Information processing method and apparatus, electronic device, and computer-readable storage medium

Abstract

An information processing method and device, electronic equipment and computer readable storage medium. The information processing method comprises: screening a plurality of information, filtering noise information irrelevant to a first type in the plurality of information to obtain preliminary screening information; and using a first large model to perform semantic understanding and association analysis on the preliminary screening information to obtain an analysis result, and obtain first information of the first type included in the plurality of information, wherein the analysis result represents whether the preliminary screening information includes the first information of the first type, the plurality of information includes content in multiple languages, and the analysis result is represented by a first language in the multiple languages. The above method and device provided by the embodiments of the present disclosure can quickly and accurately screen and extract the first type of information of interest from a large amount of information.

Description

Technical Field

[0001] This disclosure relates to an information processing method, an information processing apparatus, an electronic device, and a computer-readable storage medium. Background Technology

[0002] With the accelerating pace of globalization and digitalization, network operations and data processing activities are becoming increasingly frequent, leading to greater challenges in maintaining cybersecurity. The sheer volume and complexity of information, the difficulty in verifying its authenticity and accuracy, and the challenges in tracking and tracing the source of large amounts of data make these phenomena difficult to manage effectively, posing potential threats to cybersecurity. Summary of the Invention

[0003] This summary section is provided to briefly introduce the concepts, which will be described in detail in the detailed description section below. This summary section is not intended to identify key or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0004] At least one embodiment of this disclosure provides an information processing method, including: screening multiple pieces of information, filtering out noise information that is not related to a first type from the multiple pieces of information, and obtaining preliminary screening information; using a first large model to perform semantic understanding and association analysis with the first type on the preliminary screening information, obtaining analysis results, and obtaining first information of the first type included in the multiple pieces of information, wherein the analysis results characterize whether the preliminary screening information includes the first information of the first type, wherein the multiple pieces of information include content in multiple languages, and the analysis results are represented by the first language among the multiple languages.

[0005] At least another embodiment of this disclosure provides an information processing apparatus, including: an information filtering module configured to: filter multiple pieces of information, filtering out noise information unrelated to a first type from the multiple pieces of information to obtain preliminary screening information; and a processing module configured to: perform semantic understanding and association analysis with the first type on the preliminary screening information using a first large model, obtain analysis results, and obtain first information of the first type included in the multiple pieces of information, wherein the analysis results characterize whether the preliminary screening information includes the first information of the first type, wherein the multiple pieces of information include content in multiple languages, and the analysis results are represented by a first language among the multiple languages.

[0006] At least one further embodiment of this disclosure provides an electronic device, including: a processing device; and a storage device including one or more computer program instructions; wherein the one or more computer program instructions are executed by the processing device to perform the information processing method provided in at least one embodiment of this disclosure.

[0007] At least one further embodiment of this disclosure provides a computer-readable storage medium for non-transitory storage of computer-readable instructions, wherein the computer-readable instructions, when executed by a processor, implement the information processing method provided in at least one embodiment of this disclosure.

[0008] At least one further embodiment of this disclosure provides a computer program product, including a computer program / instructions that, when run on a computer, cause the computer to perform the information processing method provided in at least one embodiment of this disclosure. Attached Figure Description

[0009] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the originals and elements are not necessarily drawn to scale.

[0010] Figure 1 This illustration schematically shows an application scenario of the information processing method and apparatus provided in at least one embodiment of the present disclosure;

[0011] Figure 2 The schematic diagram illustrates a flowchart of an information processing method provided in at least one embodiment of the present disclosure;

[0012] Figure 3 The schematic diagram illustrates the principle of an information processing method according to at least one embodiment of the present disclosure;

[0013] Figure 4 The illustration shows a schematic diagram illustrating the principle of determining a new information source according to at least one embodiment of the present disclosure;

[0014] Figure 5 This illustration schematically shows a principle diagram of optimized interactive guidance information according to at least one embodiment of the present disclosure;

[0015] Figure 6 This schematic diagram illustrates the implementation principle of an information processing system according to at least one embodiment of the present disclosure;

[0016] Figure 7 This schematically illustrates a structural block diagram of an information processing apparatus provided in at least one embodiment of the present disclosure; and

[0017] Figure 8 A schematic diagram of the structure of an electronic device suitable for implementing embodiments of the present disclosure is shown. Detailed Implementation

[0018] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0019] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0020] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0021] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0022] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0023] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0024] It is understood that the data involved in this technical solution (including but not limited to the data itself, the acquisition, use, storage or deletion of the data) shall comply with the requirements of relevant laws, regulations and related provisions.

[0025] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, relevant users should be informed of the type, scope of use, and usage scenarios of the information involved in this disclosure through appropriate means in accordance with relevant laws and regulations, and authorization should be obtained from the relevant users. Among them, relevant users may include any type of rights holder, such as individuals, enterprises, and groups.

[0026] For example, in response to receiving an active request from a user, a prompt message is sent to the relevant user to clearly inform the user that the requested operation will require obtaining and using the user's information, thereby enabling the relevant user to choose whether to provide information to the software or hardware such as the electronic device, application, server, or storage medium that performs the operation of the technical solution disclosed herein based on the prompt message.

[0027] As an optional but non-restrictive implementation, in response to a user's active request, a prompt message can be sent to the user, such as a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide information to the electronic device.

[0028] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0029] With the accelerating pace of globalization and digitalization, the challenges facing cybersecurity are becoming increasingly complex and international. For example, the use of the internet for communication and transactions is becoming more and more prevalent. The internet carries massive amounts of multilingual and unstructured information, containing valuable data related to data breaches and business vulnerabilities that is crucial for cybersecurity protection. This information can be multimodal, including one or more types of data such as text, audio, images, and video.

[0030] However, extracting valuable information from this information presents challenges such as difficulty, low processing efficiency, and high demands on business capabilities. For example, due to the vast amount of information and high levels of noise online, using fixed-rule filtering methods to extract high-value data can easily generate numerous false positives. Furthermore, such filtering methods cannot accurately understand contextual information and are ill-suited for dealing with online information that subtly expresses non-compliant content. For instance, online information involves multiple languages, especially less common ones. Without analysts possessing the corresponding language skills, it is difficult to effectively interpret and analyze this information, leading to the loss of some high-value data. Finally, extracting truly valuable information from massive amounts of data that can guide adjustments to security measures requires analysts with deep domain knowledge and extensive experience; this process is time-consuming, labor-intensive, and highly dependent on the analyst's individual abilities.

[0031] To at least partially solve the above-mentioned technical problem, at least one embodiment of this disclosure provides an information processing method, including: screening multiple pieces of information, filtering out noise information unrelated to a first type from the multiple pieces of information, to obtain preliminary screening information; and using a first large model to perform semantic understanding and association analysis with the first type on the preliminary screening information, to obtain analysis results, to obtain first information of the first type included in the multiple pieces of information, wherein the analysis results characterize whether the preliminary screening information includes the first information of the first type, wherein the multiple pieces of information include content in multiple languages, and the analysis results are represented by a first language among the multiple languages.

[0032] Based on the information processing method provided in at least one embodiment of this disclosure, at least one embodiment of this disclosure also provides an information processing apparatus, an electronic device, and a computer-readable storage medium.

[0033] The information processing method provided in at least one embodiment of this disclosure can quickly filter out massive amounts of noisy information by first screening multiple pieces of information, reducing the cost and pressure of large-scale model processing. By using a large-scale model to perform semantic understanding and association analysis on the initially screened information after obtaining it, the method can achieve a deeper understanding of the complex semantics of the information, thereby improving the accuracy of the first type of information obtained. This information processing method achieves the identification and extraction of the first type of information by combining the filtering of noisy information with the use of a large-scale model for semantic understanding and association analysis, thus achieving a balance between the efficiency and depth of information analysis. For example, based on this information processing method, data of high value for network security protection can be quickly and accurately extracted from massive amounts of interactive information.

[0034] The embodiments and some examples of this disclosure will now be described in detail with reference to the accompanying drawings.

[0035] Figure 1 The illustration shows an application scenario of the information processing method and apparatus provided in at least one embodiment of the present disclosure.

[0036] like Figure 1 As shown, the application scenario 100 of this embodiment involves first terminal devices 111, 112, and 113 and server 120. Server 120 can be, for example, a server for network security protection, or a backend management server supporting client application operation; it can be a server for a local area network or wide area network, or a cloud server, etc. The embodiments of this disclosure do not limit this. For example, first terminal devices 111, 112, and 113 can be electronic devices such as smartphones, tablets, laptops, and desktop computers, or any device capable of installing client applications and browsing web pages, such as smart wearable devices, smart appliances, and smart cars. The embodiments of this disclosure do not limit this.

[0037] For example, server 120 can obtain information sent by clients from first terminal devices 111, 112, and 113, and process the information set including this information. Depending on implementation needs, any compliant method can be used to obtain the information, and this embodiment of the disclosure does not limit this. After obtaining the information, server 120 can, for example, filter and extract the information to obtain information of the first type.

[0038] For example, server 120 can support the operation of large models. Server 120 can rely on large models to perform semantic understanding and association analysis of information in order to extract the first type of information. For example, server 120 can also deploy a server locally that supports the operation of large models. The running server relies on the running large model to perform semantic understanding and association analysis of information.

[0039] In some embodiments, application scenario 100 may involve other terminal devices to replace server 120 for filtering and extracting the acquired information. For example, the other terminal device may have a server locally deployed that supports the operation of a large model. The running server relies on the running large model to perform semantic understanding and association analysis on the information in order to extract the first type of information.

[0040] In at least one embodiment, application scenario 100 may also involve a second terminal device 130. For example, server 120 may push the obtained first type of information to a client running on the second terminal device 130 so that analysts can view the first type of information and analyze the risks conveyed by the information, as well as the level of those risks, based on the first type of information.

[0041] In at least one embodiment, the server 120 can also convert the information into structured information and push the information of the first type in the structured information obtained from the information conversion to the client running on the second terminal device 130, so as to improve the efficiency of analyzing the information of the first type.

[0042] For example, the information processing method provided in at least one embodiment of this disclosure can be implemented in software, hardware, firmware, or any combination thereof.

[0043] For example, the information processing method provided in at least one embodiment of this disclosure is applicable to servers or other terminal devices. These servers or other terminal devices can load and execute the information processing method, and the embodiments of this disclosure do not limit this. For example, the server or other terminal device may include a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), a Digital Signal Processor (DSP), a Neural Processing Unit (NPU), or other processing units with data processing capabilities and / or instruction execution capabilities, storage units, etc. The server or other terminal device may also have an operating system and various types of application programming interfaces (APIs) (e.g., OpenGL (Open Graphics Library), Metal, etc.) installed, implementing the information processing method provided in the embodiments of this disclosure by running code or instructions.

[0044] The following will combine Figures 2-5 The information processing method provided in at least one embodiment of this disclosure will be described in detail.

[0045] Figure 2 A flowchart illustrating at least one embodiment of the information processing method provided in this disclosure is shown.

[0046] like Figure 2 As shown, the information processing method 200 of this embodiment includes steps S210 to S220. For example, the executing entity of this information processing method can be a terminal device with a server deployed, or it can be a server with a server deployed; the embodiments of this disclosure do not limit this.

[0047] Step S210: Filter multiple pieces of information, removing noise information that is not related to the first type from the multiple pieces of information to obtain preliminary screening information.

[0048] Step S220: Use the first large model to perform semantic understanding and association analysis with the first type on the initial screening information, obtain the analysis results, and obtain the first information of the first type including multiple pieces of information.

[0049] According to at least one embodiment of this disclosure, the multiple pieces of information may include various information on the network, all of which have been obtained with authorization or permission. It is understood that the types of the multiple pieces of information may be one or more of types such as text, image, video, and audio; these types are merely examples to aid understanding of this disclosure, and the embodiments of this disclosure do not limit this.

[0050] For example, the number of multiple pieces of information (e.g., the first number) can be massive, such as big data level, including but not limited to tens of thousands or even millions of pieces of information.

[0051] In at least one embodiment of this disclosure, multiple pieces of information can be filtered based on predetermined rules. These predetermined rules may include filtering out information containing garbled characters, filtering out information containing non-compliant images, filtering out information containing specific characters, etc. For example, the predetermined rules can be determined based on a first type. The purpose of setting the predetermined rules is to filter out a large amount of noise information unrelated to the first type from a massive amount of information. The initially filtered information is information with the potential to extract the first type of first information; for example, it can also be called potential information. The specific content of the predetermined rules is not limited in the embodiments of this disclosure.

[0052] In at least one embodiment of this disclosure, the obtained preliminary screening information may include one or more (e.g., a second quantity) pieces of information. This embodiment may employ a first large model to perform semantic understanding and association analysis on the preliminary screening information to obtain analysis results corresponding to the preliminary screening information, or analysis results uniquely corresponding to each piece of information in the preliminary screening information. For example, the analysis result may characterize whether the preliminary screening information includes first information of a first type. In this disclosure, for example, the first type may be any type of the type to which the information of interest belongs, and is not limited to a specific type. Depending on actual needs, the first type may be at least one of the types with security risks, types with business risks, etc., and the embodiments of this disclosure do not limit this.

[0053] For example, the first large model can be any type of large model, such as any one or a combination of multiple large language models, visual models, audio models, and multimodal models, as long as it can achieve the functions and effects defined in the embodiments of this disclosure. The embodiments of this disclosure do not limit this, for example, it can be an open-source model or a closed-source model. For example, the first large model can be pre-trained using manually labeled sample data. The input of the first large model is the initial screening information obtained through screening, and the output is the analysis result characterizing whether the initial screening information includes the first type of first information. For example, the labeled data of the sample data is the analysis result obtained by manual analysis of the information. Through training, the first large model can, for example, learn the rules of correlation between information and the first type, and perform correlation analysis based on these rules. For example, the sample data may include the first information of the first type, or it may include information other than the first type. The ratio between these two parts of information can be set according to actual needs, and the embodiments of this disclosure do not limit this.

[0054] In at least one embodiment of this disclosure, each piece of information in the initial screening can be used as input to a large model agent constructed based on a first large model. The large model agent then uses the first large model to perform semantic understanding and association analysis on each piece of information, thereby obtaining the analysis result corresponding to each piece of information. Alternatively, this embodiment can also use each piece of information and its context information as input to the large model agent for semantic understanding and association analysis. Alternatively, this embodiment can also use the initial screening information as a whole as input to the large model agent.

[0055] In at least another embodiment of this disclosure, a first large model can be used to perform semantic understanding and association analysis on the initial screening information based on interactive guidance information (e.g., prompts) to obtain analysis results. The interactive guidance information represents the semantic understanding and association analysis tasks that the first large model needs to perform. For example, it may include multiple parts to convey various environmental information and execution instructions. For instance, the interactive guidance information may at least include a first guidance instruction representing the workflow of semantic understanding and association analysis. For example, each piece of information in the interactive guidance information and the initial screening information can be concatenated and input into the first large model, which then performs semantic understanding and association analysis on each piece of information in the initial screening information based on the interactive guidance information to obtain analysis results. Alternatively, all information in the interactive guidance information and the initial screening information can be concatenated and input into the first large model, which then performs semantic understanding and association analysis on the initial screening information as a whole based on the interactive guidance information to obtain analysis results. Alternatively, the interactive guidance information, each piece of information in the initial screening information, and the context information of each piece of information can be concatenated and input into the first large model, which then performs semantic understanding and association analysis on each piece of information and its context information based on the interactive guidance information to obtain analysis results.

[0056] For example, after obtaining the analysis results, information belonging to the first type can be selected from the initial screening information and designated as the first piece of information for that type. Alternatively, depending on actual needs, after obtaining the first piece of information belonging to the first type, it can be intercepted to prevent the widespread dissemination of non-compliant data and improve cybersecurity.

[0057] For example, the analysis result can characterize whether the initial screening information includes first information of the first type. If it does, the first information is extracted. For example, if the initial screening information includes the first information, the analysis result includes the first information; if the initial screening information does not include the first information, the analysis result can be predetermined information that does not include the first information.

[0058] In one embodiment, the analysis results can be structured information. For example, the analysis results may include first information represented in a structured form. This embodiment can also distribute the first information in a structured form so that the recipient of the first information can determine the risk conveyed by the first information based on the first information. For example, it can also be understood as determining the risk conveyed by the preliminary screening information corresponding to the first information based on the first information. For example, the first information can be distributed to the terminal used by the analyst so that the analyst can determine the risk based on the first information. Compared with preliminary screening information, the first information represented in a structured form is information that can be directly used and consumed, which helps to improve the efficiency of the analyst in determining risk.

[0059] The information data processing method of at least one embodiment of this disclosure achieves the identification and extraction of first type of first information by combining noise filtering with semantic understanding and association analysis using large models, thus achieving a balance between the efficiency and depth of information analysis. For example, based on this information processing method, data of high value for network security protection can be extracted quickly and accurately from massive amounts of information.

[0060] Figure 3 The schematic diagram illustrates the principle of an information data processing method according to at least one embodiment of the present disclosure.

[0061] In at least one embodiment of this disclosure, the information to be processed can be filtered based on a keyword lexicon for a first type. For example, the aforementioned step S210 can be implemented as follows: based on a keyword lexicon for a first type, information matching the keywords in the keyword lexicon is filtered from multiple pieces of information to obtain preliminary screening information.

[0062] According to at least one embodiment of this disclosure, keywords in the keyword database for the first type can be obtained by searching and statistically analyzing information already manually selected as relevant to the first type, or by performing word frequency analysis. For example, to construct a keyword database, words with frequencies higher than a predetermined frequency can be used as keywords in the database, as can other words associated with or appearing simultaneously with these words. Alternatively, keywords can be collected from content provided by professional platforms based on business needs. For example, in addition to a specific keyword, synonyms of that keyword in different contexts or languages ​​can also be added as keywords. Depending on actual needs, the keyword database for the first type can be maintained periodically or in real-time to periodically or in real-time add newly analyzed or collected keywords, thereby continuously improving the quality of the initial screening information and reducing false positives and false negatives.

[0063] For example, the first type could include business security types or risk security types. Keywords in the keyword database could include general security terms, terms related to the target business, and regional coded language.

[0064] For example, for each piece of information among multiple pieces of information, this embodiment can match each piece of information with each keyword in a keyword lexicon for the first type. If each piece of information includes a keyword from the keyword lexicon, then that piece of information is included as one of the initial screening pieces of information. Alternatively, each piece of information and each keyword in the keyword lexicon can be converted into a semantic vector, and the similarity between the semantic vector of each piece of information and the semantic vector of each keyword in the keyword lexicon can be calculated as the matching degree between each piece of information and each keyword. If there is a keyword in the keyword lexicon whose matching degree with each piece of information is higher than the matching degree threshold, then it is determined that each piece of information matches a keyword in the keyword lexicon, and that piece of information is included as one of the initial screening pieces of information.

[0065] In at least one embodiment, such as Figure 3 As shown, after obtaining multiple pieces of information 310, the information 310 can be filtered based on the keyword thesaurus 320, that is, information that matches the keywords in the keyword thesaurus 320 can be filtered out to obtain preliminary information 311. Subsequently, the preliminary information 311 can be concatenated with the interactive guidance information 330, for example, as input to the first main model 340. The first main model 340 performs semantic understanding and association analysis on the preliminary information 311 based on the interactive guidance information 330, and outputs the analysis result 350 corresponding to the preliminary information 311. Finally, the first information 360 of the first type included in the multiple pieces of information 310 can be obtained based on the analysis result 350. For example, if the analysis result 350 indicates that the preliminary information 311 includes the first information, the analysis result can be used as the first information 360 and distributed to the security team or business team through the application programming interface (API) or information push.

[0066] For example, after obtaining the first information 360, the first information can be stored in a predetermined storage space for later use.

[0067] In at least one embodiment of this disclosure, the interactive guidance information 330 may include first guidance instructions representing a workflow for semantic understanding and correlation analysis, such as the following information: "1. Carefully read and understand the provided information, and understand the semantics of the information, and clarify the key elements involved and their correlations; 2. Analyze the attributes of the information and distinguish whether it belongs to security risk information or business risk information."

[0068] For example, the analysis results can also characterize the basis for determining whether the initial screening information includes the first type of information. The aforementioned first guiding instruction can also include the following information: "3. Explain the basis for judgment in detail to ensure that the analysis logic is clear, professional and based on evidence."

[0069] For example, the analysis results can also characterize the subtypes that match the initial screening information among the multiple subtypes included in the first type. The aforementioned first guidance instruction can also include the following information: "4. If the information belongs to security risk information, then determine which of the following types it belongs to: account security risk, ...; if the information belongs to business risk information, then determine which of the following types it belongs to: non-compliant resource supply, ...."

[0070] For example, the analysis results can also characterize the scenarios that match the initial screening information. The aforementioned first guidance instruction can also include the following information: "5. Determine whether the information is related to the target scenario and locate the scenario in combination with the business background."

[0071] For example, the analysis results can also characterize risk control recommendations for the initial screening information. The aforementioned first guiding instruction can also include the following information: "6. Based on the above analysis, determine the direction of subsequent value mining or risk control recommendations."

[0072] It is understood that the information included in the first guidance instruction above is only an example to facilitate understanding of this disclosure. Depending on actual needs, the first guidance instruction may include one or more of the above information, or may include other information. For example, the first guidance instruction may be used to guide a large model to perform deep semantic understanding, contextual association analysis and intent judgment. The embodiments of this disclosure do not limit this.

[0073] In at least one embodiment of this disclosure, in addition to the first guidance instruction, the interactive guidance information may also include a second guidance instruction indicating the output format of the analysis results, so as to standardize the expression of the analysis results and facilitate direct use and consumption. For example, the second guidance instruction may include the following information. It is understood that the following information is only provided as an example to facilitate understanding of this disclosure, and the embodiments of this disclosure do not limit it:

[0074] ## Output Format

[0075] {

[0076] "Is it a security risk type?": "Yes / No"

[0077] "Judgment basis": "..."

[0078] "Subtypes of security risks": "..."

[0079] "Security Scenario": "..."

[0080] "Is it a type of business risk?": "Yes / No"

[0081] "Judgment basis": "..."

[0082] Subtypes of Business Risk: "..."

[0083] "Business Scenario": "..."

[0084] "Further value extraction based on the above": "..."

[0085] }

[0086] Please ensure that each field has a specific description, using standard and professional language.

[0087] For example, regarding security risk types, the second guiding instruction can constrain the analysis results output by the first major model to include judgment criteria, specific security risk subtypes (e.g., social engineering fraud, attack warnings, etc.), applicable security scenarios (e.g., data privacy protection, online fraud prevention, etc.), and risk levels. For business risk types, the second guiding instruction can constrain the analysis results output by the first major model to include judgment criteria, specific business risk subtypes (e.g., marketing strategies, industry promotion activities, etc.), applicable business scenarios (e.g., digital payments, expanding user base, etc.), and suggestions to help the business unit understand market dynamics and potential risks. It is understood that the information included in the analysis results output by the first major model is merely an example to facilitate understanding of this disclosure, and the embodiments of this disclosure do not limit this.

[0088] In at least one embodiment of this disclosure, the interactive guidance information may further include a third guidance instruction representing the role played by the first major model, to constrain the professionalism of semantic understanding and association analysis of the first major model based on the role, thereby improving the accuracy of the obtained analysis results. For example, the third guidance instruction may include the following information; it is understood that the following information is merely an example to facilitate understanding of this disclosure, and the embodiments of this disclosure do not limit it:

[0089] "##Role

[0090] You are a professional security risk analyst. Please analyze the following text and output your analysis results.

[0091] In at least one embodiment of this disclosure, the interactive guidance information may further include a fourth guidance instruction representing the goal of semantic understanding and association analysis, to provide guidance for semantic understanding and association analysis of the first large model, thereby improving the accuracy of the obtained analysis results. For example, the fourth guidance instruction may include the following information; it is understood that the following information is merely an example to aid in understanding this disclosure, and the embodiments of this disclosure do not limit the scope of the disclosure:

[0092] "##Target

[0093] In-depth analysis of user-provided information to accurately identify whether it involves... business scenarios.

[0094] Output structured and professional analysis reports that clearly distinguish between security risks and business risks, highlighting potential value.

[0095] In at least one embodiment of this disclosure, the interactive guidance information may further include a fifth guidance instruction representing the skills possessed by the first master model, to constrain the accuracy of the first master model in semantic understanding and association analysis, thereby improving the accuracy of the obtained analysis results. For example, the fifth guidance instruction may include the following information; it is understood that the following information is merely an example to aid in understanding this disclosure, and the embodiments of this disclosure do not limit it:

[0096] "##Skill

[0097] Proficient in risk analysis methods and techniques, able to identify and assess security risks and business value within complex information.

[0098] Be familiar with the business scenarios and industry background of enterprise services, and understand risk characteristics and attack mechanisms.

[0099] In at least one embodiment of this disclosure, the interactive guidance information may further include a sixth guidance instruction representing constraints on semantic understanding and association analysis, to constrain the direction of semantic understanding and association analysis of the first large model, thereby improving the accuracy of the obtained analysis results. For example, the sixth guidance instruction may include the following information; it is understood that the following information is merely an example to aid in understanding this disclosure, and the embodiments of this disclosure do not limit it:

[0100] "##constraint

[0101] Information must be rigorously analyzed based on the information provided by the user; no information may be added or deleted without authorization.

[0102] The original information must not be deleted or modified; only structured analysis reports can be output.

[0103] The report should use professional and accurate language, avoiding vagueness and repetition.

[0104] In at least one embodiment of this disclosure, the interactive guidance information may further include a seventh guidance instruction representing examples of semantic understanding and association analysis, to more accurately guide the first large model to output the required analysis results. For example, the sixth guidance instruction may include the following information; it is understood that the following information is merely illustrative to aid in understanding this disclosure, and the embodiments of this disclosure do not limit it:

[0105] ##Example

[0106] Example 1:

[0107] Input: XXXXX

[0108] Output: YYYYY

[0109] Example 2:

[0110] …。

[0111] It is understandable that, depending on actual needs, in addition to the first boot instruction, the interactive boot information may also include one of the aforementioned boot instructions or any combination of the aforementioned boot instructions.

[0112] In at least one embodiment of this disclosure, the multiple pieces of information to be processed may include content in multiple languages, and the analysis result may be represented by a first language among the multiple languages. For example, the multiple languages ​​may include common languages ​​or less commonly spoken languages, and the first language representing the analysis result may be a common language among the multiple languages, thereby reducing the difficulty and cost of reading the analysis result.

[0113] For example, after obtaining the initial screening information, a translation model can be used to translate the initial screening information into information represented in the first language. Then, a primary model is used to perform semantic understanding and association analysis on the information in the first language, thereby obtaining the analysis results represented in the first language. For example, the initial screening information can be sent to an agent built based on the primary model, which then calls a translation model matching the language of the initial screening information to translate the initial screening information into third information represented in the first language. The agent then calls the primary model to perform semantic understanding and association analysis on the third information to obtain the analysis results. For example, the translation model can include multiple models for implementing translation tasks between the first language and each of the other languages ​​besides the first language, with each model corresponding to one other language. For example, the multiple models included in the translation model can be existing models, or multiple models pre-trained on the same base model using corpora from multiple other languages. The base model can be a large model, or any deep learning model such as a recurrent neural network model; the embodiments of this disclosure are not limited in this regard. For example, a multilingual translation model can also be used to translate the initial screening information into information represented in the first language. For example, by first using a translation model to translate the initial screening information, and then using a large model for semantic understanding and association analysis, the accuracy of translating the initial screening information can be improved, and the requirements for the processing power of the large model can be reduced.

[0114] For example, the identification of information in multiple languages ​​can be achieved by relying on a primary model. For instance, after obtaining initial screening information, this information and interactive guidance information can be directly input into the primary model. By constraining the language type of the analysis results output by the primary model, it can be made to directly output the analysis results in the primary language, thereby reducing the language proficiency requirements for analysts. By relying on the primary model to identify information in multiple languages, the inherent multilingual capabilities of the primary model can be fully utilized without prior machine translation, effectively preserving subtle semantic nuances of the information, thus improving the accuracy of semantic understanding and association analysis, and ultimately enhancing the accuracy of the obtained analysis results. For example, the primary model can be a specially trained and optimized model with powerful multilingual recognition capabilities.

[0115] The information processing method provided in at least one embodiment of this disclosure can fully utilize the native multilingual capabilities and powerful logical reasoning abilities of large models, enabling end-to-end automated analysis of multilingual information. It not only overcomes language barriers but also directly transforms unstructured information into structured, directly consumable first information as intelligence data, providing detailed judgment criteria and application scenarios. This first information can directly empower business decisions, representing a significant breakthrough compared to processes that rely solely on predetermined rules to mine valuable intelligence or manual intelligence mining.

[0116] Figure 4 The illustration shows a schematic diagram of the principle of determining a new information source according to at least one embodiment of the present disclosure.

[0117] In at least one embodiment of this disclosure, the information processing method can also automatically expand the information source based on the information to be processed, so as to increase the coverage of information processing, realize the fission expansion of information source, and continuously improve network security.

[0118] According to embodiments of this disclosure, when multiple pieces of information include second information relating to information sources, a new information source can be determined based on the second information, and the new information source can be provided for collecting new information for processing.

[0119] For example, for each of the multiple pieces of information, regular expressions can be used to check whether each piece of information includes a string that conforms to a specific format, or semantic pattern matching technology can be used to determine whether content conforming to a preset "semantic pattern" can be identified and extracted from each piece of information. The specific format and the preset "semantic pattern" can be set according to actual needs. For example, the specific format can be a link format containing "t.me / " or similar, and the embodiments of this disclosure are not limited in this regard. If each piece of information includes a string of a specific format or content conforming to a preset "semantic pattern" can be extracted, then each piece of information can be determined to be second information related to the information source.

[0120] For example, a page accessible based on the second information can be used as a new information source. When collecting new information in the future, the information in the page accessible based on the second information can be used as the collection target, and the newly collected information can be filtered and processed.

[0121] For example, when determining new information sources based on second information, it can be first determined whether the second information is related to the first type. If the second information is related to the first type, then the information source involved in the second information is taken as a new information source. In this way, the probability that the information collected from the determined new information source is related to the first type can be increased, ensuring that the investment of collection resources is more accurate, thereby improving the overall quality of the collected information from the source.

[0122] For example, it can be determined whether the second piece of information is related to each subtype included in the first type, thereby improving the precision and accuracy of relevance determination. For example, relevance determination can also be based on the second piece of information and its contextual information, combining contextual semantics to improve the accuracy of the determination. For example, when multiple pieces of information include multiple pieces of second information, sources related to second information with high relevance to the first type can be prioritized as new sources; sources related to second information with low relevance are either given lower priority as new sources or ignored.

[0123] In one embodiment, a large model can be used to analyze the correlation between the second information and the first type. This determines whether the second information and the first type are related. Using a large model enables rapid assessment of correlation, which facilitates the implementation of a "collect-as-you-go" model, thereby improving the efficiency of information source expansion and enhancing the effectiveness and timeliness of network security protection.

[0124] For example, such as Figure 4 As shown, after identifying the second information 411 involving the information source from the multiple pieces of information 410 to be processed, the second information 411 can be input into the second large model 430. The second large model 430 analyzes the correlation between the second information 411 and the first type to obtain the correlation degree 440. Subsequently, new information sources 450 can be selected from the information sources 420 involved in the second information 411 based on the correlation degree. For example, the second large model is a different model from the first large model. The difference means that the two have at least different network parameters. According to actual needs, the first large model and the second large model can be trained based on the same base model. However, during training, the sample data and training objectives of the first large model and the second large model are different. Alternatively, the first large model and the second large model can also be trained based on different base models. The embodiments of this disclosure do not limit this. Alternatively, in at least one embodiment, the first large model and the second large model can be different functional parts of the same unified model. That is, the unified model has the functions of both the first large model and the second large model, thus serving as the first large model or the second large model in different scenarios.

[0125] Figure 5 The illustration shows a schematic diagram of the principle of optimized interactive guidance information according to at least one embodiment of the present disclosure.

[0126] In at least one embodiment of this disclosure, after obtaining the first information, the analyst or operator may, for example, assess the accuracy and value of the first information when processing it, and correct the first information based on the assessment results to obtain corrected information. The corrected information may, for example, serve as a reference for the first major model to perform semantic understanding and association analysis on subsequent preliminary screening information.

[0127] For example, the information processing method of this disclosure embodiment can further, after obtaining the corrected information obtained by correcting the first information, use the corrected information as the labeled data of the initial screening information to obtain sample data. Subsequently, the sample data is added to a predetermined sample library for the user to subsequently train or fine-tune the first large model, so that the first large model is trained or fine-tuned based on the sample data, making the results of semantic understanding and association analysis of the first large model more consistent with the results of manual analysis.

[0128] For example, the information processing method of this disclosure embodiment can also optimize the interactive guidance information of the first large model based on the difference between the corrected information and the first information after obtaining the corrected information, so as to guide the first large model to perform semantic understanding and association analysis on the initial screening information, so that the analysis results output by the first large model tend to be consistent with the results of manual analysis, thereby improving the accuracy of the first large model in processing information.

[0129] For example, this embodiment can directly add information representing the difference between the corrected information and the first information to the interactive guidance information, thereby optimizing the interactive guidance information.

[0130] For example, a large model can be used to analyze the differences between the corrected information and the initial information to obtain optimized information for the interactive guidance information. This optimized information is then used to further optimize the interactive guidance information. In this way, a large model can be used to analyze the corrected information and fine-tune the initial large model, enabling autonomous learning of knowledge and further reducing manual costs. For example, the information processing method of at least one embodiment of this disclosure can be implemented by a large model intelligent agent built based on a large model. This enables end-to-end information processing, autonomous learning of knowledge by the large model, and continuous optimization of the large model.

[0131] For example, such as Figure 5 As shown, in one embodiment, after the first large model 510 performs semantic understanding and association analysis on the initial screening information 511 based on the interactive guidance information 512 and obtains the first information 520, in response to obtaining the corrected information 530 obtained by correcting the first information 520, the initial screening information, the corrected information, and the first information are input into the third large model 540. The third large model 540 outputs the difference information between the analyzed corrected information and the first information, as well as the optimized information 550 generated based on the difference information for the interactive guidance information. In this embodiment, the optimized information 550 can be directly added to the interactive guidance information to achieve optimization of the interactive guidance information.

[0132] For example, in one embodiment, interactive guidance information 512, initial screening information, first information and corrected information can be input into the third large model in the form of information group. The third large model outputs the difference information between the corrected information and the first information obtained from the analysis, as well as the optimized information obtained by optimizing interactive guidance information 512 based on the difference information. In this embodiment, the optimized information can be used as the optimized interactive guidance information for subsequent processing.

[0133] For example, the information input to the third major model 540 may also include interactive guidance information corresponding to the third major model (hereinafter also referred to as second guidance information, so as to distinguish it from the interactive guidance information input to the first major model), which is used to constrain the tasks performed by the third major model 540 and the information output by the third major model 540.

[0134] In at least one embodiment of this disclosure, the first large model 510 and the third large model 540 can be two different models trained on the same base model using different sample data, so that the first large model 510 and the third large model 540 have basically the same multilingual recognition capabilities, thereby ensuring the accuracy of the difference information and optimization information output by the third large model.

[0135] Based on the information processing method provided in at least one embodiment of this disclosure, at least one embodiment of this disclosure also provides an information processing system to facilitate the implementation of the information processing method.

[0136] Figure 6 The schematic diagram illustrates the implementation principle of an information processing system according to at least one embodiment of the present disclosure.

[0137] like Figure 6 As shown, an information processing system capable of implementing at least one embodiment of the information processing method of this disclosure may include an acquisition module 610, an analysis module 620, and a discrimination module 630.

[0138] For example, the acquisition module 610 is used to expand information sources and collect information. The analysis module 620 has an embedded keyword filtering engine for initial screening of the information acquired by the acquisition module 610.

[0139] For example, the analysis module 620 can first store the information collected by the acquisition module 610, and then analyze the stored information during the initial screening process to achieve offline execution of the initial screening step. For example, the analysis module 620 can also embed an interface for calling a large model to perform semantic understanding and correlation analysis on the selected initial screening information.

[0140] For example, the discrimination module 630 can be understood as a module integrated into the large model processing flow, responsible for processing and judging multilingual information. For example, by selecting the large model's base model and setting prompt words, the large model can be equipped with the ability to perform semantic understanding and association analysis on multilingual information. After completing the prompt word setting and base model selection, the base model can be optimized first, and then the optimized large model can be used to perform semantic understanding and association analysis on the preliminary screening information selected in the offline preliminary screening step to obtain the analysis results. For example, the push design can be used to set the triggering time for distributing the analysis results, and when the triggering time is reached, the part of the obtained analysis results that represents the preliminary screening information, including the first information, is distributed to the analyst as the first information for manual analysis and correction, which is used as a reference for subsequent fine-tuning of the large model, so that the semantic understanding and association analysis capabilities of the large model can be continuously improved in specific scenarios, realizing a complete learning and optimization closed loop.

[0141] Based on the information processing method provided in at least one embodiment of this disclosure, at least one embodiment of this disclosure also provides an information processing apparatus. The following will be combined with... Figure 7 The information processing device is described in detail.

[0142] Figure 7 The schematic diagram illustrates a structural block diagram of an information processing apparatus provided in at least one embodiment of the present disclosure.

[0143] like Figure 7 As shown, the information processing apparatus 700 of this embodiment includes an information filtering module 710 and a processing module 720. For example, these units or modules can be implemented by hardware (e.g., circuit) modules or software modules, etc. The following embodiments are similar and will not be described again. For example, these units or modules can be implemented by a central processing unit (CPU), a general-purpose graphics processor (GPGPU), a graphics processing unit (GPU), a tensor processor (TPU), a field-programmable gate array (FPGA), or other forms of processing units with data processing capabilities and / or instruction execution capabilities, along with corresponding computer instructions.

[0144] The information filtering module 710 is configured to filter multiple pieces of information, filtering out noise information that is irrelevant to the first type from the multiple pieces of information, and obtaining preliminary screening information. For example, the information filtering module 710 can be configured to execute step S210 described above. The specific implementation principle can be referred to the relevant description of step S210, and will not be repeated here.

[0145] Processing module 720 is configured to use a first large model to perform semantic understanding and association analysis with the first type on the initial screening information, obtain analysis results, and obtain the first information of the first type included in multiple pieces of information. For example, the analysis results characterize whether the initial screening information includes the first information. For example, if multiple pieces of information include content in multiple languages, the analysis results are represented by the first language among the multiple languages. Exemplarily, processing module 720 can be configured to execute step S220 described above, and its specific implementation principle can be referred to the relevant description of step S220, which will not be repeated here.

[0146] In at least one embodiment of this disclosure, the information processing apparatus 700 may further include a source determination module configured to, in response to a second information relating to a source being included in a plurality of information, determine a new source based on the second information and provide the new source for collecting new information for processing.

[0147] In at least one embodiment of this disclosure, the information source determination module may include a discrimination submodule and a determination submodule. The discrimination submodule is configured to determine whether there is a correlation between the second information and the first type. The determination submodule is configured to determine, in response to a correlation between the second information and the first type, that the information source involved in the second information is a new information source.

[0148] In at least one embodiment of this disclosure, the discrimination submodule is specifically configured to: use a second large model to analyze the correlation between the second information and the first type to perform the above discrimination.

[0149] In at least one embodiment of this disclosure, the multiple pieces of information include content in multiple languages; the analysis results are represented in the first language among the multiple languages.

[0150] In at least one embodiment of this disclosure, the information filtering module 710 may include a conversion submodule and a processing submodule. The conversion submodule is configured to use a translation model to convert the initially screened information into third information represented in a first language. The processing submodule is configured to input the third information into a first large model for semantic understanding and association analysis to obtain analysis results.

[0151] In at least one embodiment of this disclosure, the information filtering module 710 can be configured to: filter information that matches the keywords in the keyword library from multiple pieces of information based on a keyword library for the first type, to obtain preliminary screening information, wherein the keyword library includes keywords in multiple languages.

[0152] In at least one embodiment of this disclosure, the analysis results include first information represented in a structured form. The information processing apparatus 700 may further include an information distribution module configured to distribute the first information represented in a structured form to determine the risk conveyed by the first information based on the first information.

[0153] In at least one embodiment of this disclosure, the processing module 720 is specifically configured to perform semantic understanding and association analysis with a first type on the initial screening information based on interactive guidance information, thereby obtaining analysis results. The interactive guidance information includes at least a first guidance instruction representing the workflow of semantic understanding and association analysis.

[0154] In at least one embodiment of this disclosure, the interactive guidance information further includes at least one of the following: a second guidance instruction indicating the output format of the analysis results; a third guidance instruction indicating the role played by the first large model; a fourth guidance instruction indicating the goal of semantic understanding and association analysis; a fifth guidance instruction indicating the skills possessed by the first large model; a sixth guidance instruction indicating the constraints of semantic understanding and association analysis; and a seventh guidance instruction indicating examples of semantic understanding and association analysis.

[0155] In at least one embodiment of this disclosure, the information processing apparatus 700 may further include an optimization module configured to optimize interactive guidance information based on the difference between the corrected information and the first information in response to obtaining corrected information obtained by correcting the first information.

[0156] In at least one embodiment of this disclosure, the optimization module may include an optimization information acquisition submodule and an optimization submodule. The optimization information acquisition submodule is configured to analyze the difference between the corrected information and the first information using a third major model to obtain optimization information for the interactive guidance information. The optimization submodule is configured to optimize the interactive guidance information based on the optimization information.

[0157] In at least one embodiment of this disclosure, the analysis results also characterize at least one of the following: the basis for determining whether the initial screening information includes information of the first type; the subtype among the multiple subtypes included in the first type that matches the initial screening information; the scenario that matches the initial screening information; and risk control recommendations for the initial screening information. It should be noted that, for clarity and conciseness, this disclosure does not provide all the constituent units of the information processing device 700. To achieve the necessary functions of the information processing device, those skilled in the art can provide and set other constituent units (not shown) according to specific needs, and this disclosure does not limit this.

[0158] At least one embodiment of this disclosure also provides an electronic device, including: a processing device (e.g., a processor); a storage device (e.g., a memory), including one or more computer program modules; wherein the one or more computer program modules are stored in the storage device and configured to be executed by the processing device, and the one or more computer program modules are used to implement the information processing method provided in any embodiment of this disclosure.

[0159] For example, the processing device may be a central processing unit (CPU), digital signal processor (DSP), image processor (GPU), general-purpose graphics processor (GPGPU), or other form of processing unit with data processing capabilities and / or instruction execution capabilities. It may be a general-purpose processor or a dedicated processor and may control other components in the electronic device to perform the desired functions.

[0160] For example, the storage device may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, which a processing device may execute to implement the functions (implemented by the processing device) in the embodiments of this disclosure and / or other desired functions, such as information processing methods. Various application programs and various data may also be stored in the computer-readable storage medium, such as collected information, obtained preliminary screening information, and determined first information.

[0161] The following is for reference. Figure 8 This illustration shows a structural diagram of an electronic device (e.g., a terminal device or a server) 800 suitable for implementing embodiments of the present disclosure. The terminal device in the embodiments of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 8 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0162] like Figure 8 As shown, the electronic device 800 may include a processing device (e.g., a central processing unit, a graphics processor, etc.) 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage device 808 into a random access memory (RAM) 803. The RAM 803 also stores various programs and data required for the operation of the electronic device 800. The processing device 801, ROM 802, and RAM 803 are interconnected via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0163] Typically, the following devices can be connected to I / O interface 805: input devices 806 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 807 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 808 including, for example, magnetic tapes, hard disks, etc.; and communication devices 809. Communication device 809 allows electronic device 800 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 8 An electronic device 800 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0164] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 809, or installed from a storage device 808, or installed from a ROM 802. When the computer program is executed by a processing device 801, it performs the functions defined in the methods of embodiments of this disclosure.

[0165] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0166] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol) and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and end-to-end networks (e.g., ad hoc end-to-end networks), as well as any currently known or future-developed networks.

[0167] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0168] The aforementioned computer-readable medium carries one or more programs. When the aforementioned one or more programs are executed by the electronic device, the electronic device causes the electronic device to: filter multiple pieces of information, filter out noise information that is not related to the first type from the multiple pieces of information, and obtain preliminary screening information; and use a first large model to perform semantic understanding and association analysis with the first type on the preliminary screening information, obtain analysis results, and obtain first information of the first type included in the multiple pieces of information, wherein the analysis results characterize whether the preliminary screening information includes the first information.

[0169] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including but not limited to object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0170] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0171] The units or modules described in the embodiments of this disclosure can be implemented in software or hardware. The names of the units or modules do not necessarily constitute a limitation on the unit or module itself.

[0172] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0173] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0174] According to one or more embodiments of this disclosure, Example 1 provides an information processing method, including:

[0175] Multiple pieces of information are filtered to remove noise information that is irrelevant to the first type, resulting in preliminary screening information; and

[0176] The first major model is used to perform semantic understanding and association analysis with the first type on the initial screening information to obtain analysis results, thereby obtaining the first information of the first type included in the multiple pieces of information. The analysis results characterize whether the initial screening information includes the first information.

[0177] The multiple pieces of information include content in multiple languages, and the analysis result is represented by the first language among the multiple languages.

[0178] According to one or more embodiments of this disclosure, Example 2 provides the method of Example 1, further comprising:

[0179] In response to the inclusion of second information involving a source among the multiple pieces of information, a new source is determined based on the second information, and the new source is provided for collecting new information for processing.

[0180] According to one or more embodiments of this disclosure, Example 3 provides the method of determining a new information source based on the second information as in Example 2, including:

[0181] Determine whether the second information is related to the first type; and

[0182] In response to the correlation between the second information and the first type, the information source involved in the second information is determined to be the newly added information source.

[0183] According to one or more embodiments of this disclosure, Example 4 provides the method in Example 3 for determining whether the second information is related to the first type, including:

[0184] The second major model is used to analyze the correlation between the second information and the first type in order to make the discrimination.

[0185] According to one or more embodiments of this disclosure, Example 5 provides the semantic understanding and association analysis with the first type of information using the first large model as in Example 1, to obtain analysis results, including:

[0186] The initial screening information is converted into third information represented in the first language using a translation model; and

[0187] The third information is input into the first large model to perform the semantic understanding and the association analysis, and the analysis results are obtained.

[0188] According to one or more embodiments of this disclosure, Example Six provides the filtering of multiple pieces of information as described in Example One, filtering out noise information unrelated to the first type from the multiple pieces of information to obtain preliminary screening information, including:

[0189] Based on the keyword lexicon for the first type, information matching the keywords in the keyword lexicon is filtered from the multiple pieces of information to obtain the initial screening information.

[0190] The keyword database includes keywords from the multiple languages.

[0191] According to one or more embodiments of this disclosure, Example 7 provides the analysis results of Example 1 including the first information represented in a structured form;

[0192] The information processing method in Example 1 further includes: distributing the first information in a structured form to determine the risk conveyed by the first information based on the first information.

[0193] According to one or more embodiments of this disclosure, Example 8 provides a semantic understanding of the initial screening information and an association analysis with the first type using a first large model, obtained by any of Examples 1 to 7, to obtain analysis results, including:

[0194] Based on the interactive guidance information, the first large model is used to perform semantic understanding and association analysis with the first type on the initial screening information to obtain the analysis results.

[0195] The interactive guidance information includes at least a first guidance instruction representing the workflow of the semantic understanding and the association analysis.

[0196] According to one or more embodiments of this disclosure, Example Nine provides the interactive guidance information in Example Eight, which further includes at least one of the following:

[0197] A second guiding instruction indicating the output format of the analysis results;

[0198] The third guiding instruction indicates the role played by the first large model;

[0199] A fourth guiding instruction indicating the objectives of the semantic understanding and the association analysis;

[0200] The fifth guiding instruction indicates the skills possessed by the first major model;

[0201] A sixth guiding instruction representing the constraints of the semantic understanding and the association analysis; and

[0202] The seventh guiding instruction represents an example of the semantic understanding and the association analysis.

[0203] According to one or more embodiments of this disclosure, Example 10 provides that the information processing method in Example 8 further includes:

[0204] In response to obtaining the corrected information obtained by correcting the first information, the interactive guidance information is optimized based on the difference between the corrected information and the first information.

[0205] According to one or more embodiments of this disclosure, Example 11 provides optimization of the interactive guidance information based on the difference between the corrected information and the first information, as in Example 10, including:

[0206] The third major model is used to analyze the difference between the corrected information and the first information to obtain optimized information for the interactive guidance information; and

[0207] The interactive guidance information is optimized based on the optimization information.

[0208] According to one or more embodiments of this disclosure, Example Twelve provides that the analysis results of any one of Examples One through Seven also characterize at least one of the following:

[0209] The basis for determining whether the initial screening information includes the first type of information;

[0210] The first type includes a subtype that matches the initial screening information from among multiple subtypes;

[0211] Scenarios that match the initial screening information;

[0212] Risk control recommendations based on the aforementioned initial screening information.

[0213] According to one or more embodiments of this disclosure, Example Thirteen provides an information processing apparatus, including:

[0214] The information filtering module is configured to: filter multiple pieces of information, filtering out noise information that is irrelevant to the first type from the multiple pieces of information to obtain preliminary screening information; and

[0215] The processing module is configured to: perform semantic understanding and association analysis with the first type on the initial screening information using a first large model, obtain analysis results, and obtain first information of the first type included in the multiple pieces of information; wherein, the analysis results characterize whether the first information includes the first information.

[0216] The multiple pieces of information include content in multiple languages, and the analysis result is represented by the first language among the multiple languages.

[0217] According to one or more embodiments of this disclosure, Example Fourteen provides an electronic device, including:

[0218] Processing device; and

[0219] Storage device, including one or more computer program instructions;

[0220] The one or more computer program instructions are executed by the processing device to perform the information processing method provided in at least one embodiment of the present disclosure.

[0221] According to one or more embodiments of the present disclosure, Example Fifteen provides a computer-readable storage medium that non-transitory stores computer-readable instructions, wherein the computer-readable instructions, when executed by a processor, implement the information processing method provided in at least one embodiment of the present disclosure.

[0222] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0223] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. In certain environments, multitasking and parallel processing may be advantageous. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0224] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative examples of implementing the claims.

Claims

1. An information processing method, comprising: Multiple pieces of information are filtered based on predetermined rules to remove noise information unrelated to the first type, resulting in preliminary screening information. The predetermined rules are determined according to the first type, and the preliminary screening information has the potential to extract information of the first type. The first major model is used to perform semantic understanding and association analysis with the first type on the initial screening information to obtain analysis results, thereby obtaining the first information of the first type included in the multiple pieces of information. The analysis results characterize whether the initial screening information includes the first information. The multiple pieces of information include content in multiple languages, and the analysis result is represented by the first language among the multiple languages.

2. The information processing method according to claim 1 further includes: In response to the inclusion of second information involving a source among the multiple pieces of information, a new source is determined based on the second information, and the new source is provided for collecting new information for processing.

3. The information processing method according to claim 2, wherein, Based on the second information, new information sources are identified, including: Determine whether the first information is related to the first type; and In response to the correlation between the first information and the first type, the information source involved in the first information is determined to be the newly added information source.

4. The information processing method according to claim 3, wherein, Determining whether the first information is related to the first type includes: The second major model is used to analyze the correlation between the first information and the first type in order to make the discrimination.

5. The information processing method according to claim 1, wherein, The first major model is used to perform semantic understanding and association analysis with the first type on the initial screening information to obtain analysis results, including: The initial screening information is converted into third information represented in the first language using a translation model; and The third information is input into the first large model to perform the semantic understanding and the association analysis, and the analysis results are obtained.

6. The information processing method according to claim 1, wherein, The step of filtering multiple pieces of information, filtering out noise information that is irrelevant to the first type from the multiple pieces of information, to obtain preliminary screening information includes: Based on the keyword lexicon for the first type, information matching the keywords in the keyword lexicon is filtered from the multiple pieces of information to obtain the initial screening information. The keyword database includes keywords from the multiple languages.

7. The information processing method according to claim 1, wherein, The analysis results include the first information represented in a structured form; The information processing method further includes: Distribute the first information in a structured form to determine the risk conveyed by the first information based on the first information.

8. The information processing method according to any one of claims 1 to 7, wherein, The first major model is used to perform semantic understanding and association analysis with the first type on the initial screening information to obtain analysis results, including: Based on the interactive guidance information, the first large model is used to perform semantic understanding and association analysis with the first type on the initial screening information to obtain the analysis results. The interactive guidance information includes at least a first guidance instruction representing the workflow of the semantic understanding and the association analysis.

9. The information processing method according to claim 8, wherein, The interactive guidance information also includes at least one of the following: A second guiding instruction indicating the output format of the analysis results; The third guiding instruction indicates the role played by the first large model; A fourth guiding instruction indicating the objectives of the semantic understanding and the association analysis; The fifth guiding instruction indicates the skills possessed by the first major model; The sixth guiding instruction represents the constraints of the semantic understanding and the association analysis; as well as The seventh guiding instruction represents an example of the semantic understanding and the association analysis.

10. The information processing method according to claim 8, further comprising: In response to obtaining corrected information obtained by correcting the first information, the interactive guidance information is optimized based on the difference between the corrected information and the first information.

11. The information processing method according to claim 10, wherein, Optimizing the interactive guidance information based on the difference between the corrected information and the first information includes: The third major model is used to analyze the difference between the corrected information and the first information to obtain optimized information for the interactive guidance information; and The interactive guidance information is optimized based on the optimization information.

12. The information processing method according to any one of claims 1 to 7, wherein, The analytical results also characterize at least one of the following: The basis for determining whether the initial screening information includes the first type of information; The first type includes a subtype that matches the initial screening information from among multiple subtypes; Scenarios that match the initial screening information; Risk control recommendations based on the aforementioned initial screening information.

13. An information processing apparatus, comprising: The information filtering module is configured to: filter multiple pieces of information based on predetermined rules, filtering out noise information unrelated to a first type from the multiple pieces of information to obtain preliminary screening information, wherein the predetermined rules are determined according to the first type, and the preliminary screening information has the possibility of extracting information of the first type; and The processing module is configured to: perform semantic understanding and association analysis with the first type on the initial screening information using a first large model, obtain analysis results, and obtain first information of the first type included in the multiple pieces of information; wherein, the analysis results characterize whether the initial screening information includes the first information. The multiple pieces of information include content in multiple languages, and the analysis result is represented by the first language among the multiple languages.

14. An electronic device comprising: Processing device; as well as Storage device, including one or more computer program instructions; The one or more computer program instructions are executed by the processing device according to any one of claims 1 to 12.

15. A computer-readable storage medium for non-transitory storage of computer-readable instructions, wherein, The method described in any one of claims 1 to 12 is implemented when the computer-readable instructions are executed by a processor.

Images