College network security evaluation method and device

Abstract

The application provides a high school network security evaluation method and device, relates to the technical field of network security, and solves the technical problem that the prior art cannot meet the needs of high schools for network security management and prevention and control. The method comprises the following steps: collecting multi-modal data of various network platforms of a high school; wherein the network platforms comprise an official website, a social media platform, an online learning platform and a campus forum; the multi-modal data comprises text data, image data and video data; performing multi-dimensional analysis on the multi-modal data, outputting multi-modal feature data, inputting the multi-modal feature data into an evaluation model, and outputting an evaluation result; the evaluation model is a model constructed based on a machine learning algorithm, and the network parameters and feature fusion weights of the evaluation model are dynamically adjusted through a reinforcement learning mechanism with the prediction deviation of the real-time collected data and evaluation correction information. The application is used in the network security evaluation process.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to a method and apparatus for assessing cybersecurity in universities. Background Technology

[0002] With the rapid development of internet technology, the network environment in universities is becoming increasingly diversified and complex. As a frontier for knowledge dissemination and intellectual exchange, university network security assessment faces new challenges and opportunities.

[0003] Currently, most cybersecurity assessment technologies in universities are based on text data collection and analysis, using assessment models with fixed parameters and weights to make security judgments. However, as network content expands from simple text to multimedia formats such as images and videos, and as the network environment becomes more dynamic, higher demands are placed on assessment methods in terms of data coverage, analytical dimensions, and model adaptability. Existing assessment methods are insufficient to meet the needs of universities for cybersecurity management and prevention. Summary of the Invention

[0004] This application provides a method and apparatus for assessing cybersecurity in universities, which solves the technical problem that existing technologies cannot meet the needs of universities for cybersecurity management and control.

[0005] To achieve the above objectives, this application adopts the following technical solution:

[0006] Firstly, a method for assessing cybersecurity in universities is provided, comprising: collecting multimodal data from various university network platforms; wherein the network platforms include official websites, social media platforms, online learning platforms, and campus forums; the multimodal data includes text data, image data, and video data; performing multidimensional analysis on the multimodal data to output multimodal feature data, wherein the multimodal feature data includes text features, image features, and video features; text features are extracted from text data using natural language processing technology; image features are extracted from image data using deep learning image recognition technology; video features are extracted from video data using speech recognition and image sequence analysis technology; inputting the multimodal feature data into an assessment model to output assessment results; the assessment model is a model built based on machine learning algorithms, and the network parameters and feature fusion weights of the assessment model are dynamically adjusted through a reinforcement learning mechanism based on the prediction bias and assessment correction information of the real-time collected data.

[0007] Based on the above technical solution, this application can collect multimodal data from various network platforms in universities and perform multi-dimensional analysis on the multimodal data, outputting multimodal feature data such as text features, image features, and video features. Then, the multimodal feature data can be input into an evaluation model to output evaluation results. This evaluation model is built based on machine learning algorithms, and the network parameters and feature fusion weights of the evaluation model are dynamically adjusted through a reinforcement learning mechanism based on the prediction bias and evaluation correction information of the real-time collected data. In this way, this application can comprehensively, accurately, and promptly evaluate the network security status of universities by collecting multimodal data, performing multi-dimensional analysis, and then using an evaluation model with dynamic adjustment capabilities to output evaluation results, thereby meeting the needs of universities for network security management and prevention.

[0008] In conjunction with the first aspect mentioned above, in one possible implementation, the evaluation model includes a feature input layer, a feature fusion layer, a classification evaluation layer, and a dynamic adjustment layer. The feature input layer receives multimodal feature data. The feature fusion layer includes a convolutional neural network layer, a recurrent neural network layer, and a normalization layer. The convolutional neural network layer extracts spatial features from keyframe features in image and video features, while the recurrent neural network layer extracts temporal features from text features and text features converted from image and video data based on self-attention weights. The normalization layer performs dimensional unification and normalization processing on the features output by the convolutional neural network layer and the recurrent neural network layer based on normalization coefficients to generate fused features. The classification evaluation layer performs feature mapping classification on the fused features and outputs evaluation results. The evaluation results include security risk level, risk type, and risk confidence. The dynamic adjustment layer uses a reinforcement learning mechanism, taking prediction bias and evaluation correction information as reward signals, to adjust the network parameters of the classification evaluation layer, the self-attention weights of the feature fusion layer, and the normalization coefficients.

[0009] In conjunction with the first aspect mentioned above, in one possible implementation, the dynamic adjustment layer is specifically used to: generate a deviation dataset based on the deviation data between the evaluation results output by the evaluation model in real time and the prediction of actual security events, and use the correction opinions of the received evaluation results as evaluation correction information; calculate the reward value using the deviation value of the deviation dataset and the correction weight of the evaluation correction information as the reward signal for reinforcement learning; adjust the network parameters of the classification evaluation layer according to the reward value through the gradient descent algorithm, and update the self-attention weights and standardization coefficients of the feature fusion layer at the same time.

[0010] In conjunction with the first aspect mentioned above, in one possible implementation, the evaluation model is trained as follows: a training dataset is constructed based on historical multimodal feature data and labeled evaluation results. The labeled information of the evaluation results includes risk level labels, risk type labels, and risk impact range labels. The deviation between the predicted results and the labeled results is calculated using a cross-entropy loss function through supervised learning, and the model parameters of the evaluation model are optimized using a backpropagation algorithm. Adversarial examples are generated by adding directional perturbation data to the historical multimodal feature data through a generator of a generative adversarial network. The adversarial examples are mixed with the historical multimodal feature data in a preset ratio to form an enhanced training set. The loss function is recalculated and the model parameters are updated based on the enhanced training set.

[0011] In conjunction with the first aspect mentioned above, in one possible implementation, the method includes: for text data, using topic modeling to extract core topic features, using named entity recognition to extract key subject features, and using semantic understanding and knowledge graph technology to extract relational features, thereby generating text features; for image data, using scene analysis to extract dissemination scene features, using human action recognition to extract behavioral tendency features, and using image description generation technology to convert images into text, thereby generating image features; for video data, using keyframes of video data to extract image features identical to those of image data, and using audio to convert to text, thereby generating video features.

[0012] In conjunction with the first aspect mentioned above, in one possible implementation, topic modeling analysis employs the Linear Discriminant Analysis (LDA) algorithm, which extracts latent topic features from text data by constructing a three-layer probabilistic model of words, topics, and documents; knowledge graph technology constructs a domain entity relation library based on a pre-trained language model, which is used for reasoning and analysis of entity relationship features in text data.

[0013] In conjunction with the first aspect mentioned above, in one possible implementation, the method further includes: generating a dynamic display interface based on the evaluation results; wherein the dynamic display interface includes a dynamic dashboard, a risk distribution heatmap, and a risk evolution trend curve; the dynamic dashboard is used to present a real-time risk index, the risk distribution heatmap is used to display the distribution of risk areas, and the risk evolution trend curve is used to reflect the pattern of risk changes.

[0014] In conjunction with the first aspect mentioned above, in one possible implementation, the method further includes: preprocessing the multimodal data; wherein, the preprocessing operations for text data include word segmentation, part-of-speech tagging, stop word removal, and word vector generation; the preprocessing operations for image data include grayscale conversion, noise reduction, normalization, and feature extraction; and the preprocessing operations for video data include keyframe extraction, audio separation, and conversion to text processing, and the converted text is subjected to the same preprocessing operations as the text data.

[0015] Secondly, a network security assessment device for universities is provided, comprising: a communication unit and a processing unit; the communication unit is used to collect multimodal data from various network platforms of universities; wherein the network platforms include official websites, social media platforms, online learning platforms, and campus forums; the multimodal data includes text data, image data, and video data; the processing unit is used to perform multi-dimensional analysis on the multimodal data and output multimodal feature data, wherein the multimodal feature data includes text features, image features, and video features; the text features are obtained by analyzing and extracting text data based on natural language processing technology; the image features are obtained by analyzing and extracting image data based on deep learning image recognition technology; the video features are obtained by analyzing and extracting video data based on speech recognition and image sequence analysis technology; the processing unit is used to input the multimodal feature data into an assessment model and output assessment results; the assessment model is a model built based on machine learning algorithms, and the network parameters and feature fusion weights of the assessment model are dynamically adjusted through a reinforcement learning mechanism based on the prediction bias and assessment correction information of the real-time collected data.

[0016] In conjunction with the second aspect mentioned above, in one possible implementation, the evaluation model includes a feature input layer, a feature fusion layer, a classification evaluation layer, and a dynamic adjustment layer. The feature input layer receives multimodal feature data. The feature fusion layer includes a convolutional neural network layer, a recurrent neural network layer, and a normalization layer. The convolutional neural network layer extracts spatial features from keyframe features in image and video features, while the recurrent neural network layer extracts temporal features from text features and text features converted from image and video data based on self-attention weights. The normalization layer performs dimensional unification and normalization processing on the features output by the convolutional neural network layer and the recurrent neural network layer based on normalization coefficients to generate fused features. The classification evaluation layer performs feature mapping classification on the fused features and outputs evaluation results. The evaluation results include security risk level, risk type, and risk confidence. The dynamic adjustment layer uses a reinforcement learning mechanism, taking prediction bias and evaluation correction information as reward signals, to adjust the network parameters of the classification evaluation layer, the self-attention weights of the feature fusion layer, and the normalization coefficients.

[0017] In conjunction with the second aspect above, in one possible implementation, the dynamic adjustment layer is specifically used to: generate a deviation dataset based on the deviation data between the evaluation results output by the evaluation model in real time and the prediction of actual security events, and use the correction opinions of the received evaluation results as evaluation correction information; calculate the reward value using the deviation value of the deviation dataset and the correction weight of the evaluation correction information as the reward signal for reinforcement learning; adjust the network parameters of the classification evaluation layer according to the reward value through the gradient descent algorithm, and update the self-attention weights and standardization coefficients of the feature fusion layer at the same time.

[0018] In conjunction with the second aspect mentioned above, in one possible implementation, the evaluation model is trained as follows: a training dataset is constructed based on historical multimodal feature data and labeled evaluation results. The labeled information of the evaluation results includes risk level labels, risk type labels, and risk impact range labels. The deviation between the predicted results and the labeled results is calculated using a cross-entropy loss function through supervised learning, and the model parameters of the evaluation model are optimized using a backpropagation algorithm. Adversarial examples are generated by adding directional perturbation data to the historical multimodal feature data through a generator of a generative adversarial network. The adversarial examples are mixed with the historical multimodal feature data in a preset ratio to form an enhanced training set. The loss function is recalculated and the model parameters are updated based on the enhanced training set.

[0019] In conjunction with the second aspect above, in one possible implementation, the processing unit is used to: for text data, extract core topic features using topic modeling analysis, extract key subject features using named entity recognition, and extract relational features based on semantic understanding and knowledge graph technology, thereby generating text features; for image data, extract dissemination scene features through scene analysis, extract behavioral tendency features based on human action recognition, and convert images into text using image description generation technology, thereby generating image features; for video data, extract the same image features as the image data from keyframes of the video data, and convert audio into text, thereby generating video features.

[0020] In conjunction with the second aspect mentioned above, in one possible implementation, topic modeling analysis employs the Linear Discriminant Analysis (LDA) algorithm, which extracts latent topic features from text data by constructing a three-layer probabilistic model of words, topics, and documents; knowledge graph technology constructs a domain entity relation library based on a pre-trained language model, which is used for reasoning and analysis of entity relationship features in text data.

[0021] In conjunction with the second aspect above, in one possible implementation, the processing unit is used to: generate a dynamic display interface based on the evaluation results; wherein the dynamic display interface includes a dynamic dashboard, a risk distribution heatmap, and a risk evolution trend curve; the dynamic dashboard is used to present a real-time risk index, the risk distribution heatmap is used to display the distribution of risk areas, and the risk evolution trend curve is used to reflect the pattern of risk changes.

[0022] In conjunction with the second aspect above, in one possible implementation, the processing unit is used to: perform preprocessing operations on multimodal data; wherein, the preprocessing operations for text data include word segmentation, part-of-speech tagging, stop word removal, and word vector generation; the preprocessing operations for image data include grayscale conversion, noise reduction, normalization, and feature extraction; and the preprocessing operations for video data include keyframe extraction, audio separation, and conversion to text processing, and the converted text is subjected to the same preprocessing operations as the text data.

[0023] Thirdly, this application provides a university network security assessment device, comprising: a processor and a storage medium; the storage medium includes instructions, and the processor is used to execute the instructions to implement the method described in any of the above embodiments. This university network security assessment device can be an electronic device or a chip within an electronic device.

[0024] Fourthly, this application provides a computer-readable storage medium storing instructions that, when executed on a university network security assessment device, cause the university network security assessment device to perform the methods described in any of the above embodiments.

[0025] Fifthly, this application provides a computer program product containing instructions that, when run on a university network security assessment device, causes the university network security assessment device to perform the method described in any of the above embodiments.

[0026] It should be understood that the descriptions of technical features, technical solutions, beneficial effects, or similar language in this application do not imply that all features and advantages can be achieved in any single embodiment. Rather, it is understood that the description of a feature or beneficial effect means that a specific technical feature, technical solution, or beneficial effect is included in at least one embodiment. Therefore, the descriptions of technical features, technical solutions, or beneficial effects in this specification do not necessarily refer to the same embodiment. Furthermore, the technical features, technical solutions, and beneficial effects described in this embodiment can be combined in any suitable manner. Those skilled in the art will understand that embodiments can be implemented without one or more specific technical features, technical solutions, or beneficial effects of a particular embodiment. In other embodiments, additional technical features and beneficial effects may be identified in specific embodiments that do not embody all embodiments. Attached Figure Description

[0027] Figure 1 A system architecture diagram of a university network security assessment system provided in this application embodiment;

[0028] Figure 2 A flowchart illustrating a university network security assessment method provided in this application embodiment;

[0029] Figure 3 A flowchart illustrating an evaluation model training method provided in an embodiment of this application;

[0030] Figure 4 A flowchart illustrating another university network security assessment method provided in this application embodiment;

[0031] Figure 5 A flowchart illustrating another university network security assessment method provided in this application embodiment;

[0032] Figure 6 This is a schematic diagram of the structure of a university network security assessment device provided in an embodiment of this application;

[0033] Figure 7 This is a schematic diagram of the hardware structure of a university network security assessment device provided in an embodiment of this application. Detailed Implementation

[0034] In the description of this application, unless otherwise stated, " / " means "or," for example, A / B can mean A or B. The "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone. Furthermore, "at least one" means one or more, and "multiple" means two or more. The terms "first," "second," etc., do not limit the quantity or order of execution, and "first," "second," etc., do not necessarily imply differences.

[0035] It should be noted that, in this application, the terms "exemplary" or "for example" are used to indicate that something is being described as an example, illustration, or illustration. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design solutions. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0036] With the rapid development of internet technology, the online environment in universities has become increasingly complex and diverse. As important venues for knowledge dissemination and intellectual exchange, universities face particularly critical issues regarding cybersecurity. The internet is flooded with all sorts of information, including some content that contradicts mainstream values, which may negatively impact the values ​​of university students.

[0037] Currently, the assessment of cybersecurity in universities faces the following main problems. First, most existing assessment methods rely on manual sampling of network content. This approach is not only inefficient but also fails to comprehensively cover the massive amount of information on university network platforms. University network platforms include multiple channels such as official websites, social media accounts, online learning platforms, and forums. Manual sampling cannot obtain comprehensive data in a timely manner, resulting in many potential security risks going undetected.

[0038] Secondly, existing assessment techniques often focus only on the analysis of textual content, neglecting multimedia information such as images and videos. However, in today's online environment, the influence of information conveyed by images and videos cannot be underestimated. Some people may use images and videos to spread harmful ideas, and relying solely on textual analysis is insufficient for a comprehensive assessment of university network security.

[0039] Furthermore, current assessment devices lack intelligence and dynamic adjustment capabilities. University network environments are constantly changing, with new network applications and information dissemination methods emerging continuously. Existing assessment devices often employ fixed assessment indicators and models, failing to automatically adjust assessment strategies based on real-time network data and emerging risk factors, resulting in poor accuracy and timeliness of assessment results.

[0040] In conclusion, existing methods and devices for assessing cybersecurity in universities have many shortcomings and cannot meet the urgent needs of universities for cybersecurity management and prevention. There is an urgent need for a more scientific, comprehensive, and intelligent assessment method and device to solve these problems.

[0041] In view of this, this application provides a method for assessing cybersecurity in universities. First, it collects multimodal data from various network platforms within the university and performs multi-dimensional analysis on this data, outputting multimodal feature data such as text features, image features, and video features. Then, this multimodal feature data is input into an assessment model, which outputs assessment results. This assessment model is built based on machine learning algorithms, and its network parameters and feature fusion weights are dynamically adjusted using a reinforcement learning mechanism, taking into account prediction biases and assessment correction information from real-time data collection. In this way, this application can comprehensively, accurately, and promptly assess the cybersecurity status of universities by collecting multimodal data, performing multi-dimensional analysis, and then using a dynamically adjustable assessment model to output assessment results, thereby meeting the needs of universities for cybersecurity management and prevention.

[0042] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0043] The university network security assessment method provided in this application embodiment can be applied to, for example, Figure 1 In the university network security assessment system shown, such as Figure 1 As shown, the university's network security assessment system includes: a data acquisition module 101, a data analysis and processing module 102, and an assessment result display module 103.

[0044] The data acquisition module 101 can be distributed across key nodes of the university network, such as the core campus network switch and various network platform servers. This module employs a combination of intelligent web crawling technology and platform-specific application programming interfaces (APIs) for data collection, tailored to different types of network platforms. For official university websites and forums, the intelligent crawler can adaptively learn changes in webpage structure and accurately capture various types of text, images, and other data. On social media platforms, API calls are used to obtain information such as updates and comments posted by faculty and students. Simultaneously, a distributed acquisition architecture enables multi-threaded concurrent acquisition, improving data collection efficiency and ensuring comprehensive coverage of various data sources within the university network.

[0045] The data analysis and processing module 102 adopts a heterogeneous computing architecture to accelerate data processing and analysis. Through improved word vector fusion technology, the module combines traditional word vector models with attention-based word vector representations, resulting in richer and more accurate semantic expression of text data. For image and video data, a lightweight convolutional neural network is used for feature extraction, reducing computational resource consumption while ensuring effective feature extraction.

[0046] The assessment results display module 103 is connected to the data analysis and processing module 102 via the campus intranet, supporting the display of assessment results on various terminal devices (such as computers, tablets, and mobile phones). The display interface utilizes data visualization technology to present the overall situation of university network security, the risk level of each platform, and risk trend predictions in intuitive charts and graphs. It also provides interactive functions, allowing administrators to view detailed data through clicks and filtering, facilitating targeted analysis.

[0047] It should be noted that the various embodiments of this application can be referenced or learned from each other. For example, the same or similar steps, method embodiments, system embodiments and device embodiments can be referenced from each other without limitation.

[0048] Figure 2 A flowchart illustrating a university network security assessment method provided in this application embodiment. Figure 2 As shown, the method includes the following steps:

[0049] Step 201: Collect multimodal data from various online platforms of universities.

[0050] The network platforms include official websites, social media platforms, online learning platforms, and campus forums, while the multimodal data includes text data, image data, and video data.

[0051] Text data can include news announcements on the official website, comments from teachers and students on social media platforms, course materials and discussions on online learning platforms, posts and replies on campus forums, etc.; image data can include promotional images published on various platforms, and photos of students' daily lives, etc.; video data can include promotional videos released by the campus, online course videos, and short videos uploaded by students, etc.

[0052] In some implementation methods, when collecting text data, web crawling technology can be used to crawl official websites according to set rules; official API interfaces can be used for social media platforms; system integration can be used for online learning platforms; and web crawling can be used to collect data according to page structure for campus forums. When collecting image and video data, web crawling technology, API interfaces, and system integration are also combined, and the data usage agreements and relevant laws and regulations of each platform are strictly followed during the collection process.

[0053] It should be noted that using multiple channels and methods to collect multimodal data can ensure the comprehensiveness and richness of data sources, providing a reliable data foundation for subsequent accurate assessment.

[0054] For example, when collecting text data from a university's official website, a web crawler can periodically scrape text content from sections such as "News," "Announcements," and "Policy Documents" according to the website's directory structure; when collecting image data from social media platforms, the crawler can obtain the images published by the university on the social media platforms through the platform's API interface.

[0055] Step 202: Perform multi-dimensional analysis on the multimodal data and output multimodal feature data.

[0056] The multimodal feature data includes text features, image features, and video features. Text features are extracted from text data using natural language processing techniques, image features are extracted from image data using deep learning-based image recognition techniques, and video features are extracted from video data using speech recognition and image sequence analysis techniques.

[0057] Natural language processing technologies include word segmentation, part-of-speech tagging, sentiment analysis, topic modeling, and named entity recognition; deep learning image recognition technologies can use models such as convolutional neural networks; speech recognition technologies can convert audio in videos into text; and image sequence analysis technologies can analyze keyframes in videos.

[0058] In one possible implementation, the application may preprocess the multimodal data before performing multidimensional analysis.

[0059] Among them, the preprocessing operations for text data include word segmentation,词性标注, stop word removal, and word vector generation. The preprocessing operations for image data include grayscale conversion, noise reduction, normalization, and feature extraction. The preprocessing operations for video data include key frame extraction, audio separation, and conversion to text processing, and the same preprocessing operations as those for text data are performed on the converted text.

[0060] Exemplarily, word segmentation is to split the text into individual words or terms.词性标注is to label the词性of each word, such as noun, verb, etc. Stop word removal is to delete the words in the text that have no actual meaning, such as "的", "在", etc. Word vector generation is to convert words into numerical vectors for computer processing. Grayscale conversion is to convert a color image into a black-and-white image to reduce the data volume. Noise reduction is to remove the noise in the image, such as Gaussian noise, salt-and-pepper noise, etc. Normalization is to adjust the size and pixel values of the image to a unified range. Feature extraction is to extract representative information from the image. Key frame extraction is to select important frames from the video. Audio separation is to extract the audio track in the video separately. Conversion to text processing is to convert the audio into text through speech recognition technology.

[0061] In some embodiments, when analyzing text data, preprocessing is first performed, then the topic model analysis is used to extract the core topic features, the named entity recognition is used to extract the key subject features, and the semantic understanding and knowledge graph technology are combined to extract the association relationship features, and then the text features are generated. For image data, the propagation scene features are extracted through scene analysis, the behavior tendency features are extracted based on human action recognition, and then the image is converted into text through image description generation technology to generate image features. For video data, the key frames are extracted and analyzed to obtain image features, and at the same time the audio is converted into text and analyzed to obtain text features, and the video features are comprehensively generated.

[0062] It should be noted that multi-dimensional analysis of multi-modal data can挖掘出与安全相关的特征from different types of data,打破了传统仅依赖文本分析的局限, and提升了分析的全面性和深度.

[0063] Exemplarily, when analyzing the text data of a campus forum, it is found through topic model analysis that there are inappropriate discussion topics about historical events, the key figures and organizations involved in the discussion are identified through named entity recognition, and it is judged through knowledge graph technology that there are association relationships of distorting history, so as to extract the corresponding text features; when analyzing a certain image data, it is judged through scene analysis that its propagation scene is a campus activity, it is found that there are inappropriate behavior tendencies based on human action recognition, and then the image content is converted into a text description through image description generation technology to extract the image features.

[0064] It should be noted that there is an unclear "词性标注" in the original text which needs to be further clarified in the source language for a more accurate translation. Also, the expressions like "挖掘出与安全相关的特征", "打破了传统仅依赖文本分析的局限", etc. are translated based on the understanding of the context, and there may be more accurate ways depending on the specific domain terms.Step 203: Input the multimodal feature data into the evaluation model and output the evaluation results.

[0065] The evaluation model is a model built based on machine learning algorithms, and the network parameters and feature fusion weights of the evaluation model are dynamically adjusted through a reinforcement learning mechanism to collect prediction bias and evaluation correction information in real time.

[0066] For example, machine learning algorithms can be deep neural networks, support vector machines, etc.; evaluation results can include security risk level, risk type, risk confidence, etc.; reinforcement learning mechanisms continuously optimize the network parameters and feature fusion weights of the model by using prediction bias and evaluation correction information as reward signals.

[0067] In some implementations, after receiving multimodal feature data, the evaluation model fuses the data and then performs classification evaluation to obtain the evaluation result. Simultaneously, it collects new data in real time and calculates prediction bias, receives feedback from management on the evaluation results as evaluation correction information, and adjusts the model parameters and weights through reinforcement learning based on this information, enabling the model to adapt to changes in the network environment.

[0068] It should be noted that building an evaluation model based on machine learning algorithms and dynamically adjusting it in conjunction with reinforcement learning mechanisms can improve the accuracy and timeliness of the evaluation, enabling the model to better cope with complex and ever-changing network environments.

[0069] For example, the extracted text features, image features, and video features from a university's social media platform and an online learning platform were input into the evaluation model. The model output that the platform posed a medium risk, with a risk confidence level of 85%. Subsequently, real-time data collection revealed a 5% deviation between the evaluation result and the actual situation, and management personnel proposed corrections. Based on this information, the evaluation model adjusted the relevant parameters and weights through reinforcement learning.

[0070] Based on the above technical solution, this application can collect multimodal data from various network platforms in universities and perform multi-dimensional analysis on the multimodal data, outputting multimodal feature data such as text features, image features, and video features. Then, the multimodal feature data can be input into an evaluation model to output evaluation results. This evaluation model is built based on machine learning algorithms, and the network parameters and feature fusion weights of the evaluation model are dynamically adjusted through a reinforcement learning mechanism based on the prediction bias and evaluation correction information of the real-time collected data. In this way, this application can comprehensively, accurately, and promptly evaluate the network security status of universities by collecting multimodal data, performing multi-dimensional analysis, and then using an evaluation model with dynamic adjustment capabilities to output evaluation results, thereby meeting the needs of universities for network security management and prevention.

[0071] Furthermore, in the embodiments of this application, the method covers a variety of data types of various network platforms in universities, and the evaluation model is adaptive, effectively solving the shortcomings of existing evaluation methods.

[0072] As one possible embodiment of this application, the evaluation model includes a feature input layer, a feature fusion layer, a classification evaluation layer, and a dynamic adjustment layer.

[0073] The feature input layer is used to receive multimodal feature data.

[0074] In some implementations, the feature input layer can perform preliminary format verification and standardization on the received multimodal feature data to ensure that the data can be correctly processed by the subsequent feature fusion layer. As the data entry point for the evaluation model, the accurate reception and preliminary processing of multimodal feature data by the feature input layer is fundamental to ensuring the smooth progress of subsequent model analysis and evaluation.

[0075] For example, the feature input layer receives text features, image features, and video features, and validates the dimensions and format of these vectors to ensure that they meet the input requirements of the feature fusion layer.

[0076] The feature fusion layer comprises a convolutional neural network (CNN) layer, a recurrent neural network (RNN) layer, and a normalization layer. The CNN layer extracts spatial features from keyframe features in images and videos. The RNN layer extracts temporal features from text features and text features derived from image and video data based on self-attention weights. The normalization layer standardizes and unifies the dimensions of the features output from the CNN and RNN layers based on normalization coefficients, generating fused features.

[0077] Among them, convolutional neural network layers are good at processing spatial features and can extract local and detailed spatial information from image features and video keyframe features; recurrent neural network layers include long short-term memory networks (LSTM) and gated recurrent units (GRU), which are suitable for processing temporal features, and self-attention weights can make the network pay more attention to important feature information; normalization layers process features from different sources through normalization coefficients, so that they have the same scale and distribution, which facilitates subsequent fusion and analysis.

[0078] In some implementations, the convolutional neural network layer uses multiple convolutional and pooling operations to process image features and video keyframe features to obtain spatial feature vectors; the recurrent neural network layer performs sequence modeling on text features and text features converted from images and videos, and combines self-attention weights to highlight important features to obtain temporal feature vectors; the normalization layer uses methods such as Z-score normalization or min-max normalization to process the spatial feature vectors and temporal feature vectors based on preset normalization coefficients, and then concatenates or weights them to obtain fused features.

[0079] It should be noted that the feature fusion layer processes different types of features through different network layers, and performs standardization and fusion. This can give full play to the advantages of various features, improve the representativeness and effectiveness of the fused features, and provide better input for subsequent classification and evaluation.

[0080] For example, a convolutional neural network layer processes the features of an image containing a sensitive symbol, extracting spatial features such as the shape and position of the sensitive symbol; a recurrent neural network layer processes the features of a text containing inappropriate language, focusing on key words based on self-attention weights, and extracting temporal features; a normalization layer processes these two types of features and then concatenates them to generate a fused feature.

[0081] The classification and evaluation layer is used to perform feature mapping and classification on the fused features, and outputs evaluation results. These results include the security risk level, risk type, and risk confidence level.

[0082] For example, the classification and evaluation layer can adopt a fully connected neural network or other structure, and map the fused features to different evaluation categories through multi-layer nonlinear transformation; the safety risk level can be divided into low risk, medium risk, high risk, etc.; the risk type can include extreme ideologies, denigration of mainstream values, etc.; the risk confidence level represents the reliability of the evaluation result, and the value range is generally 0-100%.

[0083] In some implementations, the classification evaluation layer uses a softmax function to convert the fused features into a probability distribution of various evaluation results, takes the category with the highest probability as the final risk type, determines the risk confidence level based on the probability value, and then determines the safety risk level by combining it with a preset threshold.

[0084] It should be noted that the classification and assessment layer can transform the integrated characteristics into intuitive and specific assessment results, providing university administrators with clear information on the cybersecurity status, which facilitates them in taking corresponding prevention and control measures.

[0085] The dynamic adjustment layer is used to adjust the network parameters of the classification evaluation layer, the self-attention weights of the feature fusion layer, and the standardization coefficients based on the reinforcement learning mechanism, using prediction bias and evaluation correction information as reward signals.

[0086] For example, prediction bias is the difference between the assessment results output by the assessment model and the actual security event; assessment correction information is the management's corrective opinions on the assessment results; the reward signal is determined based on the magnitude of the prediction bias and the importance of the assessment correction information, with a higher reward value for smaller bias and more reasonable corrective opinions.

[0087] In one possible implementation, the dynamic adjustment layer is specifically used to: generate a deviation dataset based on the deviation data between the evaluation results output by the evaluation model in real time and the prediction of actual security events, and use the correction opinions of the received evaluation results as evaluation correction information; calculate the reward value using the deviation value of the deviation dataset and the correction weight of the evaluation correction information as the reward signal for reinforcement learning; adjust the network parameters of the classification evaluation layer according to the reward value through the gradient descent algorithm, and update the self-attention weights and standardization coefficients of the feature fusion layer at the same time.

[0088] It should be noted that the dynamic adjustment layer dynamically adjusts the key parameters and weights of the evaluation model through reinforcement learning mechanisms, enabling the model to continuously adapt to changes in the network environment and improve the accuracy and robustness of the evaluation.

[0089] For example, the dynamic adjustment layer finds that the evaluation model has a large prediction bias for a certain type of newly emerging network risk, and the management has put forward clear correction opinions. Therefore, this information is used as a reward signal to calculate the corresponding reward value. The weight of the relevant neurons in the classification evaluation layer is reduced by the gradient descent algorithm, while the self-attention weight and standardization coefficient of the feature fusion layer for the risk-related features are increased.

[0090] Based on the above technical solution, this application can effectively process and analyze multimodal feature data by evaluating the collaborative work of each layer of the model, output accurate evaluation results, and dynamically adjust the model parameters according to the actual situation, so that the model has good adaptability and accuracy.

[0091] In another possible implementation of the embodiments of this application, such as Figure 3 As shown, the above evaluation model can be trained in the following way:

[0092] Step 301: Construct a training dataset based on historical multimodal feature data and the evaluation results of the annotation.

[0093] The assessment results include labels for risk level, risk type, and scope of risk impact.

[0094] For example, historical multimodal feature data is feature data that has been collected and analyzed in the past; the annotation information is annotated by professionals according to the actual situation.

[0095] In some implementations, historical multimodal feature data can be filtered and cleaned during the construction of the training dataset to remove noisy data and outliers, thus ensuring data quality.

[0096] Step 302: Using supervised learning, calculate the deviation between the predicted results and the labeled results using the cross-entropy loss function, and optimize the model parameters of the evaluation model using the backpropagation algorithm.

[0097] Among them, the cross-entropy loss function can effectively measure the difference between the prediction result and the labeling result. The backpropagation algorithm continuously adjusts the parameters to reduce the loss by calculating the gradient of the loss function with respect to each parameter.

[0098] In some implementations, during supervised learning, the training dataset can be divided into a training set, a validation set, and a test set. The model is trained using the training set, hyperparameters are tuned using the validation set, and the model performance is evaluated using the test set.

[0099] Step 303: Generate adversarial examples by adding directional perturbation data to historical multimodal feature data through the generator of the generative adversarial network. Mix the adversarial examples with historical multimodal feature data in a preset ratio to form an enhanced training set. Recalculate the loss function and update the model parameters based on the enhanced training set.

[0100] Among them, the adversarial examples generated by the generator of the generative adversarial network can improve the model's resistance to interference data. The preset ratio can be set according to the actual situation, such as 3:7.

[0101] In some implementations, when generating adversarial examples, the generator generates data that is similar to real data but with directional perturbations based on the distribution patterns of historical multimodal feature data, in order to enhance the generalization ability of the model.

[0102] Based on the above technical solution, this application trains the evaluation model by combining supervised learning and adversarial training, which enables the evaluation model to learn the patterns and characteristics in historical data, while improving the evaluation model's ability to process complex and interfering data, thereby improving the evaluation performance of the evaluation model.

[0103] In another possible implementation of this application, the application can analyze data based on different dimensions, output dimensional features of the corresponding dimensions, and combine them with... Figure 2 ,like Figure 4 As shown, step 202 above can be achieved through the following steps.

[0104] Step 401: For text data, topic modeling is used to extract core topic features, named entity recognition is used to extract key subject features, and semantic understanding and knowledge graph technology are used to extract relational features, thereby generating text features.

[0105] In some embodiments, topic modeling analysis employs the linear discriminant analysis (LDA) algorithm, extracting latent topic features from text data by constructing a three-layer probabilistic model of words, topics, and documents. Knowledge graph technology, based on pre-trained language models, constructs a domain entity relation library for inference and analysis of entity relationship features in text data. Named entity recognition can identify key entities such as person names, place names, and organization names in text.

[0106] For example, when performing topic modeling analysis on text data, the text can first be preprocessed, such as word segmentation and stop word removal, and then the LDA algorithm can be used to map the text data to the topic space to obtain core topic features. Named entity recognition uses a BiLSTM-CRF-based model to identify and classify key entities in the text. Semantic understanding is combined with knowledge graph technology, using a pre-trained language model to understand the semantics of the text, and then using a domain entity relation database to infer the relationships between entities.

[0107] Step 402: For image data, extract the propagation scene features through scene analysis, extract behavioral tendency features based on human action recognition, and convert the image into text through image description generation technology to generate image features.

[0108] In some embodiments, scene analysis can identify environmental information in an image, such as a campus or conference room; human action recognition can determine a person's behavior, such as giving a speech; and image description generation technology uses a deep learning model to convert image content into natural language text.

[0109] For example, when performing scene analysis and human action recognition on image data, a convolutional neural network model is used to classify the scene and human actions in the image, respectively. The image description generation technology adopts an encoder-decoder structure, where the encoder extracts image features and the decoder generates text descriptions.

[0110] Step 403: For video data, extract the same image features from the keyframes of the video data as those from the image data, and at the same time, convert the audio into text to generate video features.

[0111] In some embodiments, keyframe extraction involves selecting representative frame images from the video; audio-to-text conversion is achieved through speech recognition technology.

[0112] For example, when extracting keyframes from video data, keyframes are selected based on inter-frame differences and motion information. Then, features are extracted according to the image data analysis method. At the same time, the audio is processed to be converted into text and features are extracted. The combined video features are obtained.

[0113] Based on the above technical solution, this application can fully explore the security-related features contained in different types of multimodal data by adopting targeted analysis methods, providing comprehensive and effective input for the evaluation model and improving the accuracy of the evaluation.

[0114] In another possible implementation of this application's embodiments, the application can also display the evaluation results to facilitate viewing and analysis by relevant personnel. Combined with... Figure 2 ,like Figure 5 As shown, the method also includes the following steps.

[0115] Step 501: Generate a dynamic display interface based on the evaluation results.

[0116] The dynamic display interface includes a dynamic dashboard, a risk distribution heatmap, and a risk evolution trend curve. The dynamic dashboard presents the real-time risk index, the risk distribution heatmap displays the distribution of risk areas, and the risk evolution trend curve reflects the patterns of risk change.

[0117] For example, the dynamic dashboard displays the real-time risk index in an intuitive digital and pointer format, with a higher risk index indicating a worse safety situation; the risk distribution heat map uses different colors to represent the risk level of different areas, with darker colors indicating higher risk; and the risk evolution trend curve uses time as the horizontal axis and the risk index as the vertical axis to show how the risk changes over time.

[0118] In some implementations, the dynamic display interface employs responsive web design technology, supporting display on various terminal devices such as computers, tablets, and mobile phones. The dynamic dashboard updates data in real time, and the risk distribution heatmap can be displayed by dimension such as campus or online platform. The risk evolution trend curve can select different time periods, such as daily, weekly, or monthly. Simultaneously, the interface provides interactive functions, allowing users to click and view specific risk details.

[0119] For example, the dynamic dashboard displays a real-time risk index of 65 points (out of 100) for the current university's cybersecurity; the risk distribution heatmap shows that the social media platforms on a certain campus are colored darker, indicating a higher risk; and the risk evolution trend curve shows that the risk index has fluctuated upwards over the past month. Administrators can click on high-risk areas in the heatmap to view the specific risk content and related data for that area.

[0120] Based on the above technical solution, this application can present complex evaluation results to users in an intuitive and easy-to-understand way by generating a dynamic display interface, which makes it convenient for administrators to quickly grasp the network security status of universities and take corresponding management and prevention measures in a timely manner.

[0121] The above primarily describes the solutions of the embodiments of this application from the perspective of device implementation. It is understood that each device, such as a university network security assessment device, includes at least one of the hardware structures and software modules corresponding to the execution of each function in order to achieve the above-mentioned functions. Those skilled in the art should readily recognize that, in conjunction with the units and algorithm steps of the various examples described in the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed by hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0122] This application embodiment can divide the university network security assessment device into functional units according to the above method example. For example, each function can be divided into separate functional units, or two or more functions can be integrated into one processing unit. The integrated unit can be implemented in hardware or as a software functional unit. It should be noted that the unit division in this application embodiment is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods.

[0123] When using integrated units, Figure 6 A possible structural schematic diagram of the university network security assessment device (referred to as university network security assessment device 60) involved in the above embodiments is shown. The university network security assessment device 60 includes a processing unit 601 and a communication unit 602, and may also include a storage unit 603. Figure 6 The structural diagram shown can be used to illustrate the structure of the university network security assessment device involved in the above embodiments.

[0124] when Figure 6 The structural diagram shown is used to illustrate the structure of the university network security assessment device involved in the above embodiments. The processing unit 601 is used to control and manage the operation of the university network security assessment device, the communication unit 602 is used for the university network security assessment device to communicate with other devices, and the storage unit 603 is used to store the program code and data of the university network security assessment device.

[0125] For example, communication unit 602 is used to collect multimodal data from various network platforms of universities; among which, network platforms include official websites, social media platforms, online learning platforms and campus forums; multimodal data includes text data, image data and video data.

[0126] The processing unit 601 is used to perform multi-dimensional analysis on multimodal data and output multimodal feature data, wherein the multimodal feature data includes text features, image features and video features; the text features are obtained by analyzing and extracting text data based on natural language processing technology; the image features are obtained by analyzing and extracting image data based on deep learning image recognition technology; and the video features are obtained by analyzing and extracting video data based on speech recognition and image sequence analysis technology.

[0127] The processing unit 601 is used to input multimodal feature data into the evaluation model and output the evaluation result. The evaluation model is a model built based on machine learning algorithms, and the network parameters and feature fusion weights of the evaluation model are dynamically adjusted through a reinforcement learning mechanism to collect prediction bias and evaluation correction information in real time.

[0128] In one possible implementation, the evaluation model includes a feature input layer, a feature fusion layer, a classification evaluation layer, and a dynamic adjustment layer. The feature input layer receives multimodal feature data. The feature fusion layer includes a convolutional neural network layer, a recurrent neural network layer, and a normalization layer. The convolutional neural network layer extracts spatial features from keyframe features in image and video features, while the recurrent neural network layer extracts temporal features from text features and text features converted from image and video data based on self-attention weights. The normalization layer performs dimensionality unification and normalization processing on the features output by the convolutional neural network layer and the recurrent neural network layer based on normalization coefficients to generate fused features. The classification evaluation layer performs feature mapping classification on the fused features and outputs evaluation results. The evaluation results include security risk level, risk type, and risk confidence. The dynamic adjustment layer uses a reinforcement learning mechanism, taking prediction bias and evaluation correction information as reward signals, to adjust the network parameters of the classification evaluation layer, the self-attention weights of the feature fusion layer, and the normalization coefficients.

[0129] In one possible implementation, the dynamic adjustment layer is specifically used to: generate a deviation dataset based on the deviation data between the evaluation results output by the evaluation model in real time and the prediction of actual security events, and use the correction opinions of the received evaluation results as evaluation correction information; calculate the reward value using the deviation value of the deviation dataset and the correction weight of the evaluation correction information as the reward signal for reinforcement learning; adjust the network parameters of the classification evaluation layer according to the reward value through the gradient descent algorithm, and update the self-attention weights and standardization coefficients of the feature fusion layer at the same time.

[0130] In one possible implementation, the evaluation model is trained as follows: a training dataset is constructed based on historical multimodal feature data and labeled evaluation results. The labeled information of the evaluation results includes risk level labels, risk type labels, and risk impact range labels. The deviation between the predicted results and the labeled results is calculated using a cross-entropy loss function through supervised learning, and the model parameters of the evaluation model are optimized using a backpropagation algorithm. Adversarial examples are generated by adding directional perturbation data to the historical multimodal feature data through a generator of a generative adversarial network. The adversarial examples are mixed with the historical multimodal feature data in a preset ratio to form an enhanced training set. The loss function is recalculated and the model parameters are updated based on the enhanced training set.

[0131] In one possible implementation, the processing unit 601 is used to: for text data, extract core topic features using topic modeling analysis, extract key subject features using named entity recognition, and extract relational features based on semantic understanding and knowledge graph technology, thereby generating text features; for image data, extract dissemination scene features through scene analysis, extract behavioral tendency features based on human action recognition, and convert images into text using image description generation technology, thereby generating image features; for video data, extract the same image features as the image data from keyframes of the video data, and convert audio into text, thereby generating video features.

[0132] In one possible implementation, topic modeling analysis employs the Linear Discriminant Analysis (LDA) algorithm, which extracts latent topic features from text data by constructing a three-layer probabilistic model of words, topics, and documents; knowledge graph technology is based on a pre-trained language model to construct a domain entity relation library, which is used for reasoning and analysis of entity relationship features in text data.

[0133] In one possible implementation, the processing unit 601 is used to: generate a dynamic display interface based on the evaluation results; wherein the dynamic display interface includes a dynamic dashboard, a risk distribution heatmap, and a risk evolution trend curve; the dynamic dashboard is used to present a real-time risk index, the risk distribution heatmap is used to display the distribution of risk areas, and the risk evolution trend curve is used to reflect the pattern of risk changes.

[0134] In one possible implementation, the processing unit 601 is used to: perform preprocessing operations on multimodal data; wherein the preprocessing operations for text data include word segmentation, part-of-speech tagging, stop word removal, and word vector generation; the preprocessing operations for image data include grayscale conversion, noise reduction, normalization, and feature extraction; and the preprocessing operations for video data include keyframe extraction, audio separation, and conversion to text processing, and the converted text is subjected to the same preprocessing operations as the text data.

[0135] The processing unit 601 can be a processor or a controller, and the communication unit 602 can be a communication interface, transceiver, transceiver circuit, transceiver device, etc. The term "communication interface" is a general term and may include one or more interfaces. The storage unit 603 can be a memory. When the university network security assessment device 60 is a chip, the processing unit 601 can be a processor or a controller, and the communication unit 602 can be an input interface and / or an output interface, pins, or circuits, etc. The storage unit 603 can be a storage unit within the chip (e.g., a register, cache, etc.) or a storage unit located outside the chip (e.g., read-only memory (ROM), random access memory (RAM, etc.).

[0136] The communication unit can also be called a transceiver unit. The antenna and control circuit with transceiver functions in the university network security assessment device 60 can be considered as the communication unit 602 of the university network security assessment device 60, and the processor with processing functions can be considered as the processing unit 601 of the university network security assessment device 60. Optionally, the device in the communication unit 602 used to implement the receiving function can be considered as the communication unit. The communication unit is used to execute the receiving steps in the embodiments of this application, and the communication unit can be a receiver, a receiver circuit, etc. The device in the communication unit 602 used to implement the transmitting function can be considered as the transmitting unit. The transmitting unit is used to execute the transmitting steps in the embodiments of this application, and the transmitting unit can be a transmitter, a transmitter, a transmitting circuit, etc.

[0137] Figure 6 If the integrated units in the process are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. Storage media for storing computer software products include various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory, random access memory, magnetic disks, or optical disks.

[0138] Figure 6 The units in the process can also be called modules; for example, a processing unit can be called a processing module.

[0139] This application also provides a hardware structure diagram of a university network security assessment device (referred to as university network security assessment device 70), see [link to diagram]. Figure 7 The university network security assessment device 70 includes a processor 701, and optionally, a memory 702 connected to the processor 701.

[0140] In the first possible implementation, see Figure 7 The university network security assessment device 70 also includes a transceiver 703. The processor 701, memory 702, and transceiver 703 are connected via a bus. The transceiver 703 is used to communicate with other devices or communication networks. Optionally, the transceiver 703 may include a transmitter and a receiver. The device in the transceiver 703 that implements the receiving function can be considered as a receiver, and the receiver is used to perform the receiving steps in the embodiments of this application. The device in the transceiver 703 that implements the transmitting function can be considered as a transmitter, and the transmitter is used to perform the transmitting steps in the embodiments of this application.

[0141] Based on the first possible implementation method Figure 7 The structural diagram shown can be used to illustrate the structure of the university network security assessment device involved in the above embodiments.

[0142] in, Figure 7 This can also be illustrated by the system chip in the university's cybersecurity assessment device. In this case, the actions performed by the aforementioned university cybersecurity assessment device can be implemented by this system chip; the specific actions performed can be found above and will not be repeated here.

[0143] In implementation, each step of the method provided in this embodiment can be completed by integrated logic circuits in the processor or by instructions in software form. The steps of the method disclosed in the embodiments of this application can be directly manifested as being executed by a hardware processor, or being executed by a combination of hardware and software modules in the processor.

[0144] The processor in this application may include, but is not limited to, at least one of the following: a central processing unit (CPU), a microprocessor, a digital signal processor (DSP), a microcontroller unit (MCU), or an artificial intelligence processor, etc., which are various computing devices that run software. Each computing device may include one or more cores for executing software instructions to perform calculations or processing. The processor may be a separate semiconductor chip or integrated with other circuits into a single semiconductor chip. For example, it may be integrated with other circuits (such as encoding / decoding circuits, hardware acceleration circuits, or various bus and interface circuits) to form a SoC (System-on-a-Chip), or it may be integrated as a built-in processor within an ASIC. The ASIC with the integrated processor may be packaged separately or together with other circuits. In addition to the cores for executing software instructions to perform calculations or processing, the processor may further include necessary hardware accelerators, such as field-programmable gate arrays (FPGAs), PLDs (programmable logic devices), or logic circuits that implement dedicated logic operations.

[0145] The memory in the embodiments of this application may include at least one of the following types: read-only memory (ROM) or other types of static storage devices capable of storing static information and instructions; random access memory (RAM) or other types of dynamic storage devices capable of storing information and instructions; or electrically erasable programmable-only memory (EEPROM). In some scenarios, the memory may also be a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media, or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto.

[0146] This application also provides a computer-readable storage medium including instructions that, when run on a computer, cause the computer to perform any of the methods described above.

[0147] This application also provides a computer program product containing instructions that, when run on a computer, cause the computer to perform any of the methods described above.

[0148] This application also provides a chip including a processor and an interface circuit. The interface circuit is coupled to the processor. The processor is used to run computer programs or instructions to implement the above-described method. The interface circuit is used to communicate with other modules outside the chip.

[0149] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software programs, implementation can be, in whole or in part, in the form of a computer program product. This computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device containing one or more servers, data centers, etc., that can be integrated with the medium. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks (SSDs)).

[0150] Although this application has been described herein in conjunction with various embodiments, those skilled in the art, by reviewing the accompanying drawings, disclosure, and appended claims, will understand and implement other variations of the disclosed embodiments in carrying out the claimed application. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple instances. A single processor or other unit can implement several functions listed in the claims. While different dependent claims may recite certain measures, this does not mean that these measures cannot be combined to produce good results.

[0151] Although this application has been described in conjunction with specific features and embodiments, it is obvious that various modifications and combinations can be made thereto without departing from the spirit and scope of this application. Accordingly, this specification and drawings are merely exemplary illustrations of this application as defined by the appended claims, and are considered to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Clearly, those skilled in the art can make various alterations and modifications to this application without departing from the spirit and scope of this application. Thus, if such modifications and modifications of this application fall within the scope of the claims of this application and their equivalents, this application is also intended to include such modifications and modifications.

Claims

1. A method for assessing cybersecurity in universities, characterized in that, include: Multimodal data is collected from various online platforms of universities; these platforms include official websites, social media platforms, online learning platforms, and campus forums; the multimodal data includes text data, image data, and video data. The multimodal data is analyzed in multiple dimensions to output multimodal feature data, which includes text features, image features, and video features. The text features are extracted from the text data using natural language processing technology. The image features are extracted from the image data using deep learning image recognition technology. The video features are extracted from the video data using speech recognition and image sequence analysis technology. The multimodal feature data is input into the evaluation model, and the evaluation result is output. The evaluation model is a model built based on machine learning algorithms, and the network parameters and feature fusion weights of the evaluation model are dynamically adjusted through a reinforcement learning mechanism to collect prediction bias and evaluation correction information in real time. The evaluation model includes a feature input layer, a feature fusion layer, a classification evaluation layer, and a dynamic adjustment layer; The feature input layer is used to receive the multimodal feature data; The feature fusion layer includes a convolutional neural network layer, a recurrent neural network layer, and a normalization layer. The convolutional neural network layer is used to extract spatial features from keyframe features in image and video features. The recurrent neural network layer is used to extract temporal features from text features and text features converted from image and video data based on self-attention weights. The normalization layer is used to perform dimensionality unification and normalization processing on the features output by the convolutional neural network layer and the recurrent neural network layer based on normalization coefficients to generate fused features. The classification and evaluation layer is used to perform feature mapping and classification on the fused features and output the evaluation results; the evaluation results include the security risk level, risk type and risk confidence level. The dynamic adjustment layer is used to adjust the network parameters of the classification evaluation layer, the self-attention weights of the feature fusion layer, and the standardization coefficients based on the reinforcement learning mechanism, using the prediction bias and evaluation correction information as reward signals. The dynamic adjustment layer is specifically used for: Based on the deviation data between the evaluation results output by the evaluation model and the prediction of actual security events collected in real time, a deviation dataset is generated, and the correction opinions of the received evaluation results are used as evaluation correction information. The reward value is calculated using the deviation value of the deviation dataset and the correction weight of the evaluation correction information as the reward signal for reinforcement learning; Based on the reward value, the network parameters of the classification evaluation layer are adjusted using the gradient descent algorithm, while the self-attention weights and normalization coefficients of the feature fusion layer are updated. The evaluation model is trained in the following manner: A training dataset is constructed based on historical multimodal feature data and labeled evaluation results. The labeled information of the evaluation results includes risk level labels, risk type labels, and risk impact range labels. The deviation between the predicted and labeled results is calculated using a supervised learning method with the cross-entropy loss function, and the model parameters of the evaluation model are optimized using the backpropagation algorithm. The generator of the generative adversarial network adds directional perturbation data to the historical multimodal feature data to generate adversarial samples. The adversarial samples are then mixed with the historical multimodal feature data at a preset ratio to form an enhanced training set. The loss function is recalculated and the model parameters are updated based on the enhanced training set.

2. The method according to claim 1, characterized in that, The step of performing multi-dimensional analysis on the multimodal data and outputting multimodal feature data includes: For the text data, topic modeling is used to extract core topic features, named entity recognition is used to extract key subject features, and semantic understanding and knowledge graph technology are used to extract relational features, thereby generating text features; For the image data, propagation scene features are extracted through scene analysis, behavioral tendency features are extracted based on human action recognition, and the image is converted into text through image description generation technology, thereby generating image features; For the video data, the same image features as those in the image data are extracted from the keyframes of the video data, and the audio is converted into text to generate video features.

3. The method according to claim 2, characterized in that, The topic model analysis employs the Linear Discriminant Analysis (LDA) algorithm, which extracts latent topic features from the text data by constructing a three-layer probabilistic model of words, topics, and documents. The knowledge graph technology is based on a pre-trained language model to construct a domain entity relation library, which is used for reasoning and analysis of entity relationship features in the text data.

4. The method according to claim 1, characterized in that, The method further includes; A dynamic display interface is generated based on the assessment results; wherein, the dynamic display interface includes a dynamic dashboard, a risk distribution heatmap, and a risk evolution trend curve; the dynamic dashboard is used to present a real-time risk index, the risk distribution heatmap is used to display the distribution of risk areas, and the risk evolution trend curve is used to reflect the pattern of risk change.

5. The method according to claim 1, characterized in that, The method further includes: The multimodal data is preprocessed; the preprocessing operations for the text data include word segmentation, part-of-speech tagging, stop word removal, and word vector generation; the preprocessing operations for the image data include grayscale conversion, noise reduction, normalization, and feature extraction; the preprocessing operations for the video data include keyframe extraction, audio separation, and conversion to text processing, and the converted text is subjected to the same preprocessing operations as the text data.

6. An evaluation apparatus for implementing the university network security evaluation method according to any one of claims 1-5, characterized in that, The device includes: a communication unit and a processing unit; The communication unit is used to collect multimodal data from various network platforms of universities; wherein, the network platforms include official websites, social media platforms, online learning platforms, and campus forums; the multimodal data includes text data, image data, and video data; The processing unit is used to perform multi-dimensional analysis on the multimodal data and output multimodal feature data, wherein the multimodal feature data includes text features, image features, and video features; the text features are obtained by analyzing and extracting the text data based on natural language processing technology; the image features are obtained by analyzing and extracting the image data based on deep learning image recognition technology; and the video features are obtained by analyzing and extracting the video data based on speech recognition and image sequence analysis technology. The processing unit is used to input the multimodal feature data into the evaluation model and output the evaluation result; the evaluation model is a model built based on machine learning algorithm, and the network parameters and feature fusion weights of the evaluation model are dynamically adjusted through reinforcement learning mechanism to collect prediction bias and evaluation correction information in real time.

7. A network security assessment device for universities, characterized in that, include: A processor and a communication interface; the communication interface is coupled to the processor, the processor being used to run computer programs or instructions to implement the university network security assessment method as described in any one of claims 1-5.

Images