Collection Each vector in With collection Each vector in Combine two by two, Represents the total number of semantic coding vectors of the basic requirements for network security level protection, The first one in the semantic coding vector set of basic requirements for network security level protection indexes, , Represents the total number of semantic encoding vectors of network equipment evaluation item evidence, The first one in the set of semantic encoding vectors of network equipment evaluation items indexes, .

[0049] Feed each pair of vectors into the relationship function builder and output the interaction vector , forming an interaction matrix , the dimension is ,in is the interaction vector dimension.

[0050] Interaction Vector Represents a vector pair The semantic relationship between them is used as the input for the subsequent scoring function. The calculation process is expressed as:

[0051] in, is the final interaction feature vector, is the semantic coupling coefficient, is the normalized balance factor, is the hyperbolic tangent function, is the Euclidean norm, is the ReLU function, which represents nonlinear compression.

[0052] The scoring function integration sub-unit 202 calculates the matching score for each group of interaction vectors through the scoring channel. The system needs to judge whether the network device meets the level protection requirements based on multiple semantic dimensions and cannot rely on a single vector similarity. Therefore, the formula nests and integrates three different scoring mechanisms to construct a multi-channel scoring function. The system receives the interaction feature vector output by the interaction relationship construction unit. , and build a multi-scoring path parallel computing structure, for each pair Generate fusion matching score The scoring function consists of three parts: Path 1: Normalize and score the square of the interaction vector modulus to evaluate its semantic interaction strength.

[0053] Path 2: Input the interaction vector into the neural network model MLP to extract its deep nonlinear expression capabilities.

[0054] Path 3: Construct a matching decay score factor based on the Euclidean distance between the requirement vector and the evidence vector.

[0055] The outputs of the three paths are weighted and combined, and then fed into the Sigmoid activation function to obtain the final score:

[0056] in, is the matching score after fusion, is the Sigmoid activation function, is the L2 norm of the interaction vector, is the distance penalty factor, is the scoring channel weighting coefficient, is a one-layer feedforward neural network function.

[0057] Finally, we get a scoring matrix that represents the matching relationship between all requirements and evidence. .

[0058] The scoring aggregation subunit 203 aggregates the scoring results in the scoring matrix by row or column to generate an overall matching scoring vector for each level protection requirement. All corresponding ratings Apply the Softmax function to calculate the attention weights.

[0059] All ratings Perform weighted summation according to their weights to generate a single matching value , expressed as:

[0060] in, is the attention amplification coefficient, which is used to control the weight steepness. For the The total matching score for the requirements.

[0061] The output is a matching score vector , as the scoring input for the next stage.

[0062] The scoring vector normalization subunit 204 performs normalization and range compression on the matching scoring vector generated after aggregation, and outputs a scoring feature vector in a unified format. The system performs normalization and range compression on the matching scoring vector generated after aggregation. Perform normalization processing to meet the light-entry requirements of the subsequent grade evaluation model, expressed as:

[0063] in is the adjustment coefficient, Sets a value for the score center offset.

[0064] The final output For the Standardized score required for each level.

[0065] S3: Feature fusion and grade scoring module 300.

[0066] Further, refer to Figure 4It can be seen that the feature fusion and grade scoring module 300 includes a feature fusion subunit 301 , a grade prediction subunit 302 , and a decision rule coordination subunit 303 .

[0067] It should be noted that the feature fusion and grade scoring module 300 also includes a feature fusion subunit 301 that receives the matching score vector and performs weighted fusion or gate mechanism fusion operations in combination with the risk factor vector required by the graded protection. Perform semantic enhancement, risk-oriented modeling, and feature dimension compression. Perform position encoding or high-order cross-feature generation on the scoring vector to build a scoring context. Introduce the risk weight system preset for each security requirement in the graded protection system to build a risk guidance vector. Fuse the scoring vector and the risk guidance vector according to the weighting strategy to generate an enhanced grade scoring feature vector. .

[0068] The level prediction subunit 302 inputs the fusion features into the classification model and outputs the corresponding protection level label. It supports single-label and multi-label output forms, builds a multi-layer perception network or a lightweight decision tree structure, and performs nonlinear mapping on the fusion score vector. The level label output boundary is set as:

[0069] in, 、 as well as is the preset threshold.

[0070] The decision rule coordination subunit 303 will modify the label when the model output result is inconsistent with the rule system. If the highest level label confidence is less than the set threshold, the system will mark the result as pending review. , and the control point is defined as a mandatory requirement item, the system will force the whole label to be adjusted downward.

[0071] Example 2 is the second embodiment of the present invention, which is different from the previous embodiment in that: If a function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the existing technology, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device, such as a personal computer, server, or network device, to execute all or part of the steps of the various embodiments of the method of the present invention. The aforementioned storage medium includes various media that can store program code, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0072] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device, such as a computer-based system, a system including a processor, or other system that can fetch instructions from and execute instructions on an instruction execution system, apparatus, or device. For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0073] A non-exhaustive list of more specific examples of computer-readable media includes the following: an electronic device with one or more wired electrical connections, a portable computer diskette, a magnetic device, a random access memory RAM, a read-only memory ROM, an erasable and programmable read-only memory EPROM or flash memory, an optical fiber device, and a portable compact disc read-only memory CDROM. In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0074] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having logic gate circuits for implementing logic functions on data signals, an application-specific integrated circuit having suitable combinational logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0075] Example 3, the third embodiment of the present invention, provides a method for a risk-based cybersecurity multi-level protection management system. The method includes: when the system receives a cybersecurity multi-level protection assessment task, the cybersecurity semantic encoding module 100 receives information on the basic requirements for multi-level protection and evidence information on network equipment assessment items. The deep semantic encoding subunit 101, the statistical semantic encoding subunit 102, and the structural semantic encoding subunit 103 perform encoding processing in sequence. The channel fusion and control subunit 104 fuses the channel vectors to generate a unified semantic feature vector set. The cross-matching analysis module 200 receives the semantic feature vectors, the interaction relationship construction subunit 201 generates interaction pairs, the scoring function integration subunit 202 calculates matching scores for the interaction pairs, the scoring aggregation subunit 203 aggregates the scoring results, and the scoring vector normalization subunit 204 generates a unified scoring vector. In the feature fusion and grade scoring module 300, the feature fusion subunit 301 fuses the scoring vector with the grade risk weight, the grade prediction subunit 302 generates a grade label, and the decision rule coordination subunit 303 modifies the result.

[0076] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A risk-based network security level protection management system, characterized by: include: A network security semantic coding module (100) is used to perform multi-channel semantic coding on the basic requirements information of network security level protection and the evidence information of network equipment evaluation items, and output a high-dimensional semantic feature vector in a unified format. The multi-channel semantic coding includes context modeling, statistical feature extraction, and structural semantic modeling. A cross-matching analysis module (200) is configured to receive the semantic feature vector set, construct a semantic interaction matrix between the grade requirements and the evaluation evidence, calculate a matching score using a multi-channel scoring function, aggregate based on the multi-dimensional scoring results, and output a grade matching score vector; The feature fusion and grade scoring module (300) is used to fuse the matching score vector with the preset grade requirement risk weight, generate a fusion feature vector through a fusion strategy, and input it into the grade prediction model to output a network security grade label.

2. The risk-based network security multi-level protection management system according to claim 1, characterized in that: The network security semantic coding module (100) comprises a depth semantic coding subunit (101), a statistical semantic coding subunit (102), a structural semantic coding subunit (103), and a channel fusion subunit (104).

3. The risk-based network security multi-level protection management system according to claim 2, characterized in that: The network security semantic coding module (100) further includes a deep semantic coding subunit (101) for performing context modeling on the text based on a pre-trained language model, and extracting a high-dimensional embedding vector with word order dependency and syntactic structure; The statistical semantic encoding subunit (102) calculates the importance of keywords based on the TF-IDF or word frequency model and generates a sparse vector representation; The structural semantic encoding subunit (103) constructs a syntactic dependency graph, uses a graph neural network to model the structural relationships and logical dependencies in the text, and extracts structural feature vectors; The channel fusion subunit (104) fuses the semantic vectors output by the three encoding subunits and dynamically adjusts the fusion strategy according to the characteristics of the input data to generate a set of semantic representation vectors in a unified format.

4. The risk-based network security multi-level protection management system according to claim 3, characterized in that: The cross-matching analysis module (200) includes an interactive relationship construction subunit (201), a scoring function integration subunit (202), a scoring aggregation subunit (203), and a scoring vector normalization subunit (204).

5. The risk-based network security multi-level protection management system according to claim 4, characterized in that: The cross-matching analysis module (200) further includes an interaction relationship construction subunit (201) for combining the level requirement semantic vectors and the device evidence semantic vectors in pairs to construct interaction pairs and generate an interaction vector matrix; The scoring function integration subunit (202) calculates the matching score for each group of interaction vectors through the scoring channel; The scoring aggregation subunit (203) aggregates the scoring results in the scoring matrix by row or column to generate an overall matching scoring vector for each level protection requirement; The score vector normalization subunit (204) performs normalization and range compression processing on the matching score vector generated after aggregation, and outputs a score feature vector in a unified format.

6. The risk-based network security multi-level protection management system according to claim 5, characterized in that: The feature fusion and grade scoring module (300) includes a feature fusion subunit (301), a grade prediction subunit (302), and a decision rule coordination subunit (303).

7. The risk-based network security multi-level protection management system according to claim 6, characterized in that: The feature fusion and grade scoring module (300) further includes a feature fusion subunit (301) that receives a matching score vector and performs a weighted fusion or a gating mechanism fusion operation in combination with a risk factor vector required by graded protection; The grade prediction subunit (302) inputs the fusion features into the classification model and outputs the corresponding grade protection grade label, supporting single label and multi-label output forms; The decision rule coordination subunit (303) performs label correction when the model output result is inconsistent with the rule system.

8. A method for using the risk-based network security level protection management system according to any one of claims 1 to 7, characterized in that: When the system receives a cybersecurity level protection assessment task, the cybersecurity semantic coding module (100) receives the basic requirements information of the level protection and the evidence information of the network equipment assessment items, and the deep semantic coding subunit (101), the statistical semantic coding subunit (102) and the structural semantic coding subunit (103) perform encoding processing in sequence, and the channel fusion and control subunit (104) fuses the channel vectors to generate a unified format semantic feature vector set; The cross-matching analysis module (200) receives the above-mentioned semantic feature vector, the interaction relationship construction subunit (201) generates interaction pairs, the scoring function integration subunit (202) calculates the matching score for the interaction pairs, the scoring aggregation subunit (203) aggregates the scoring results, and the scoring vector standardization subunit (204) generates a unified scoring vector; in the feature fusion and grade scoring module (300), the feature fusion subunit (301) fuses the scoring vector with the grade risk weight, the grade prediction subunit (302) generates a grade label, and the decision rule coordination subunit (303) corrects the result.

Images