Information processing method and device, electronic equipment and computer readable storage medium

Abstract

The invention discloses an information processing method and device, electronic equipment and a computer readable storage medium. The information processing method comprises the steps that multiple pieces of information are screened, noise information irrelevant to a first type in the multiple pieces of information is filtered, and preliminary screening information is obtained; the first large model is adopted to conduct semantic understanding and first type correlation analysis on the preliminary screening information, an analysis result is obtained, first information of the first type included in the multiple pieces of information is obtained, the analysis result represents whether the preliminary screening information comprises the first information of the first type or not, and the multiple pieces of information comprise the content of multiple languages; the analysis result is represented by a first language of the plurality of languages. According to the method and the device provided by the embodiment of the invention, the concerned first type of information can be quickly and accurately screened and extracted from massive information.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to an information processing method, an information processing apparatus, an electronic device, and a computer-readable storage medium. BACKGROUND

[0002] With the accelerating process of globalization and digitization, network operation and data processing activities are becoming more and more frequent, for example, the maintenance of network security is becoming more and more difficult. Due to the complexity of various types of information, the authenticity and accuracy are difficult to identify, the data volume is large and difficult to trace and trace, so that these phenomena are difficult to be effectively governed, which brings potential threat to network security. SUMMARY

[0003] This summary is provided to introduce a selection of concepts, which will be described in more detail in the detailed description section. Such summary is not intended to identify key or essential features of the claimed technology, nor is it intended to limit the scope of the claimed technology.

[0004] At least one embodiment of the present disclosure provides an information processing method, comprising: screening a plurality of information, filtering noise information irrelevant to a first type in the plurality of information to obtain preliminary screening information; using a first large model to perform semantic understanding and association analysis with the first type on the preliminary screening information to obtain an analysis result, and obtaining first information of the first type included in the plurality of information, wherein the analysis result represents whether the preliminary screening information includes the first information of the first type, wherein the plurality of information includes content in multiple languages, and the analysis result is represented by a first language among the multiple languages.

[0005] At least another embodiment of the present disclosure provides an information processing apparatus, comprising: an information screening module configured to screen a plurality of information, filter noise information irrelevant to a first type in the plurality of information to obtain preliminary screening information; and a processing module configured to use a first large model to perform semantic understanding and association analysis with the first type on the preliminary screening information to obtain an analysis result, and obtain first information of the first type included in the plurality of information, wherein the analysis result represents whether the preliminary screening information includes the first information of the first type, wherein the plurality of information includes content in multiple languages, and the analysis result is represented by a first language among the multiple languages.

[0006] At least another embodiment of the present disclosure provides an electronic device, comprising: a processing apparatus; and a storage apparatus comprising one or more computer program instructions; wherein the one or more computer program instructions are executed by the processing apparatus to perform the information processing method provided by at least one embodiment of the present disclosure.

[0007] At least one other embodiment of the present disclosure provides a computer readable storage medium, which non-transiently stores computer readable instructions, wherein the computer readable instructions, when executed by a processor, implement the information processing method provided by at least one embodiment of the present disclosure.

[0008] At least one other embodiment of the present disclosure provides a computer program product, which includes computer programs / instructions, when the computer programs / instructions are run on a computer, cause the computer to execute the information processing method provided by at least one embodiment of the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0009] The above and other features, advantages, and aspects of the embodiments of the present disclosure will become more apparent upon reading the following detailed description in conjunction with the accompanying drawings, in which like reference numerals refer to like elements. It is to be understood that the drawings are designed solely for the purpose of illustration and not as a definition of the limits of the present disclosure, for which reference should be made only to the appended claims. Throughout the drawings, similar reference numbers indicate similar elements.

[0010] Figure 1 An application scenario schematic diagram of the information processing method and device provided by at least one embodiment of the present disclosure is schematically shown;

[0011] Figure 2 A flowchart of the information processing method provided by at least one embodiment of the present disclosure is schematically shown;

[0012] Figure 3 A principle schematic diagram of the information processing method of at least one embodiment of the present disclosure is schematically shown;

[0013] Figure 4 A principle schematic diagram of determining the new information source of at least one embodiment of the present disclosure is schematically shown;

[0014] Figure 5 A principle schematic diagram of optimizing the interaction guide information of at least one embodiment of the present disclosure is schematically shown;

[0015] Figure 6 An implementation principle diagram of the information processing system of at least one embodiment of the present disclosure is schematically shown;

[0016] Figure 7 A structure block diagram of the information processing device provided by at least one embodiment of the present disclosure is schematically shown; and

[0017] Figure 8 A structure schematic diagram of an electronic device suitable for implementing the embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0018] Embodiments of the present disclosure will be described in more detail below with reference to the drawings. Although some embodiments of the present disclosure are shown in the drawings, it is understood that the present disclosure can be implemented in various forms and should not be interpreted as being limited to the embodiments set forth herein, but rather these embodiments are provided so as to more completely and thoroughly understand the present disclosure. It is understood that the drawings and embodiments of the present disclosure are for exemplary purposes only and are not intended to limit the scope of protection of the present disclosure.

[0019] It should be understood that each step described in the method embodiments of the present disclosure can be performed in different orders and / or in parallel. In addition, the method embodiments can include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0020] The term "comprising" and variations thereof as used herein are open-ended, that is "including but not limited to". The term "based on" is "based, at least in part, on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Related terms are defined in the description that follows.

[0021] It should be noted that the concepts of "first", "second", etc. mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not intended to limit the order or interdependence of the functions performed by these devices, modules or units.

[0022] It should be noted that the modification of "one" or "multiple" mentioned in the present disclosure is illustrative and not limiting, and those skilled in the art should understand that unless otherwise explicitly stated in the context, it should be understood as "one or more".

[0023] The names of the messages or information exchanged between the devices in the embodiments of the present disclosure are only for illustrative purposes and are not intended to limit the scope of the messages or information.

[0024] It can be understood that the data involved in the technical solutions of the present disclosure (including but not limited to the data itself, obtaining, using, storing or deleting of the data) should comply with the requirements of relevant laws and regulations and relevant provisions.

[0025] It can be understood that before using the technical solutions disclosed in the embodiments of the present disclosure, the type of information involved in the present disclosure, the scope of use, the use scenario, etc. should be informed to the relevant user and the authorization of the relevant user should be obtained by appropriate means, wherein the relevant user can include any type of right subject, such as an individual, an enterprise or a group.

[0026] For example, in response to receiving an active request of a user, prompt information is sent to the relevant user to explicitly prompt the relevant user that the operation requested to be performed will require obtaining and using information of the relevant user, so that the relevant user can autonomously select whether to provide information to the software or hardware, such as an electronic device, an application program, a server or a storage medium, performing the operation of the technical solution of the present disclosure according to the prompt information.

[0027] As an optional but non-limiting implementation manner, in response to receiving an active request of a relevant user, the manner of sending prompt information to the relevant user may, for example, be a pop-up window manner, in which the prompt information may be presented in the form of text. In addition, the pop-up window may also carry selection controls for the user to select "agree" or "disagree" to provide information to the electronic device.

[0028] It can be understood that the above notification and user authorization obtaining process is only illustrative and does not limit the implementation manner of the present disclosure, and other manners meeting relevant laws and regulations can also be applied to the implementation manner of the present disclosure.

[0029] With the continuous acceleration of globalization and digitization, the challenges faced by network security are increasingly complex and international. For example, the phenomenon of using network communication and transaction is becoming more and more common. The network carries a large amount of multilingual and unstructured information, which contains data related to data leakage, business vulnerabilities and other data of great value to network security protection. For example, the information can be multi-modal information, such as one or more of text type information, voice type information, image type information, and video type information.

[0030] However, there are problems such as great difficulty in discovering the information of great value from the information, low processing efficiency, and high requirements for business capabilities. For example, due to the complex and noisy information on the network, if a fixed rule-based screening method is used to mine high-value data, a large number of false positives are likely to occur, and the screening method cannot accurately understand the context, making it difficult to deal with ambiguous expressions of non-compliant information. For example, the information on the network involves multiple languages, especially small languages. If there is a lack of analysts with corresponding language skills, it is difficult to effectively interpret and analyze the information, resulting in the loss of a part of high-value data. For example, it takes a lot of time and effort for analysts to have deep domain knowledge and rich experience to extract truly valuable information from a large amount of information that can provide guidance for adjusting security protection measures, and the process is highly dependent on the individual ability of the analyst.

[0031] To at least partially solve the above at least one technical problem, at least one embodiment of the present disclosure provides an information processing method, comprising: screening a plurality of pieces of information, filtering noise information irrelevant to a first type in the plurality of pieces of information to obtain preliminary screened information; and performing semantic understanding and association analysis on the preliminary screened information by using a first large model to obtain an analysis result, to obtain first information of the first type included in the plurality of pieces of information, wherein the analysis result represents whether the preliminary screened information includes the first information of the first type, and wherein the plurality of pieces of information include content in multiple languages, and the analysis result is represented by a first language in the multiple languages.

[0032] Based on the information processing method provided by at least one embodiment of the present disclosure, at least one embodiment of the present disclosure further provides an information processing apparatus, an electronic device, and a computer-readable storage medium.

[0033] The information processing method provided by at least one embodiment of the present disclosure can quickly filter out a large amount of noise information by first screening a plurality of pieces of information, thereby reducing the cost and pressure of large model processing. By performing semantic understanding and association analysis on the preliminary screened information by using a large model after obtaining the preliminary screened information, complex semantics of the information can be understood, and the accuracy of the obtained first information of the first type can be improved. The information processing method can achieve a balance between analysis efficiency and analysis depth of the analyzed information by combining the way of filtering noise information and the way of performing semantic understanding and association analysis by using a large model to identify and extract information of the first type. For example, based on the information processing method, data of high value for network security protection can be quickly and accurately extracted from a large amount of interactive information.

[0034] The embodiments of the present disclosure and some examples thereof will be described in detail below with reference to the accompanying drawings.

[0035] Figure 1 An application scenario schematic diagram of the information processing method and apparatus provided by at least one embodiment of the present disclosure is schematically shown.

[0036] As Figure 1 shown, the application scenario 100 of this embodiment involves first terminal devices 111, 112, and 113 and a server 120. The server 120 may, for example, be a server for protecting network security, or a background management server supporting the running of a client application, etc. For example, the server 120 may, for example, be a server for a local area network or a wide area network, or a cloud server, etc., and the embodiments of the present disclosure do not limit this. For example, the first terminal devices 111, 112, and 113 may, for example, be electronic devices such as smartphones, tablet computers, laptop computers, desktop computers, etc., or any device that can install a client application and browse a webpage, such as a smart wearable device, a smart appliance, a smart car, etc., and the embodiments of the present disclosure do not limit this.

[0037] For example, the server 120 can obtain information sent from the clients on the first terminal devices 111, 112, 113, and process an information set including the information. The information can be obtained in any compliant manner as needed for implementation, which is not limited in the embodiments of the present disclosure. After obtaining the information, the server 120 can screen and extract the information, for example, to obtain the first type of information.

[0038] For example, the server 120 can support running of a large model, and the server 120 can rely on the large model to implement semantic understanding and correlation analysis of the information to extract the first type of information. For example, the server 120 can also locally deploy a server supporting running of the large model, and the running server can rely on the running large model to perform semantic understanding and correlation analysis of the information.

[0039] In some embodiments, the application scenario 100 can involve other terminal devices to screen and extract the obtained information. For example, the other terminal devices can locally deploy a server supporting running of the large model, and the running server can rely on the running large model to perform semantic understanding and correlation analysis of the information to extract the first type of information.

[0040] In at least one embodiment, the application scenario 100 can also involve the second terminal device 130. For example, the server 120 can push the obtained first type of information to the client running on the second terminal device 130, so that an analyst can view the first type of information, and analyze the risk conveyed by the information and the level of the risk based on the first type of information.

[0041] In at least one embodiment, the server 120 can also convert the information into structured information, and push the first type of information in the structured information obtained based on the conversion of the information to the client running on the second terminal device 130, so as to improve the efficiency of analyzing the first type of information.

[0042] For example, the information processing method provided by at least one embodiment of the present disclosure can be implemented in the form of software, hardware, firmware, or any combination thereof.

[0043] For example, the information processing method provided by at least one of the embodiments of the present disclosure is applicable to a server or other terminal device, which can load and execute the information processing method, and the embodiments of the present disclosure do not limit this. For example, the server or other terminal device can include a central processing unit (CPU) or a graphics processing unit (GPU), a digital signal processor (DSP), a neural network processing unit (NPU), and other forms of processing units having data processing capability and / or instruction execution capability, a storage unit, and the like, and the server or other terminal device also has an operating system, various types of application programming interfaces (APIs) (for example, OpenGL (Open Graphics Library), Metal, and the like), and the like installed thereon, and the information processing method provided by the embodiments of the present disclosure is implemented by running codes or instructions.

[0044] The information processing method provided by at least one of the embodiments of the present disclosure will be described below in conjunction with Figures 2-5 The information processing method provided by at least one of the embodiments of the present disclosure will be described below in conjunction with

[0045] Figure 2 The flowchart of the information processing method provided by at least one of the embodiments of the present disclosure is schematically shown.

[0046] As Figure 2 shown, the information processing method 200 of this embodiment includes steps S210-S220. For example, the execution subject of the information processing method can be a terminal device deployed with a server, or a server deployed with a server, and the embodiments of the present disclosure do not limit this.

[0047] In step S210, a plurality of pieces of information are screened, noise information irrelevant to the first type in the plurality of pieces of information is filtered, and preliminary screening information is obtained.

[0048] In step S220, the preliminary screening information is subjected to semantic understanding and association analysis with the first type by using a first large model, an analysis result is obtained, and first information of the first type included in the plurality of pieces of information is obtained.

[0049] According to at least one of the embodiments of the present disclosure, the plurality of pieces of information can include various information on a network, and the information is all acquired by authorization or permission. It can be understood that the type of the plurality of pieces of information can be one or more of a text type, an image type, a video type, an audio type, and the like, and the type of the information is only an example for understanding the present disclosure, and the embodiments of the present disclosure do not limit this.

[0050] For example, the quantity (e.g., the first quantity) of the plurality of pieces of information can be massive, such as a big data level, for example, including but not limited to thousands of pieces of information, or even millions of pieces of information.

[0051] In at least one embodiment of the present disclosure, the plurality of pieces of information can be filtered based on a predetermined rule, which can include filtering out information with garbled codes, filtering out information with non-compliant images, filtering out information with specific characters, and the like. The predetermined rule can be determined according to the first type, for example. The setting of the predetermined rule aims to filter out a large amount of noise information irrelevant to the first type from the massive information, and the preliminary filtered information obtained is information with the possibility of extracting the first information of the first type, which can also be referred to as potential information. The present disclosure does not limit the specific content of the predetermined rule.

[0052] In at least one embodiment of the present disclosure, the obtained preliminary filtered information can include one or more (e.g., a second quantity) pieces of information. This embodiment can use a first large model to perform semantic understanding and correlation analysis on the preliminary filtered information, to obtain an analysis result corresponding to the preliminary filtered information, or an analysis result uniquely corresponding to each piece of information in the preliminary filtered information. For example, the analysis result can represent whether the preliminary filtered information includes the first information of the first type. In the present disclosure, the first type can be any type of information of interest without being limited to a specific type. According to actual needs, the first type can be at least one of a type with a security risk, a type with a business risk, and the like. The present disclosure does not limit this.

[0053] For example, the first large model can be any type of large model, such as any one of a large language model, a visual large model, an audio large model, a multi-modal large model, or a combination of multiple thereof. As long as the functions and effects defined in the embodiments of the present disclosure can be achieved, the embodiments of the present disclosure do not limit this, such as an open source model or a closed source model. For example, the first large model can be pre-trained using artificially annotated sample data. The input of the first large model is the preliminary filtered information obtained by filtering, and the output is an analysis result representing whether the preliminary filtered information includes the first information of the first type. For example, the annotation data of the sample data is an analysis result obtained by artificially analyzing the information. Through training, the first large model can learn the correlation between the information and the first type, for example, to perform correlation analysis based on the law. For example, the sample data can include the first information of the first type, or information other than the first type. The proportion between the two parts of information can be set according to actual needs, and the embodiments of the present disclosure do not limit this.

[0054] In at least one embodiment of the present disclosure, each piece of information in the preliminary screening information can be taken as an input of the large model agent constructed based on the first large model, and the first large model is used to perform semantic understanding and correlation analysis on each piece of information, so as to obtain an analysis result corresponding to each piece of information. Alternatively, the embodiment can also take each piece of information and its context information as an input of the large model agent to perform semantic understanding and correlation analysis. Alternatively, the embodiment can also take the preliminary screening information as a whole as an input of the large model agent.

[0055] In at least one other embodiment of the present disclosure, the preliminary screening information can be subjected to semantic understanding and correlation analysis based on interaction guidance information (such as a prompt word) to obtain an analysis result. The interaction guidance information is used to indicate the semantic understanding task and the correlation analysis task to be performed by the first large model, and can include multiple parts to deliver various environmental information and execution instructions, etc. For example, the interaction guidance information can at least include a first guidance instruction indicating a workflow of semantic understanding and correlation analysis. For example, the interaction guidance information and each piece of information in the preliminary screening information can be spliced and input into the first large model, and the first large model can perform semantic understanding and correlation analysis on each piece of information in the preliminary screening information based on the interaction guidance information to obtain an analysis result. Alternatively, the interaction guidance information and all information in the preliminary screening information can be spliced and input into the first large model, and the first large model can perform semantic understanding and correlation analysis on the preliminary screening information as a whole based on the interaction guidance information to obtain an analysis result. Alternatively, the interaction guidance information, each piece of information in the preliminary screening information, and the context information of each piece of information can be spliced and input into the first large model, and the first large model can perform semantic understanding and correlation analysis on each piece of information and its context information based on the interaction guidance information to obtain an analysis result.

[0056] For example, after obtaining the analysis result, information belonging to the first type can be screened from the preliminary screening information, and the information belonging to the first type is taken as the first information of the first type. For example, according to actual needs, after obtaining the first information of the first type, the first information of the first type can be intercepted, etc. to avoid widespread dissemination of non-compliant data and improve network security.

[0057] For example, the analysis result can represent whether the preliminary screening information includes the first information of the first type. If it does, the first information is extracted. For example, in the case where the preliminary screening information includes the first information, the analysis result includes the first information; in the case where the preliminary screening information does not include the first information, the analysis result can be predetermined information representing that the first information is not included.

[0058] In an embodiment, the analysis result can be structured information. For example, the analysis result can include first information represented in a structured form, and the embodiment can further distribute the first information represented in the structured form, so that a recipient of the first information determines a risk conveyed by the first information based on the first information, for example, can also be understood as determining a risk conveyed by the preliminary screening information corresponding to the first information based on the first information. For example, the first information can be distributed to a terminal used by an analyst, so that the analyst determines the risk based on the first information. Compared with the preliminary screening information, the first information represented in the structured form is information that can be directly used and consumed, which facilitates improving the efficiency of the analyst determining the risk.

[0059] The information data processing method of at least one embodiment of the present disclosure can realize the identification and extraction of the first information of the first type by combining the way of filtering noise information and the way of semantic understanding and correlation analysis by means of a large model, and can realize the balance between the analysis efficiency and the analysis depth of the analysis information. For example, based on the information processing method, high-value data for network security protection can be quickly and accurately extracted from a large amount of information.

[0060] Figure 3 The principle schematic diagram of the information data processing method of at least one embodiment of the present disclosure is schematically shown.

[0061] In at least one embodiment of the present disclosure, the information to be processed can be screened based on the keyword library for the first type. For example, the foregoing step S210 can be implemented as: screening information matching the keywords in the keyword library from the plurality of information based on the keyword library for the first type to obtain the preliminary screening information.

[0062] According to at least one embodiment of the present disclosure, the keywords in the keyword library for the first type can be obtained by searching and counting from a search engine, or can be obtained by frequency analysis on information related to the first type that has been screened by humans. For example, in order to construct the keyword library, words with a frequency higher than a predetermined frequency obtained by analysis can be used as keywords in the keyword library, and other words associated with or appearing simultaneously with the words with a frequency higher than the predetermined frequency can also be used as keywords in the keyword library; or, keywords in the content provided by a professional platform can also be collected according to business needs as keywords in the keyword library; for example, in addition to a certain keyword itself, synonyms of the keyword in different contexts or different languages can also be added as keywords. According to actual needs, the keyword library for the first type can be periodically maintained or maintained in real time, so as to periodically or in real time add new keywords obtained by analysis or collection to the keyword library, so as to continuously improve the quality of the preliminary screening information screened, and reduce the situation of false positives and false negatives.

[0063] For example, the first type could include business security types or risk security types. Keywords in the keyword database could include general security terms, terms related to the target business, and regional coded language.

[0064] For example, for each piece of information among multiple pieces of information, this embodiment can match each piece of information with each keyword in a keyword lexicon for the first type. If each piece of information includes a keyword from the keyword lexicon, then that piece of information is included as one of the initial screening pieces of information. Alternatively, each piece of information and each keyword in the keyword lexicon can be converted into a semantic vector, and the similarity between the semantic vector of each piece of information and the semantic vector of each keyword in the keyword lexicon can be calculated as the matching degree between each piece of information and each keyword. If there is a keyword in the keyword lexicon whose matching degree with each piece of information is higher than the matching degree threshold, then it is determined that each piece of information matches a keyword in the keyword lexicon, and that piece of information is included as one of the initial screening pieces of information.

[0065] In at least one embodiment, such as Figure 3 As shown, after obtaining multiple pieces of information 310, the information 310 can be filtered based on the keyword thesaurus 320, that is, information that matches the keywords in the keyword thesaurus 320 can be filtered out to obtain preliminary information 311. Subsequently, the preliminary information 311 can be concatenated with the interactive guidance information 330, for example, as input to the first main model 340. The first main model 340 performs semantic understanding and association analysis on the preliminary information 311 based on the interactive guidance information 330, and outputs the analysis result 350 corresponding to the preliminary information 311. Finally, the first information 360 of the first type included in the multiple pieces of information 310 can be obtained based on the analysis result 350. For example, if the analysis result 350 indicates that the preliminary information 311 includes the first information, the analysis result can be used as the first information 360 and distributed to the security team or business team through the application programming interface (API) or information push.

[0066] For example, after obtaining the first information 360, the first information can be stored in a predetermined storage space for later use.

[0067] In at least one embodiment of this disclosure, the interactive guidance information 330 may include first guidance instructions representing a workflow for semantic understanding and correlation analysis, such as the following information: "1. Carefully read and understand the provided information, and understand the semantics of the information, and clarify the key elements involved and their correlations; 2. Analyze the attributes of the information and distinguish whether it belongs to security risk information or business risk information."

[0068] For example, the analysis result can further represent the basis for determining whether the preliminary screening information includes the first type of information, and the first guidance instruction can further include the following information: “3. Detailed description of the judgment basis to ensure that the analysis logic is clear, professional and has basis”.

[0069] For example, the analysis result can further represent a sub-type of the first type that matches the preliminary screening information, and the first guidance instruction can further include the following information: “4. If the information belongs to security risk information, determine which of the following types it belongs to: account security risk, …; if the information belongs to business risk information, determine which of the following types it belongs to: non-compliant resource supply, …”.

[0070] For example, the analysis result can further represent a scenario that matches the preliminary screening information, and the first guidance instruction can further include the following information: “5. Determine whether the information is related to the target scenario, and perform scenario positioning in combination with the business background”.

[0071] For example, the analysis result can further represent a risk control suggestion for the preliminary screening information, and the first guidance instruction can further include the following information: “6. Based on the above analysis, determine the subsequent value mining direction or risk control suggestion”.

[0072] It can be understood that the information included in the first guidance instruction is only an example for understanding the present disclosure, and according to actual needs, the first guidance instruction can include one or more of the above information, or can include other information, for example, the first guidance instruction can be used to guide the large model to perform deep semantic understanding, context association analysis and intent judgment, and embodiments of the present disclosure are not limited thereto.

[0073] In at least one embodiment of the present disclosure, in addition to the first guidance instruction, the interaction guidance information can further include a second guidance instruction representing an output format of the analysis result, to standardize the representation of the analysis result and facilitate direct use and consumption. For example, the second guidance instruction can include the following information, and it can be understood that the following information is only an example for understanding the present disclosure, and embodiments of the present disclosure are not limited thereto:

[0074] “## Output format

[0075] {

[0076] “Is it a security risk type”: “Yes / No”,

[0077] “Judgment basis”: “… ”,

[0078] “Sub-type of security risk”: “… ”,

[0079] “Security scenario”: “…”

[0080] "Is it a business risk type?" "Yes / No",

[0081] "Judgment basis": "…",

[0082] "Subtype of business risk": "…",

[0083] "Business scenario": "…",

[0084] "Comprehensive further value mining": "…"

[0085] }

[0086] Please ensure that each field is described specifically, and the language is standard and professional.

[0087] For example, for the security risk type, based on the second guidance instruction, the analysis result of the output of the first large model can include the judgment basis, the specific security risk subtype (such as social engineering fraud, attack warning, etc.), the applicable security scenario (such as data privacy protection, online fraud prevention, etc.), and the risk level. For the business risk type, based on the second guidance instruction, the analysis result of the output of the first large model can include the judgment basis, the specific business risk subtype (such as marketing strategy, industry promotion activity, etc.), the applicable business scenario (such as digital payment, user expansion, etc.), and the suggestion to help the business part to understand the market dynamics and potential risks. It can be understood that the information included in the above analysis result of the output of the first large model is only as an example to facilitate the understanding of the present disclosure, and the embodiments of the present disclosure are not limited thereto.

[0088] In at least one embodiment of the present disclosure, the interaction guidance information can also include a third guidance instruction representing the role played by the first large model, to constrain the professionalism of the first large model in semantic understanding and correlation analysis based on the role, and improve the accuracy of the obtained analysis result. For example, the third guidance instruction can include the following information, and it can be understood that the following information is only as an example to facilitate the understanding of the present disclosure, and the embodiments of the present disclosure are not limited thereto:

[0089] "## Role

[0090] You are a professional security risk analyst, please analyze the following text and output your analysis result."

[0091] In at least one embodiment of the present disclosure, the interaction guidance information can further include fourth guidance instructions representing the target of semantic understanding and correlation analysis, to provide guidance direction for semantic understanding and correlation analysis by the first large model, and improve the accuracy of the obtained analysis results. For example, the fourth guidance instructions can include the following information, and it can be understood that the following information is only an example to facilitate understanding of the present disclosure, and embodiments of the present disclosure are not limited thereto:

[0092] "##Target

[0093] Deeply analyze the information provided by the user, accurately identify whether it involves … business scenarios.

[0094] Output structured and professional analysis reports, clearly distinguish between security risks and business risks, and prompt potential value."

[0095] In at least one embodiment of the present disclosure, the interaction guidance information can further include fifth guidance instructions representing the skills possessed by the first large model, to constrain the accuracy of semantic understanding and correlation analysis by the first large model, and improve the accuracy of the obtained analysis results. For example, the fifth guidance instructions can include the following information, and it can be understood that the following information is only an example to facilitate understanding of the present disclosure, and embodiments of the present disclosure are not limited thereto:

[0096] "##Skills

[0097] Master risk analysis methods and techniques, and be able to identify and judge security risks and business value in complex information.

[0098] Familiar with the business scenarios and industry background of … enterprise services, understand risk characteristics and attack mechanisms."

[0099] In at least one embodiment of the present disclosure, the interaction guidance information can further include sixth guidance instructions representing the constraint conditions of semantic understanding and correlation analysis, to constrain the direction of semantic understanding and correlation analysis by the first large model, and improve the accuracy of the obtained analysis results. For example, the sixth guidance instructions can include the following information, and it can be understood that the following information is only an example to facilitate understanding of the present disclosure, and embodiments of the present disclosure are not limited thereto:

[0100] "##Constraints

[0101] Strict analysis must be based on the information provided by the user, and information cannot be added or deleted arbitrarily.

[0102] Original information cannot be deleted or modified, and only structured analysis reports can be output.

[0103] The report language needs to be professional and accurate, avoiding ambiguous and repetitive expressions."

[0104] In at least one embodiment of the present disclosure, the interaction guidance information can further include a seventh guidance instruction representing an example of semantic understanding and correlation analysis to more accurately guide the first large model to output a required analysis result. For example, the sixth guidance instruction can include the following information, and it can be understood that the following information is only an example to facilitate understanding of the present disclosure, and embodiments of the present disclosure are not limited thereto:

[0105] “## Example

[0106] Example 1:

[0107] Input: XXXXX

[0108] Output: YYYYY

[0109] Example 2:

[0110] …”.

[0111] It can be understood that according to actual needs, in addition to the first guidance instruction, the interaction guidance information can further include one or any combination of the plurality of guidance instructions described above.

[0112] In at least one embodiment of the present disclosure, the plurality of information to be processed can include content in multiple languages, for example, and the analysis result can be represented by a first language among the multiple languages. For example, the multiple languages can include a general language and a small language, and the first language representing the analysis result can be a general language among the multiple languages, thereby facilitating reduction of difficulty and cost of reading the analysis result.

[0113] Exemplarily, after obtaining the screening information, the screening information can be first translated into information represented in the first language by using a translation model. Then, semantic understanding and correlation analysis can be performed on the information represented in the first language by using the first large model, so as to obtain the analysis result represented in the first language. For example, the screening information can be sent to an agent constructed based on the first large model, and the agent can call a translation model matched with the language of the screening information to translate the screening information into third information represented in the first language. Then, the agent can call the first large model to perform semantic understanding and correlation analysis on the third information, so as to obtain the analysis result. For example, the translation model can include a plurality of models respectively used to implement translation tasks between the first language and each of a plurality of other languages except the first language, and each model corresponds to one of the other languages. For example, the plurality of models included in the translation model can be existing models, or can be a plurality of models obtained by pre-training a same base model by using a corpus of the plurality of other languages, and the base model can be a large model or any deep learning model such as a recurrent neural network model, which is not limited in the embodiments of the present disclosure. For example, a multi-language translation model can also be used to translate the screening information into information represented in the first language. For example, by first translating the screening information by using the translation model and then performing semantic understanding and correlation analysis by using the large model, the accuracy of the translation of the screening information can be improved, and the requirement for the processing capability of the large model can be reduced.

[0114] Exemplarily, the identification of information in multiple languages can be implemented by relying on the first large model. For example, after obtaining the screening information, the screening information and the interaction guidance information can be directly input into the first large model, and the language type of the analysis result output by the first large model can be constrained, so that the first large model directly outputs the analysis result represented in the first language, thereby reducing the requirement for the language ability of the analyst. By relying on the first large model to implement the identification of information in multiple languages, the original multi-language capability of the large model can be fully utilized, without the need for machine translation in advance, the subtle semantics of the information can be effectively preserved, the accuracy of the semantic understanding and correlation analysis can be improved, and the accuracy of the obtained analysis result can be improved. For example, the first large model can be a large model specially trained and optimized to have strong multi-language identification capability.

[0115] The information processing method provided by at least one embodiment of the present disclosure can fully utilize the original multi-language capability and strong logical reasoning capability of the large model, can implement “end-to-end” automatic analysis and judgment of multi-language information, can not only overcome the language barrier, but also directly convert unstructured information into structured and directly consumable first information, so as to serve as intelligence data and give detailed judgment basis and application scenarios. The first information can directly empower business decision-making, which has a major breakthrough compared with a process of mining valuable intelligence based on predetermined rules or a process of manually mining valuable intelligence.

[0116] Figure 4 A schematic diagram illustrating a principle of determining a new source of information according to at least one embodiment of the present disclosure is shown.

[0117] In at least one embodiment of the present disclosure, the information processing method can further automatically expand the source of information based on the information to be processed, so as to increase the coverage of information processing, realize fission expansion of the source of information, and continuously improve network security.

[0118] According to embodiments of the present disclosure, in a case where the second information related to the source of information is included in the plurality of information, the new source of information can be determined based on the second information, and the new source of information can be provided for collecting new information for processing.

[0119] For example, for each piece of information in the plurality of information, a regular expression can be used to check whether a string in a specific format is included in the each piece of information, or a semantic pattern matching technology can be used to determine whether content in a preset "semantic pattern" can be identified and extracted from the each piece of information. The specific format and the preset "semantic pattern" can be set according to actual needs, for example, the specific format can be a link format containing "t.me / " or the like, and embodiments of the present disclosure are not limited thereto. If the each piece of information includes a string in a specific format or content in a preset "semantic pattern" can be extracted, it can be determined that the each piece of information is second information related to the source of information.

[0120] For example, the page that can be entered based on the second information can be taken as a new source of information, so that when new information is collected subsequently, information in the page entered based on the second information can be taken as a collection target, and the newly collected information can be screened and processed.

[0121] For example, when the new source of information is determined based on the second information, it can be determined whether the second information is related to the first type. If the second information is related to the first type, the source of information related to the second information is taken as the new source of information. In this way, the possibility that the information collected from the determined new source of information is related to the first type can be improved, so as to ensure that the investment of collection resources is more accurate, and thus the overall quality of the collected information can be improved from the source.

[0122] For example, it can be determined whether the second piece of information is related to each subtype included in the first type, thereby improving the precision and accuracy of relevance determination. For example, relevance determination can also be based on the second piece of information and its contextual information, combining contextual semantics to improve the accuracy of the determination. For example, when multiple pieces of information include multiple pieces of second information, sources related to second information with high relevance to the first type can be prioritized as new sources; sources related to second information with low relevance are either given lower priority as new sources or ignored.

[0123] In one embodiment, a large model can be used to analyze the correlation between the second information and the first type. This determines whether the second information and the first type are related. Using a large model enables rapid assessment of correlation, which facilitates the implementation of a "collect-as-you-go" model, thereby improving the efficiency of information source expansion and enhancing the effectiveness and timeliness of network security protection.

[0124] For example, such as Figure 4 As shown, after identifying the second information 411 involving the information source from the multiple pieces of information 410 to be processed, the second information 411 can be input into the second large model 430. The second large model 430 analyzes the correlation between the second information 411 and the first type to obtain the correlation degree 440. Subsequently, new information sources 450 can be selected from the information sources 420 involved in the second information 411 based on the correlation degree. For example, the second large model is a different model from the first large model. The difference means that the two have at least different network parameters. According to actual needs, the first large model and the second large model can be trained based on the same base model. However, during training, the sample data and training objectives of the first large model and the second large model are different. Alternatively, the first large model and the second large model can also be trained based on different base models. The embodiments of this disclosure do not limit this. Alternatively, in at least one embodiment, the first large model and the second large model can be different functional parts of the same unified model. That is, the unified model has the functions of both the first large model and the second large model, thus serving as the first large model or the second large model in different scenarios.

[0125] Figure 5 The illustration shows a schematic diagram of the principle of optimized interactive guidance information according to at least one embodiment of the present disclosure.

[0126] In at least one embodiment of this disclosure, after obtaining the first information, the analyst or operator may, for example, assess the accuracy and value of the first information when processing it, and correct the first information based on the assessment results to obtain corrected information. The corrected information may, for example, serve as a reference for the first major model to perform semantic understanding and association analysis on subsequent preliminary screening information.

[0127] For example, the information processing method of this disclosure embodiment can further, after obtaining the corrected information obtained by correcting the first information, use the corrected information as the labeled data of the initial screening information to obtain sample data. Subsequently, the sample data is added to a predetermined sample library for the user to subsequently train or fine-tune the first large model, so that the first large model is trained or fine-tuned based on the sample data, making the results of semantic understanding and association analysis of the first large model more consistent with the results of manual analysis.

[0128] For example, the information processing method of this disclosure embodiment can also optimize the interactive guidance information of the first large model based on the difference between the corrected information and the first information after obtaining the corrected information, so as to guide the first large model to perform semantic understanding and association analysis on the initial screening information, so that the analysis results output by the first large model tend to be consistent with the results of manual analysis, thereby improving the accuracy of the first large model in processing information.

[0129] For example, this embodiment can directly add information representing the difference between the corrected information and the first information to the interactive guidance information, thereby optimizing the interactive guidance information.

[0130] For example, a large model can be used to analyze the differences between the corrected information and the initial information to obtain optimized information for the interactive guidance information. This optimized information is then used to further optimize the interactive guidance information. In this way, a large model can be used to analyze the corrected information and fine-tune the initial large model, enabling autonomous learning of knowledge and further reducing manual costs. For example, the information processing method of at least one embodiment of this disclosure can be implemented by a large model intelligent agent built based on a large model. This enables end-to-end information processing, autonomous learning of knowledge by the large model, and continuous optimization of the large model.

[0131] For example, such as Figure 5 As shown, in one embodiment, after the first large model 510 performs semantic understanding and association analysis on the initial screening information 511 based on the interactive guidance information 512 and obtains the first information 520, in response to obtaining the corrected information 530 obtained by correcting the first information 520, the initial screening information, the corrected information, and the first information are input into the third large model 540. The third large model 540 outputs the difference information between the analyzed corrected information and the first information, as well as the optimized information 550 generated based on the difference information for the interactive guidance information. In this embodiment, the optimized information 550 can be directly added to the interactive guidance information to achieve optimization of the interactive guidance information.

[0132] For example, in an embodiment, the interactive guidance information 512, the preliminary screening information, the first information and the corrected information can also be input into the third large model in the form of an information group, the third large model outputs difference information between the analyzed corrected information and the first information, and the optimization information obtained by optimizing the interactive guidance information 512 based on the difference information, and the embodiment can use the optimization information as the optimized interactive guidance information for subsequent processing.

[0133] For example, the information input into the third large model 540 can also include interactive guidance information corresponding to the third large model (hereinafter also referred to as second guidance information, in order to distinguish from the interactive guidance information input into the first large model), which is used to constrain the task performed by the third large model 540, and the information output by the third large model 540.

[0134] In at least one embodiment of the present disclosure, the first large model 510 and the third large model 540 can be two different models obtained by training the same base model using different sample data, so that the first large model 510 and the third large model 540 have basically the same multilingual recognition capability, thereby ensuring the accuracy of the difference information and the optimization information output by the third large model.

[0135] Based on the information processing method provided by at least one embodiment of the present disclosure, at least one embodiment of the present disclosure also provides an information processing system to facilitate the implementation of the information processing method.

[0136] Figure 6 The implementation schematic diagram of the information processing system of at least one embodiment of the present disclosure is schematically shown.

[0137] As Figure 6 shown, the information processing system capable of implementing the information processing method of at least one embodiment of the present disclosure can include a collection module 610, an analysis module 620 and a discrimination module 630.

[0138] For example, the collection module 610 is used for source extension and information collection. The analysis module 620 is embedded with a keyword screening engine for preliminary screening of the information collected by the collection module 610.

[0139] For example, the analysis module 620 can first store the information collected by the collection module 610, and analyze the stored information in the preliminary screening process to realize offline execution of the preliminary screening step. For example, the analysis module 620 can also be embedded with a calling interface of a large model to call the large model to perform semantic understanding and correlation analysis on the preliminary screening information.

[0140] For example, the discrimination module 630 can be understood as a module integrated in the large model processing flow, responsible for performing processing and judgment of information in multiple languages. For example, through the selection of the large model base model and the setting of the prompt word, the large model can have the ability to perform semantic understanding and correlation analysis on information in multiple languages. After completing the setting of the prompt word and the selection of the base model, the base model can be first optimized, and then the optimized large model is used to perform semantic understanding and correlation analysis on the preliminary screening information screened out by the offline preliminary screening step, to obtain an analysis result. For example, the push design can be used to set the trigger time of distributing the analysis result, and when the trigger time is reached, the part of the obtained analysis result representing the preliminary screening information including the first information is distributed as the first information to the analyst for manual analysis and correction, for reference for subsequent fine-tuning of the large model, so that the semantic understanding and correlation analysis ability of the large model is continuously improved in a specific scenario, realizing a complete learning and optimization closed loop.

[0141] Based on the information processing method provided by at least one embodiment of the present disclosure, at least one embodiment of the present disclosure also provides an information processing device. The following will be described in detail Figure 7 The information processing device will be described in detail.

[0142] Figure 7 The structure block diagram of the information processing device provided by at least one embodiment of the present disclosure is schematically shown.

[0143] As Figure 7 shown, the information processing device 700 of the embodiment includes an information screening module 710 and a processing module 720. For example, these units or modules can be implemented by hardware (such as circuit) modules or software modules, etc. The following embodiments are the same as this, and will not be described again. For example, these units or modules can be implemented by a central processing unit (CPU), a general-purpose graphics processing unit (GPGPU), a graphics processing unit (GPU), a tensor processing unit (TPU), a field programmable logic gate array (FPGA), or other forms of processing units with data processing capability and / or instruction execution capability, and corresponding computer instructions.

[0144] The information screening module 710 is configured to screen a plurality of information, filter noise information irrelevant to the first type in the plurality of information, and obtain preliminary screening information. For example, the information screening module 710 can be configured to perform step S210 described above, and the specific implementation principle can refer to the related description of step S210, which will not be described here.

[0145] The processing module 720 is configured to perform semantic understanding on the preliminary screening information and correlation analysis with the first type of information by using the first large model, obtain an analysis result, and obtain first information of the first type from the plurality of pieces of information. For example, the analysis result represents whether the preliminary screening information includes the first information. For example, the plurality of pieces of information include content in a plurality of languages, and the analysis result is represented by a first language from the plurality of languages. For example, the processing module 720 can be configured to perform step S220 described above, and specific implementation principles can be referred to the related description of step S220, which will not be described here.

[0146] In at least one embodiment of the present disclosure, the information processing apparatus 700 can further include a source determination module configured to, in response to the plurality of pieces of information including second information related to a source, determine a new source based on the second information, and provide the new source for collecting new information for processing.

[0147] In at least one embodiment of the present disclosure, the source determination module can include a discrimination sub-module and a determination sub-module. The discrimination sub-module is configured to determine whether the second information is related to the first type. The determination sub-module is configured to, in response to the second information being related to the first type, determine that a source related to the second information is a new source.

[0148] In at least one embodiment of the present disclosure, the discrimination sub-module is specifically configured to analyze the correlation between the second information and the first type by using a second large model to perform the above determination.

[0149] In at least one embodiment of the present disclosure, the plurality of pieces of information include content in a plurality of languages, and the analysis result is represented by a first language from the plurality of languages.

[0150] In at least one embodiment of the present disclosure, the information screening module 710 described above can include a conversion sub-module and a processing sub-module. The conversion sub-module is configured to convert the preliminary screening information into third information represented by the first language by using a translation model. The processing sub-module is configured to input the third information into the first large model to perform semantic understanding and correlation analysis, and obtain an analysis result.

[0151] In at least one embodiment of the present disclosure, the information screening module 710 described above can be configured to screen information matching keywords in a keyword library from the plurality of pieces of information based on the keyword library for the first type, to obtain the preliminary screening information, wherein the keyword library includes keywords in a plurality of languages.

[0152] In at least one embodiment of the present disclosure, the analysis result includes first information represented in a structured form, and the information processing apparatus 700 can further include an information distribution module configured to distribute the first information represented in the structured form, to determine a risk conveyed by the first information based on the first information.

[0153] In at least one embodiment of the present disclosure, the processing module 720 is specifically configured to, based on the interaction guidance information, perform semantic understanding and correlation analysis of the first type on the preliminary screening information by using the first large model to obtain an analysis result, wherein the interaction guidance information at least includes a first guidance instruction representing a workflow of the semantic understanding and the correlation analysis.

[0154] In at least one embodiment of the present disclosure, the interaction guidance information further includes at least one of the following: a second guidance instruction representing an output format of the analysis result; a third guidance instruction representing a role played by the first large model; a fourth guidance instruction representing a target of the semantic understanding and the correlation analysis; a fifth guidance instruction representing a skill possessed by the first large model; a sixth guidance instruction representing a constraint condition of the semantic understanding and the correlation analysis; and a seventh guidance instruction representing an example of the semantic understanding and the correlation analysis.

[0155] In at least one embodiment of the present disclosure, the information processing apparatus 700 can further include an optimization module configured to, in response to obtaining corrected information obtained by correcting the first information, optimize the interaction guidance information based on a difference between the corrected information and the first information.

[0156] In at least one embodiment of the present disclosure, the optimization module can include an optimization information obtaining submodule and an optimization submodule. The optimization information obtaining submodule is configured to analyze the difference between the corrected information and the first information by using a third large model to obtain optimization information for the interaction guidance information. The optimization submodule is configured to optimize the interaction guidance information based on the optimization information.

[0157] In at least one embodiment of the present disclosure, the analysis result further represents at least one of the following: a basis for determining whether the preliminary screening information includes information of the first type; a sub-type of a plurality of sub-types included in the first type that matches the preliminary screening information; a scenario that matches the preliminary screening information; and a risk control suggestion for the preliminary screening information. It should be noted that, for the sake of clarity and brevity, the present disclosure does not give all the constituent units of the information processing apparatus 700. To achieve the necessary functions of the information processing apparatus, those skilled in the art can provide and set other constituent units not shown according to specific needs, and the embodiments of the present disclosure do not limit this.

[0158] The present disclosure at least one embodiment also provides an electronic device, comprising: a processing apparatus (for example, a processor); a storage apparatus (for example, a memory) comprising one or more computer program modules; wherein the one or more computer program modules are stored in the storage apparatus and configured to be executed by the processing apparatus, and the one or more computer program modules are used to implement the information processing method provided by any embodiment of the present disclosure.

[0159] For example, the processing device can be a central processing unit (CPU), a digital signal processor (DSP), a graphics processor (GPU), a general purpose graphics processor (GPGPU), or other forms of processing units with data processing and / or instruction execution capabilities, which can be general or special purpose processors, and can control other components in the electronic device to perform desired functions.

[0160] For example, the storage device can include one or more computer program products, which can include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory, for example, can include random access memory (RAM), cache memory, and / or the like. The non-volatile memory, for example, can include read-only memory (ROM), hard disk, flash memory, and / or the like. One or more computer program instructions can be stored on the computer-readable storage media, and the processing device can execute the program instructions to implement the functions (implemented by the processing device) in the embodiments of the present disclosure and / or other desired functions, such as an information processing method, and the like. Various application programs and various data, such as collected information, obtained preliminary screening information, and determined first information, and the like, can also be stored in the computer-readable storage media.

[0161] Reference is made below to Figure 8 which shows a structural schematic diagram of an electronic device (such as a terminal device or a server) 800 suitable for implementing the embodiments of the present disclosure. The terminal device in the embodiments of the present disclosure can include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablets), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), and the like, and fixed terminals such as digital TVs, desktop computers, and the like. Figure 8 The electronic device shown is only an example, and should not impose any limitation on the functions and use range of the embodiments of the present disclosure.

[0162] As shown in Figure 8 , the electronic device 800 can include a processing device (such as a central processing unit, a graphics processor, and the like) 801, which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 802 or programs loaded from a storage device 808 into a random access memory (RAM) 803. Various programs and data required for the operation of the electronic device 800 are also stored in the RAM 803. The processing device 801, the ROM 802, and the RAM 803 are connected to each other through a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0163] In general, the following devices can be connected to the I / O interface 805: input devices 806, including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, and the like; output devices 807, including, for example, a liquid crystal display (LCD), a speaker, a vibrator, and the like; storage devices 808, including, for example, a magnetic tape, a hard disk, and the like; and communication devices 809. The communication devices 809 can allow the electronic device 800 to communicate wirelessly or wired with other devices to exchange data. Although Figure 8 The electronic device 800 is shown with various devices, but it is understood that all of the shown devices are not required to be implemented or present. More or less devices can alternatively be implemented or present.

[0164] In particular, the processes described above with reference to the flowcharts can be implemented as a computer software program according to embodiments of the present disclosure. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for executing the methods illustrated by the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network through the communication devices 809, or installed from the storage devices 808, or installed from the ROM 802. When the computer program is executed by the processing devices 801, the above-mentioned functions defined in the methods of the embodiments of the present disclosure are performed.

[0165] It should be noted that the computer-readable medium described above can be a computer-readable signal medium or a computer-readable storage medium or any combination thereof. The computer-readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any suitable combination of the above. More specific examples of the computer-readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, the computer-readable storage medium can be any tangible medium that contains or stores a program used by or in connection with an instruction execution system, apparatus or device. In the present disclosure, the computer-readable signal medium can include a data signal propagated in baseband or propagated as a carrier wave in a propagated data signal, in which the computer-readable program code is contained. Such a propagated data signal can take many forms, including but not limited to, an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer-readable signal medium can also be any computer-readable medium that can send, propagate or transfer the program for use by or in connection with the instruction execution system, apparatus or device. The program code contained in the computer-readable medium can be transmitted by any suitable medium, including but not limited to, wire, cable, RF (radio frequency), etc., or any suitable combination of the above.

[0166] In some embodiments, the client, server, or both can communicate using any current known or future developed network protocol, such as HTTP (Hyper Text Transfer Protocol), and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include local area networks ("LAN"), wide area networks ("WAN"), the Internet, and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any current known or future developed networks.

[0167] The computer-readable medium described above can be included in the electronic device described above; or can exist separately from the electronic device, and not be assembled into the electronic device.

[0168] The computer readable medium described above carries one or more programs, when the one or more programs are executed by the electronic device, cause the electronic device to: screen a plurality of pieces of information, filter noise information irrelevant to the first type in the plurality of pieces of information to obtain preliminary screened information; and perform semantic understanding and association analysis with the first type on the preliminary screened information by using the first large model to obtain an analysis result, and obtain first information of the first type included in the plurality of pieces of information, wherein the analysis result indicates whether the preliminary screened information includes the first information.

[0169] Computer program code for carrying out operations of the present disclosure can be written in any one or more of a variety of programming languages or combinations of languages, including an object-oriented programming language such as Java, Smalltalk, C++, or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer, or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0170] The flow diagrams and the block diagrams in the drawings are illustrations of architectures, functionalities, and operations of possible implementations of systems, methods, and computer program products according to various embodiments of present disclosure. In this regard, each block in the flow diagrams or block diagrams can represent a module, a segment, or a portion of code, which comprises one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and / or flow diagrams, and combinations of blocks in the block diagrams and / or flow diagrams, can be implemented by special purpose hardware-based systems that perform the specified functions or operations, or combinations of special purpose hardware and computer instructions.

[0171] The units or modules described in the embodiments of the present disclosure can be implemented by software, or by hardware. In some cases, the name of the unit or module does not constitute a limitation on the unit or module itself.

[0172] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0173] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0174] According to one or more embodiments of this disclosure, Example 1 provides an information processing method, including:

[0175] Multiple pieces of information are filtered to remove noise information that is irrelevant to the first type, resulting in preliminary screening information; and

[0176] The first major model is used to perform semantic understanding and association analysis with the first type on the initial screening information to obtain analysis results, thereby obtaining the first information of the first type included in the multiple pieces of information. The analysis results characterize whether the initial screening information includes the first information.

[0177] The multiple pieces of information include content in multiple languages, and the analysis result is represented by the first language among the multiple languages.

[0178] According to one or more embodiments of this disclosure, Example 2 provides the method of Example 1, further comprising:

[0179] In response to the inclusion of second information involving a source among the multiple pieces of information, a new source is determined based on the second information, and the new source is provided for collecting new information for processing.

[0180] According to one or more embodiments of this disclosure, Example 3 provides the method of determining a new information source based on the second information as in Example 2, including:

[0181] determining whether the second information is related to the first type; and

[0182] in response to the second information being related to the first type, determining that a source of the second information is the new source.

[0183] According to one or more embodiments of the present disclosure, Example Four provides that the determining whether the second information is related to the first type in Example Three, comprises:

[0184] analyzing the relevance between the second information and the first type by using a second large model to make the determination.

[0185] According to one or more embodiments of the present disclosure, Example Five provides that the using a first large model to perform semantic understanding and relevance analysis on the preliminary screening information to obtain an analysis result in Example One, comprises:

[0186] using a translation model to convert the preliminary screening information into third information expressed in a first language; and

[0187] inputting the third information into the first large model to perform the semantic understanding and the relevance analysis to obtain the analysis result.

[0188] According to one or more embodiments of the present disclosure, Example Six provides that the screening a plurality of information to filter out noise information irrelevant to a first type to obtain preliminary screening information in Example One, comprises:

[0189] screening information matching keywords in a keyword library for the first type from the plurality of information based on the keyword library to obtain the preliminary screening information,

[0190] wherein the keyword library comprises keywords in the plurality of languages.

[0191] According to one or more embodiments of the present disclosure, Example Seven provides that the analysis result in Example One comprises the first information expressed in a structured form.

[0192] wherein the information processing method in Example One further comprises: distributing the first information expressed in a structured form to determine a risk conveyed by the first information based on the first information.

[0193] According to one or more embodiments of the present disclosure, Example Eight provides that the using a first large model to perform semantic understanding and relevance analysis on the preliminary screening information to obtain an analysis result in any one of Examples One to Seven, comprises:

[0194] Based on the interaction guidance information, the first large model is used to perform semantic understanding and association analysis of the first type on the preliminary screening information, to obtain the analysis result.

[0195] The interaction guidance information at least includes a first guidance instruction representing a workflow of the semantic understanding and the association analysis.

[0196] According to one or more embodiments of the present disclosure, example nine provides that the interaction guidance information in example eight further includes at least one of the following:

[0197] a second guidance instruction representing an output format of the analysis result;

[0198] a third guidance instruction representing a role played by the first large model;

[0199] a fourth guidance instruction representing a target of the semantic understanding and the association analysis;

[0200] a fifth guidance instruction representing a skill possessed by the first large model;

[0201] a sixth guidance instruction representing a constraint condition of the semantic understanding and the association analysis; and

[0202] a seventh guidance instruction representing an example of the semantic understanding and the association analysis.

[0203] According to one or more embodiments of the present disclosure, example ten provides that the information processing method in example eight further includes:

[0204] In response to obtaining corrected information obtained by correcting the first information, the interaction guidance information is optimized based on a difference between the corrected information and the first information.

[0205] According to one or more embodiments of the present disclosure, example eleven provides that the optimization of the interaction guidance information based on the difference between the corrected information and the first information in example ten includes:

[0206] using a third large model to analyze the difference between the corrected information and the first information, to obtain optimization information for the interaction guidance information; and

[0207] optimizing the interaction guidance information based on the optimization information.

[0208] According to one or more embodiments of the present disclosure, example twelve provides that the analysis result in any one of examples one to seven further represents at least one of the following:

[0209] a basis for determining whether the preliminary screening information includes information of the first type;

[0210] the first type includes a plurality of subtypes, and the first type is matched with a subtype of the plurality of subtypes in the screening information;

[0211] a scenario matched with the screening information;

[0212] a risk control suggestion for the screening information.

[0213] According to one or more embodiments of the present disclosure, example thirteen provides an information processing apparatus, comprising:

[0214] an information screening module configured to screen a plurality of information, filter noise information irrelevant to a first type in the plurality of information, and obtain screening information; and

[0215] a processing module configured to perform semantic understanding and association analysis of the first type on the screening information by using a first large model, obtain an analysis result, and obtain first information of the first type included in the plurality of information; wherein the analysis result represents whether the first information includes the first information,

[0216] wherein the plurality of information includes content in multiple languages, and the analysis result is represented by a first language of the multiple languages.

[0217] According to one or more embodiments of the present disclosure, example fourteen provides an electronic device, comprising:

[0218] a processing apparatus; and

[0219] a storage apparatus comprising one or more computer program instructions;

[0220] wherein the one or more computer program instructions are executed by the processing apparatus to perform the information processing method provided by at least one embodiment of the present disclosure.

[0221] According to one or more embodiments of the present disclosure, example fifteen provides a computer-readable storage medium, which non-transiently stores computer-readable instructions, wherein the computer-readable instructions are executed by a processor to implement the information processing method provided by at least one embodiment of the present disclosure.

[0222] The above description is merely preferred embodiments of the present disclosure and a description of the principles of the technology applied. It should be understood by those skilled in the art that the disclosure scope involved in the present disclosure is not limited to the technical solutions formed by the specific combinations of the above technical features, and should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features disclosed in the present disclosure (but not limited to) having similar functions to form technical solutions.

[0223] Moreover, while operations are depicted in a particular order, this should not be understood as requiring such an order nor infringing on the scope of the disclosure. In certain circumstances, multitasking and parallel processing can be advantageous. Likewise, while several specific implementation details have been discussed, these should not be construed as limitations on the scope of the disclosure. Certain features that are described in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable sub-combination.

[0224] Although the subject matter has been described in language specific to structural features and / or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

Claims

1. An information processing method, comprising: Multiple pieces of information are filtered to remove noise information that is not related to the first type, thus obtaining preliminary screening information; as well as The first major model is used to perform semantic understanding and association analysis with the first type on the initial screening information to obtain analysis results, thereby obtaining the first information of the first type included in the multiple pieces of information. The analysis results characterize whether the initial screening information includes the first information. The multiple pieces of information include content in multiple languages, and the analysis result is represented by the first language among the multiple languages.

2. The information processing method according to claim 1 further includes: In response to the inclusion of second information involving a source among the multiple pieces of information, a new source is determined based on the second information, and the new source is provided for collecting new information for processing.

3. The information processing method according to claim 2, wherein, Based on the second information, new information sources are identified, including: Determine whether the first information is related to the first type; and In response to the correlation between the first information and the first type, the information source involved in the first information is determined to be the newly added information source.

4. The information processing method according to claim 3, wherein, Determining whether the first information is related to the first type includes: The second major model is used to analyze the correlation between the first information and the first type in order to make the discrimination.

5. The information processing method according to claim 1, wherein, The first major model is used to perform semantic understanding and association analysis with the first type on the initial screening information to obtain analysis results, including: The initial screening information is converted into third information represented in the first language using a translation model; and The third information is input into the first large model to perform the semantic understanding and the association analysis, and the analysis results are obtained.

6. The information processing method according to claim 1, wherein, The step of filtering multiple pieces of information, filtering out noise information that is irrelevant to the first type from the multiple pieces of information, to obtain preliminary screening information includes: Based on the keyword lexicon for the first type, information matching the keywords in the keyword lexicon is filtered from the multiple pieces of information to obtain the initial screening information. The keyword database includes keywords from the multiple languages.

7. The information processing method according to claim 1, wherein, The analysis results include the first information represented in a structured form; The information processing method further includes: Distribute the first information in a structured form to determine the risk conveyed by the first information based on the first information.

8. The information processing method according to any one of claims 1 to 7, wherein, The first major model is used to perform semantic understanding and association analysis with the first type on the initial screening information to obtain analysis results, including: Based on the interactive guidance information, the first large model is used to perform semantic understanding and association analysis with the first type on the initial screening information to obtain the analysis results. The interactive guidance information includes at least a first guidance instruction representing the workflow of the semantic understanding and the association analysis.

9. The information processing method according to claim 8, wherein, The interactive guidance information also includes at least one of the following: A second guiding instruction indicating the output format of the analysis results; The third guiding instruction indicates the role played by the first large model; A fourth guiding instruction indicating the objectives of the semantic understanding and the association analysis; The fifth guiding instruction indicates the skills possessed by the first major model; The sixth guiding instruction represents the constraints of the semantic understanding and the association analysis; as well as The seventh guiding instruction represents an example of the semantic understanding and the association analysis.

10. The information processing method according to claim 8, further comprising: In response to obtaining corrected information obtained by correcting the first information, the interactive guidance information is optimized based on the difference between the corrected information and the first information.

11. The information processing method according to claim 10, wherein, Optimizing the interactive guidance information based on the difference between the corrected information and the first information includes: The third major model is used to analyze the difference between the corrected information and the first information to obtain optimized information for the interactive guidance information; and The interactive guidance information is optimized based on the optimization information.

12. The information processing method according to any one of claims 1 to 7, wherein, The analytical results also characterize at least one of the following: The basis for determining whether the initial screening information includes the first type of information; The first type includes a subtype that matches the initial screening information from among multiple subtypes; Scenarios that match the initial screening information; Risk control recommendations based on the aforementioned initial screening information.

13. An information processing apparatus, comprising: The information filtering module is configured to: filter multiple pieces of information, filter out noise information that is not related to the first type from the multiple pieces of information, and obtain preliminary screening information; as well as The processing module is configured to: perform semantic understanding and association analysis with the first type on the initial screening information using a first large model, obtain analysis results, and obtain first information of the first type included in the multiple pieces of information; wherein, the analysis results characterize whether the initial screening information includes the first information. The multiple pieces of information include content in multiple languages, and the analysis result is represented by the first language among the multiple languages.

14. An electronic device comprising: Processing device; as well as Storage device, including one or more computer program instructions; The one or more computer program instructions are executed by the processing device according to any one of claims 1 to 12.

15. A computer-readable storage medium for non-transitory storage of computer-readable instructions, wherein, The method described in any one of claims 1 to 12 is implemented when the computer-readable instructions are executed by a processor.

Images