Report interpretation method and system

Abstract

The application discloses a report interpretation method and system, and the method comprises the following steps: preprocessing a target safety report and inputting the target safety report into a first preset model to extract key information to obtain key knowledge points; converting the key knowledge points into key knowledge point vectors and inputting the key knowledge point vectors into a second preset model to perform feature extraction and feature fusion and generate a preliminary interpretation result; and inputting the preliminary interpretation result as a core input parameter into a confidence rule base to perform evidence reasoning and external heterogeneous data fusion on the core input parameter by the confidence rule base to generate a final interpretation result. In the embodiment of the application, redundant interference data can be effectively filtered, information omission and interpretation deviation can be reduced, information semantic correlation can be strengthened, and the accuracy of the preliminary interpretation result can be improved. Furthermore, the accuracy of the model decision answer can be further optimized by introducing the confidence rule base to fuse external heterogeneous data, and the requirements for accurate, reliable, efficient and verifiable report interpretation results are met.

Description

Report Interpretation Methods and Systems Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to a report interpretation method and system. Background Technology

[0002] With the advancement of artificial intelligence technology, Natural Language Processing (NLP), as one of the core technologies in the field of human-computer interaction, focuses on language analysis and processing, driving innovation in the cybersecurity industry and ushering in a new era of interaction models. In cybersecurity consulting scenarios, NLP technology can now provide support such as real-time streaming responses to questions and document content parsing responses, offering crucial technical support for AI service scenarios.

[0003] However, current intelligent interpretation technologies in the cybersecurity industry rely on preset rules and limited knowledge base templates, making it difficult to cope with the linearly growing user base and their diverse professional consultation needs. Furthermore, existing service scenarios lack sufficient analysis of the security intent behind user-provided security reports, lack in-depth professionalism, and have limited accuracy in responses. Traditional service models also cannot address the multi-dimensional and ever-changing consultation methods of users. These issues constitute the main bottleneck hindering the improvement of operational efficiency in cybersecurity report interpretation scenarios. Summary of the Invention

[0004] Therefore, it is necessary to provide a report interpretation method and system to address the aforementioned technical problems and solve at least one of the problems existing in the prior art.

[0005] This application provides a report interpretation method as follows:

[0006] The target security report is preprocessed and input into the first preset model to extract key information and obtain key knowledge points.

[0007] The key knowledge points are converted into key knowledge point vectors and input into the second preset model for feature extraction and feature fusion to generate preliminary interpretation results.

[0008] The preliminary interpretation results are used as core input parameters to the confidence rule base. The confidence rule base is then used to perform evidence reasoning and external heterogeneous data fusion on the core input parameters to generate the final interpretation results.

[0009] In one possible implementation, the preprocessing of the target security report and its input into a first preset model for key information extraction to obtain key knowledge points includes:

[0010] The content of the target security report is decomposed into text structure, cleaned, and formatted to obtain standardized structured text data;

[0011] The structured text data is classified and associated to identify the relationships and attribute features between information, so as to convert the structured text data into an input format that can be processed by the first preset model;

[0012] The key knowledge points are obtained by repeatedly performing linear mapping and normalization on the structured text data after the format conversion using the first preset model, and then performing residual connection operations.

[0013] In one possible implementation, the step of classifying and associating the structured text data to identify the relationships and attribute features between information includes:

[0014] The structured text data is segmented, the segmented text is position-encoded to mark the position information of each word, and the position-encoded text is converted into an embedding vector.

[0015] Based on the embedding vector, n-gram units of different lengths are constructed, and each n-gram unit is explicitly identified to distinguish independent semantic units;

[0016] The explicitly labeled n-gram units are classified and associated to identify the relationships and attribute features between information.

[0017] In one possible implementation, the step of classifying the n-gram units to identify the relationships and attribute features between information includes:

[0018] Based on the training sample data, n-gram unit samples are obtained;

[0019] Based on the mask training task, the n-gram unit samples are trained using a preset loss function until the model converges, and the trained model parameters are obtained.

[0020] Based on the trained model parameters, the n-gram units are classified to identify the relationships and attribute features between information.

[0021] In one possible implementation, the step of converting the key knowledge points into a key knowledge point vector and inputting it into a second preset model for feature extraction and feature fusion to generate preliminary interpretation results includes:

[0022] The key knowledge point vector is input into the second preset model, and the second preset model performs top-down feature extraction to obtain the initial feature information.

[0023] The initial feature information is used as a feedback signal and input into the dynamic construction module to generate the preliminary interpretation result.

[0024] In one possible implementation, the step of performing top-down feature extraction using the second preset model to obtain initial feature information includes:

[0025] The key knowledge point vector is reduced to a first preset dimension to generate a mid-level feature map.

[0026] The intermediate-level feature mapping is reduced to a second preset dimension to generate an overall overview feature mapping.

[0027] Perform local perception operations on the overall overview feature map to generate local key data;

[0028] The local key data is standardized and processed to a greater depth, and then transformed nonlinearly to generate a context representation and a similarity matrix.

[0029] In one possible implementation, the step of inputting the initial feature information as a feedback signal into the dynamic construction module to generate the preliminary interpretation result includes:

[0030] Based on the mid-level feature mapping and the overall overview feature mapping, the dynamic construction module performs feature fusion and optimization to generate effective fused features.

[0031] The effective fused features are split to obtain new context information and new feature representations, and the initial context information is added to the new context information in a learnable scalar manner to obtain the updated context information;

[0032] Based on the updated context information and new feature representations, a dynamic kernel under a preset spatial dimension is defined and generated.

[0033] The similarity of the effective fused features is calculated to obtain the aggregated feature similarity.

[0034] After normalizing the aggregated feature similarity, weights are assigned through the dynamic kernel and key feature association information is aggregated to generate the preliminary interpretation result.

[0035] In one possible implementation, the step of generating effective fused features by performing feature fusion and optimization processing through the dynamic construction module based on the mid-level feature map and the overall overview feature map includes:

[0036] Based on the mid-level feature mapping and the overall overview feature mapping, the state within the dynamic construction module is corrected, and the context information and feature representation at the entry point of the m-th processing block are generated.

[0037] The context information and feature representation at the entry point of the m-th processing block are fused to obtain the fused feature.

[0038] After the fused features are convolved by the dynamic construction module, they are processed by the dynamic gate mechanism to generate effective fused features.

[0039] In one possible implementation, after generating the final interpretation result, the method further includes:

[0040] The final interpretation result output by the confidence rule base is used as a secondary training parameter and input into the first preset model and the second preset model for model optimization.

[0041] Based on the optimized first and second preset models, subsequent security report interpretation operations are performed.

[0042] Secondly, a report interpretation system is provided, including:

[0043] The key knowledge point extraction unit is used to preprocess the target security report and input it into the first preset model to extract key information in order to obtain key knowledge points.

[0044] The preliminary interpretation result generation unit is used to convert the key knowledge points into key knowledge point vectors and input them into the second preset model to perform feature extraction and feature fusion to generate preliminary interpretation results.

[0045] The final interpretation result generation unit is used to input the preliminary interpretation result as a core input parameter into the confidence rule base, and to perform evidence reasoning and external heterogeneous data fusion on the core input parameter through the confidence rule base to generate the final interpretation result.

[0046] The aforementioned report interpretation method and system include the following steps: preprocessing the target security report and inputting it into a first preset model to extract key information and obtain key knowledge points; converting the key knowledge points into a key knowledge point vector and inputting it into a second preset model for feature extraction and feature fusion to generate a preliminary interpretation result; inputting the preliminary interpretation result as a core input parameter into a confidence rule base, and using the confidence rule base to perform evidence reasoning and external heterogeneous data fusion on the core input parameter to generate a final interpretation result. In this embodiment, by standardizing the report and extracting key information, redundant and interfering data is effectively filtered out, reducing information omissions and interpretation biases. Combined with feature extraction and fusion of the second preset model, the semantic relevance of information is further strengthened, and the accuracy of the preliminary interpretation results is improved. By introducing a confidence rule base and integrating external heterogeneous data, evidence reasoning is used to complete cross-validation of multi-source data and supplementation of domain knowledge, outputting decision results with confidence distribution. This not only corrects the bias of interpretation by a single model through cross-validation of multi-source data, but also measures the reliability of the results with confidence, further optimizing the accuracy of the answer. This achieves the core requirements of the security field for accurate, reliable, efficient and verifiable report interpretation results. Attached Figure Description

[0047] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 is a flowchart illustrating a report interpretation method according to an embodiment of this application;

[0049] Figure 2 is a model structure diagram of the ERNIE-Gram-OverLoCK model in one embodiment of this application;

[0050] Figure 3 is a schematic diagram of the structure of a report interpretation system according to an embodiment of this application;

[0051] Figure 4 is a schematic diagram of a computer device according to an embodiment of this application. Detailed Implementation

[0052] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0053] In one embodiment, as shown in Figure 1, a report interpretation method is provided, including the following steps:

[0054] In step S110, the target security report is preprocessed and input into the first preset model to extract key information and obtain key knowledge points.

[0055] It should be noted that the first preset model can be the ERNIE-Gram model. Compared with traditional models, it has two core advantages in the scenario of extracting key information from security reports: First, it has stronger domain adaptability. ERNIE-Gram's n-gram semantic modeling capability can accurately match the text characteristics of security reports, which are dense with professional terms and have rigorous logical connections. For example, it can automatically distinguish between the names of vulnerability exploitation tools and normal software names, avoiding the extraction errors caused by the coarse semantic granularity of traditional models. Second, it has better anti-interference capability. When faced with non-pure text content such as log code and data tables mixed in with security reports, ERNIE-Gram can still stably extract key knowledge points through preprocessed structured text input and its own ability to complete incomplete semantics, without the need to develop additional customized rules for special formats.

[0056] Optionally, the target security report is first split into multiple modalities to extract text blocks, table data, and image data (including OCR text), while simultaneously recording location metadata such as page numbers and chapters. Then, the data is cleaned, professional terminology is standardized, noise is filtered, and outliers in the tables are corrected. The tables are converted into "field-value" text sequences and associated with the image text and corresponding chapters. Next, the cleaned data is integrated by chapter, type identifiers and location metadata are added to form structured text, which is then input into the first preset model. After the model cleans up interfering data and identifies the relationships and attribute features between information through association and classification, it is converted into a model input tensor.

[0057] Finally, the first pre-defined model first segments the input text into words and maps them into word embedding vectors, and then processes them through a multi-layer Transformer encoder: it uses a self-attention mechanism to capture semantic relationships between words (such as the relationship between vulnerability type and scope of impact), combines residual connections and layer normalization to alleviate gradient vanishing, and strengthens deep semantic learning; it accurately represents professional terms based on pre-trained domain knowledge, and generates high-dimensional feature vectors through multiple linear mappings and normalizations; finally, it extracts key knowledge points (such as vulnerability type, risk level, etc.) through classification or extraction heads, and these key points have clear semantic relationship attributes.

[0058] In step S120, the key knowledge points are converted into key knowledge point vectors and input into the second preset model for feature extraction and feature fusion to generate preliminary interpretation results.

[0059] It should be noted that the second preset model can be the OverLoCK model. Compared with the traditional model, the OverLoCK model can accurately capture the implicit relationships between key knowledge points through multi-scale feature fusion (for example, the relationship between "SQL injection vulnerability" and "Web server assets" is not only adjacent in text, but also a professional logical relationship in the security field that "Web applications are vulnerable to SQL injection attacks"). This avoids the one-sided interpretation caused by insufficient feature interaction in the traditional model. Furthermore, given the characteristics of security reports where "risk descriptions are scattered across multiple chapters and handling recommendations need to be combined with information on multiple types of vulnerabilities", the global feature fusion mechanism of the OverLoCK model can integrate the vector representations of different key knowledge points to generate preliminary interpretation results with global semantics (such as extracting the global conclusion that "the overall risk level is extremely high and needs to be prioritized" from scattered key points such as "multiple high-risk vulnerabilities" and "multiple assets affected"), without the need for additional manual integration of scattered information.

[0060] Figure 2 shows a model structure diagram of the ERNIE-Gram-OverLoCK model.

[0061] The second pre-defined model (OverLoCK model) can include a built-in three-layer collaborative network for top-down feature extraction. These three layers combine to form two backbone networks, which generate a dynamic contextual attention mechanism. Simultaneously, it integrates a unique contextual dynamic convolution technique, which adaptively adjusts the parameters and structure of the convolution kernel to accurately capture features of different granularities in the key knowledge point vector. The dynamic contextual attention mechanism can flexibly adjust the attention weight allocation according to the content of the input key knowledge point vector, focusing on information closely related to security interpretation (such as vector regions corresponding to keywords like "high-risk vulnerabilities" and "core assets"), effectively filtering out irrelevant feature interference. The contextual dynamic convolution technique overcomes the limitations of fixed convolution kernels, dynamically adjusting convolution operations based on the semantic information contained in the vector, better adapting to the diverse professional expressions and logical connections in security reports. Through this design, it can more efficiently extract and integrate multi-dimensional features from the key knowledge point vector, generating accurate and comprehensive preliminary interpretation results, providing high-quality intermediate results for further processing in the subsequent confidence rule base.

[0062] Optionally, for the key information output by the first preset model, the structured knowledge points such as vulnerability type, risk level, and affected assets can be transformed into low-dimensional dense numerical vectors through word embedding or sentence embedding techniques (such as using a pre-trained word vector model or Transformer encoder), making the text information into a feature form that the model can compute. Then, these vectors are input into the second preset model, and through a multi-scale feature extraction mechanism, both local detailed features in the vectors (such as the technical attributes of "SQL injection" and the risk level of "high risk") are captured, and implicit connections between knowledge points are mined through cross-level interaction modules (such as the domain-specific connection between "Web server" and "SQL injection vulnerability"). At the same time, the model integrates multi-dimensional features with a global fusion structure, fusing the scattered knowledge point vectors into a holistic representation with global semantics, and finally generating a preliminary interpretation result covering risk assessment, correlation analysis, and preliminary suggestions (such as "Combining the SQL injection vulnerability and the core Web server affected, the risk level is preliminarily determined to be high risk, and it is recommended to prioritize its repair"). This result retains the core information of the key knowledge points and endows them with professional logical connections through feature fusion.

[0063] In step S130, the preliminary interpretation result is input into the confidence rule base as a core input parameter. The confidence rule base is used to perform evidence reasoning and external heterogeneous data fusion on the core input parameter to generate the final interpretation result.

[0064] It should be noted that the Belief Rule Base (BRB) is an intelligent decision support system that integrates domain rule knowledge, uncertainty reasoning logic, and multi-source data to handle information verification, reasoning, and fusion in complex scenarios.

[0065] Optionally, the preliminary interpretation result output by the second preset model (e.g., "the vulnerability type is SQL injection, the risk level is high, and it affects the core web server") is used as the core input parameter. This parameter is then converted according to the preset format of the confidence rule base (e.g., structured feature vectors, conclusion labels with confidence levels) and input into the rule base. Next, the confidence rule base performs evidence reasoning. Based on predefined security domain rules (e.g., "if the vulnerability is SQL injection and affects core assets, the risk level confidence level needs to be increased by 20%), it performs logical verification and confidence level correction on each conclusion dimension (vulnerability type, risk level, and scope of impact) of the preliminary interpretation result to determine whether the preliminary conclusion conforms to domain-specific logic. On the other hand, it can perform external heterogeneous data fusion, calling multi-source external data related to the current security report (e.g., historical similar vulnerability handling cases, industry security risk standards, and real-time operational status data of the target assets). This non-textual, cross-source data is then correlated and matched with the preliminary interpretation result, supplementing information not covered by the preliminary interpretation through data cross-validation. Finally, the confidence rule base integrates the logical verification results of comprehensive evidence reasoning with the supplementary information from the fusion of heterogeneous data to integrate and optimize the conclusions, confidence levels, and recommendations of the preliminary interpretation results, generating the final interpretation results that include the basis for risk assessment, data sources, confidence level distribution, and precise handling suggestions.

[0066] In this embodiment of the application, a report interpretation method is provided, comprising: preprocessing a target security report and inputting it into a first preset model to extract key information to obtain key knowledge points; converting the key knowledge points into key knowledge point vectors and inputting them into a second preset model to perform feature extraction and feature fusion to generate a preliminary interpretation result; inputting the preliminary interpretation result as a core input parameter into a confidence rule base, and using the confidence rule base to perform evidence reasoning and external heterogeneous data fusion on the core input parameter to generate a final interpretation result. In this embodiment, by standardizing the report and extracting key information, redundant and interfering data is effectively filtered out, reducing information omissions and interpretation biases. Combined with feature extraction and fusion of the second preset model, the semantic relevance of information is further strengthened, and the accuracy of the preliminary interpretation results is improved. By introducing a confidence rule base and integrating external heterogeneous data, evidence reasoning is used to complete cross-validation of multi-source data and supplementation of domain knowledge, outputting decision results with confidence distribution. This not only corrects the bias of interpretation by a single model through cross-validation of multi-source data, but also measures the reliability of the results with confidence, further optimizing the accuracy of the answer. This achieves the core requirements of the security field for accurate, reliable, efficient and verifiable report interpretation results.

[0067] In one embodiment of this application, the preprocessing of the target security report and its input into a first preset model for key information extraction to obtain key knowledge points includes:

[0068] The content of the target security report is decomposed into text structure, cleaned, and formatted to obtain standardized structured text data;

[0069] The structured text data is classified and associated to identify the relationships and attribute features between information, so as to convert the structured text data into an input format that can be processed by the first preset model;

[0070] The key knowledge points are obtained by repeatedly performing linear mapping and normalization on the structured text data after the format conversion using the first preset model, and then performing residual connection operations.

[0071] As shown in Figure 2, optionally, the target security report input by the user is first split into multimodal content, extracting text blocks, table data, and image data (including OCR-extracted image text), and simultaneously recording physical location metadata such as page numbers and chapters of each content; then, data cleaning is performed, standardizing professional terminology, filtering noisy characters, correcting table outliers, converting table data into text sequences including field-value pairs, and associating image text with corresponding chapters; subsequently, the cleaned data is integrated according to chapter logic, adding type identifiers and location metadata to form chapter-level structured text, which is then input into a first preset model (such as the ERNIE-Gram model). The first preset model cleans up special symbols and other data in the structured text that may interfere with the model training results, obtains the processed data, performs association and classification, identifies the relationships and attribute features between information, and thus transforms the structured text into the input tensor of the ERNIE-Gram model.

[0072] Finally, the first pre-defined model leverages its ability to capture phrase-level semantic relationships to segment the input text, dividing it into individual word units and mapping each unit to a pre-trained word vector space to obtain corresponding word embedding vectors. A multi-layer Transformer encoder structure is then used to process the word embedding vector sequence. In each Transformer layer, a self-attention mechanism is used to calculate the attention weights between each word unit and other word units, thereby capturing the semantic relationships between word units in the text, such as the relationship between vulnerability types and their impact, and handling recommendations in a security report. Simultaneously, residual connections and layer normalization techniques are combined to alleviate the gradient vanishing problem during deep network training, enabling the model to learn the deep semantic features of the text more effectively. Then, considering the professional nature of security reports, the model uses the domain knowledge learned during pre-training to provide more accurate semantic representations of these professional terms. Through multiple linear mappings and normalization processes, the semantic information of the text is transformed into high-dimensional feature representation vectors. Finally, the encoded feature representation vector is further processed. Through specific classification or extraction heads (such as attention-based extraction heads), key knowledge points in the target security report are identified and extracted from the feature vector, such as vulnerability type, risk level, scope of affected assets, and existing remediation measures, which are core information with clear semantic association attributes.

[0073] In one embodiment of this application, the step of classifying and associating the structured text data to identify the relationships and attribute features between information includes:

[0074] The structured text data is segmented, the segmented text is position-encoded to mark the position information of each word, and the position-encoded text is converted into an embedding vector.

[0075] Based on the embedding vector, n-gram units of different lengths are constructed, and each n-gram unit is explicitly identified to distinguish independent semantic units;

[0076] The explicitly labeled n-gram units are classified and associated to identify the relationships and attribute features between information.

[0077] Optionally, after segmenting the structured text data according to semantic logic, a positional encoding (marking its positional information in the text) is added to each word, and then the text containing positional information is converted into an embedding vector, which preserves the semantic features of the word and clarifies its positional association. Then, based on the embedding vector, n-gram units of different lengths are constructed (an n-gram unit is a segment of n consecutive words or characters in the text, where n is an integer greater than or equal to 2), and different semantic units are distinguished by explicit labels (such as special tags) (for example, marking "high-risk vulnerability" and "impact scope" as independent n-gram units), thereby focusing on phrase-level information with complete semantics in the text and avoiding semantic fragmentation caused by single words. The explicitly labeled n-gram units are then classified by association: the model learns the semantic association between different n-gram units (such as the causal association between "high-risk vulnerability" and "disposal recommendations"), and at the same time identifies the attribute features of each unit (such as the "risk level" attribute of "high-risk vulnerability" and the "asset type" attribute of "impact scope"), ultimately realizing the systematic identification of information associations and attribute features in structured text. Modeling by explicitly labeling n-gram units can both ensure the semantic integrity of n-gram units and reduce the prediction space of the model.

[0078] In one embodiment of this application, the step of classifying the n-gram units to identify the relationships and attribute features between information includes:

[0079] Based on the training sample data, n-gram unit samples are obtained;

[0080] Based on the mask training task, the n-gram unit samples are trained using a preset loss function until the model converges, and the trained model parameters are obtained.

[0081] Based on the trained model parameters, the n-gram units are classified to identify the relationships and attribute features between information.

[0082] Optionally, during the training of the first preset model, the masking training task can be optimized for the professional characteristics of the security reporting domain. For example, by preprocessing the collected training sample data, such as publicly available security report data and the structured text processed by the first model, n-gram unit samples can be generated. Then, the security professional term combinations in the n-gram unit samples (such as n-gram units specific to the domain, such as "SQL injection", "high-risk vulnerability", and "core assets") can be masked in a key way, so that the model can focus more on learning the association logic of key semantic units in the security domain. At the same time, a domain-adaptive preset loss function can be introduced, such as the cross-entropy loss function, to further enhance the model's learning accuracy of security domain-specific associations. The above process is repeated until the model converges, and the trained model parameters can be obtained. The trained model parameters can then be used to classify the n-gram units generated in the subsequent actual inference process to identify the association relationships and attribute features between information.

[0083] The loss function can be defined as follows:

[0084] ;

[0085] in, This indicates the statement following the masking operation. This represents the character being masked. This indicates that when the model parameters are In the case of a statement after a mask The model predicts the masked characters. The probability, It is the set of masked characters The loss function measures the error in the model's prediction of a masked character by summing the logarithms of the predicted probabilities of all masked characters and then taking the negative of the sum, thereby guiding the optimization of the model parameters.

[0086] Meanwhile, prediction is performed by covering n-Gram entities with a single identifier at a coarse-grained level, ensuring the internal connections of related information and guaranteeing more comprehensive feature and semantic extraction of key information. The overall loss function is shown below:

[0087] ;

[0088] in, Is with Another related part, yes The elements in this part are... Each element in Each of them Calculate the statement after the mask Under the conditions, predict The logarithm of the probability is summed and the negative is taken.

[0089] The goal is to enable the model to not only learn to predict the characters in the direct mask, but also to learn to predict other characters associated with these characters, thereby better capturing the internal relationships of information. By covering n-gram entities in a coarse-grained manner, it ensures that more comprehensive features and semantics can be included when extracting key information.

[0090] In one embodiment of this application, the step of converting the key knowledge points into a key knowledge point vector and inputting it into a second preset model for feature extraction and feature fusion to generate a preliminary interpretation result includes:

[0091] The key knowledge point vector is input into the second preset model, and the second preset model performs top-down feature extraction to obtain the initial feature information.

[0092] The initial feature information is used as a feedback signal and input into the dynamic construction module to generate the preliminary interpretation result.

[0093] Optionally, as shown in Figure 2, the second preset model may include a built-in three-layer collaborative network for top-down feature extraction. These three layers are cross-combined to form two backbone networks, which generate a dynamic contextual attention mechanism. Simultaneously, it integrates a unique contextual dynamic convolution technique, which can adaptively adjust the parameters and structure of the convolution kernels to accurately capture features of different granularities in the key knowledge point vector. After the key knowledge point vector generated by the first preset model is input into the second preset model, the second preset model can extract initial feature information layer by layer from the vector through a top-down feature extraction mechanism (such as multi-layer network collaborative processing), and then pass this initial feature information as a feedback signal to the dynamic construction module. This dynamic construction module may include a third stage consisting of residual 3x3 DWConv (depth-separable convolution), a gated dynamic spatial aggregator, and Con-VFFN dynamically constructing a backbone network combining Base-Net and Focus-Net.

[0094] First, the input key knowledge vector is locally perceived using residual 3x3DWConv (depthwise separable convolution). The depthwise separable design reduces computation while preserving semantic information in the channel dimension, and the residual connections avoid information loss during feature transmission. This ensures that the refined features contain both the original key information and enhanced local correlation details. The refined features then enter a gated dynamic spatial aggregator. This module, based on a dynamic contextual attention mechanism, first calculates the correlation weights at each location in the feature space, and then uses a gating mechanism to filter and aggregate high-weight features, suppressing noise interference. The aggregated features are then fed into Con-VFFN (convolutional-visual feedforward network). Through dynamically adjusted convolutional layers and nonlinear transformations (such as the GELU activation function), the feature channel dimension is expanded to capture global correlations across space. Simultaneously, through dimensionality compression of the feedforward network, high-dimensional features are transformed into a more compact global semantic representation. The enhanced features are fed into the third stage of the backbone network composed of Base-Net and Focus-Net. Base-Net, combined with context-sensitive dynamic convolution, uses adaptively adjusted large-scale convolutional kernels to capture coarse-grained global logic, while Focus-Net uses small-scale dynamic convolutional kernels to deeply mine fine-grained professional features. The two networks interact through a cross-attention mechanism to form fused features. The fused features are then processed by a decoder through linear mapping, outputting preliminary interpretation results that conform to the expression habits of the security field, covering risk assessment, correlation analysis, and targeted recommendations.

[0095] In one embodiment of this application, the step of performing top-down feature extraction using the second preset model to obtain initial feature information includes:

[0096] The key knowledge point vector is reduced to a first preset dimension to generate a mid-level feature map.

[0097] The intermediate-level feature mapping is reduced to a second preset dimension to generate an overall overview feature mapping.

[0098] Perform local perception operations on the overall overview feature map to generate local key data;

[0099] The local key data is standardized and processed to a greater depth, and then transformed nonlinearly to generate a context representation and a similarity matrix.

[0100] Optionally, the second preset model utilizes the built-in Base-Net layer to perform preliminary feature compression and abstraction on the input key knowledge point vectors, preserving the core semantics while reducing data dimensionality. The Base-Net layer, through three embedding layers, progressively downsamples the input information, ultimately reducing the spatial dimensions (height H, width W) of the input to its original size. This generates a mid-level feature map. The resulting mid-level feature map is then input into the model's built-in Overview-Net layer. The Overview-Net layer further downsamples the mid-level feature map to... This generates a semantically meaningful overall feature map. This feature map focuses on a global, macro-level semantic summary of the input information, filtering out many local details and concentrating on the core semantic logic. The resulting overall feature map is then input into a residual 3x3-DWConv (depth-separable convolution) module for local perception operations. The 3x3 convolution kernel size captures the detailed relationships between local regions in the feature map, while the depth-separable convolution reduces computational complexity while maintaining local feature extraction capabilities. The processed features are then passed to a layer normalization layer, an extended residual convolutional layer, and a ConvFFN (convolutional feedforward network) for standardization and depth enhancement. After nonlinear transformation, the context representation and similarity matrix are obtained.

[0101] The resulting similarity matrix can be specifically represented as follows:

[0102] ;as well as

[0103] ;

[0104] Where Q and K represent the two parts of the feature map, and Let represent a 1x1 convolutional layer, Re(·) denote the reshaping operation, K denote the operation of aggregating X into S*S region centers using adaptive average pooling, and Q and K be uniformly mapped to G groups, where G represents the number of groups into which Q and K are uniformly divided, used for grouping and similarity calculation. It can be represented as a single-group similarity matrix, specifically by the following formula:

[0105] ;

[0106] Among them, a single similarity matrix Available from the g-th group (Q's sub-parts after grouping) and The product of the transpose T of (the sub-parts after K is divided into groups) is obtained. A single similarity matrix The feature dimensions.

[0107] In one embodiment of this application, the step of inputting the initial feature information as a feedback signal into the dynamic construction module to generate the preliminary interpretation result includes:

[0108] Based on the mid-level feature mapping and the overall overview feature mapping, the dynamic construction module performs feature fusion and optimization to generate effective fused features.

[0109] The effective fused features are split to obtain new context information and new feature representations, and the initial context information is added to the new context information in a learnable scalar manner to obtain the updated context information;

[0110] Based on the updated context information and new feature representations, a dynamic kernel under a preset spatial dimension is defined and generated.

[0111] The similarity of the effective fused features is calculated to obtain the aggregated feature similarity.

[0112] After normalizing the aggregated feature similarity, weights are assigned through the dynamic kernel and key feature association information is aggregated to generate the preliminary interpretation result.

[0113] Optionally, the mid-level feature map and the overall overview feature map are used as core feedback signals input to the dynamic construction module. These are then deeply fused and optimized using components such as residual convolution and gated aggregation to generate effective fused features that combine global logic with local details. Next, the effective fused features are decomposed into new contextual information (including semantic relationships between features), represented as follows: And the new feature representation (including attribute details), represented as Furthermore, the initial context information is incorporated into the new context using dynamic weights of learnable scalars, such as the initial context. Add to ,Right now Here, i and j are learnable scalars. An updated contextual information is formed that retains historical connections while adapting to new features. Subsequently, based on the updated context and new feature representations, a dynamic kernel with adaptively adjusted parameters is generated in a pre-defined security domain-specific spatial dimension (such as risk assessment or asset association dimension) to accurately capture key feature associations. Simultaneously, similarity calculations are performed on effectively fused features and aggregated to obtain an aggregation result focusing on highly correlated feature pairs. After normalization, the dynamic kernel assigns weights based on the importance of associations and aggregates key feature association information, ultimately transforming it into a preliminary interpretation result that conforms to professional security domain terminology.

[0114] In this context, the function that normalizes the aggregation similarity within a defined K*K dynamic kernel that varies across the G space is expressed as:

[0115] ;

[0116] in, For a learnable parameter matrix, This represents the number of elements in the dynamic kernel in the spatial dimension. Here, H is the normalization function, H is the feature map height, and W is the feature map width.

[0117] In one embodiment of this application, the step of generating effective fused features by performing feature fusion and optimization processing through the dynamic construction module based on the mid-level feature mapping and the overall overview feature mapping includes:

[0118] Based on the mid-level feature mapping and the overall overview feature mapping, the state within the dynamic construction module is corrected, and the context information and feature representation at the entry point of the m-th processing block are generated.

[0119] The context information and feature representation at the entry point of the m-th processing block are fused to obtain the fused feature.

[0120] After the fused features are convolved by the dynamic construction module, they are processed by the dynamic gate mechanism to generate effective fused features.

[0121] Optionally, the dynamic building module receives mid-level feature maps (including local details and intermediate semantic associations) and overall overview feature maps (including the global semantic framework and macro logic). Based on the context information of the preset model, it guides the updating of the feature and kernel weight levels within the Focus-Net layer, and performs real-time adjustments and updates to the state within the forward-transmitted dynamic module (such as recording parameters of historical feature processing logic, feature association weight distribution, etc.). That is, based on the obtained... and Feature information, outputting overall context information and related guidance, thereby obtaining progressively refined mid-level feature maps. The Focus-Net layer expands the receptive domain to obtain a more accurate and informative high-level representation. After the dynamic building module corrects its internal state through mid-level feature mapping and overall overview feature mapping, it outputs initial input information for use by the m-th processing block in the module (such as a specific computational unit in the backbone network), i.e., the context information and feature representation at the entry point of the m-th processing block within the dynamic building module. The context information and feature representation at the entry point of the m-th processing block are as follows: and The result will be and Features are fused by concatenation operations and input into a dynamic building block. Convolution operations are performed, and the outputs of the dynamic gate and its parallel branches are multiplied element-wise to obtain effectively fused features.

[0122] Among them, the mid-level feature mapping injects local detail information into the module to correct the module's accuracy in capturing local associations, while the overall overview feature mapping provides a global semantic reference for the module to calibrate the module's grasp of global associations.

[0123] In one embodiment of this application, after generating the final interpretation result, the method further includes:

[0124] The final interpretation result output by the confidence rule base is used as a secondary training parameter and input into the first preset model and the second preset model for model optimization.

[0125] Based on the optimized first and second preset models, subsequent security report interpretation operations are performed.

[0126] Optionally, the final interpretation result output by the confidence rule base (the accurate interpretation content after rule verification and logical correction) is used as a secondary training parameter and fed back into the first and second preset models, such as the ERNIE-Gram-OverLoCK model formed by combining the ERNIE-Gram model and the OverLoCK model. The first preset model learns the accurate expression of key knowledge points in the final interpretation result, while the second preset model adjusts the feature extraction weights and fusion strategies based on the semantic logic of the final interpretation result. Based on the updated parameters of the first and second preset models, when performing subsequent security report interpretation operations, the model can extract key knowledge points more accurately, capture feature associations more efficiently, and generate higher quality preliminary interpretation results, thereby reducing the correction pressure on the confidence rule base and ultimately improving the efficiency and accuracy of the entire security report interpretation system.

[0127] In this embodiment, by standardizing the report and extracting key information, redundant and interfering data is effectively filtered out, reducing information omissions and interpretation biases. Combined with feature extraction and fusion of the second preset model, the semantic relevance of information is further strengthened, and the accuracy of the preliminary interpretation results is improved. By introducing a confidence rule base and integrating external heterogeneous data, evidence reasoning is used to complete cross-validation of multi-source data and supplementation of domain knowledge, outputting decision results with confidence distribution. This not only corrects the bias of interpretation by a single model through cross-validation of multi-source data, but also measures the reliability of the results with confidence, further optimizing the accuracy of the answer. This achieves the core requirements of the security field for accurate, reliable, efficient and verifiable report interpretation results.

[0128] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0129] In one embodiment, a report interpretation system is provided, which corresponds one-to-one with the report interpretation methods in the above embodiments. As shown in Figure 3, the report interpretation system includes a key knowledge point extraction unit 10, a preliminary interpretation result generation unit 20, and a final interpretation result generation unit 30. Detailed descriptions of each functional module are as follows:

[0130] The key knowledge point extraction unit 10 is used to preprocess the target security report and input it into the first preset model to extract key information in order to obtain key knowledge points.

[0131] The preliminary interpretation result generation unit 20 is used to convert the key knowledge points into key knowledge point vectors and input them into the second preset model to perform feature extraction and feature fusion to generate preliminary interpretation results.

[0132] The final interpretation result generation unit 30 is used to input the preliminary interpretation result as a core input parameter into the confidence rule base, and to perform evidence reasoning and external heterogeneous data fusion on the core input parameter through the confidence rule base to generate the final interpretation result.

[0133] In one embodiment of this application, the key knowledge point extraction unit 10 is further configured to:

[0134] The content of the target security report is decomposed into text structure, cleaned, and formatted to obtain standardized structured text data;

[0135] The structured text data is classified and associated to identify the relationships and attribute features between information, so as to convert the structured text data into an input format that can be processed by the first preset model;

[0136] The key knowledge points are obtained by repeatedly performing linear mapping and normalization on the structured text data after the format conversion using the first preset model, and then performing residual connection operations.

[0137] In one embodiment of this application, the key knowledge point extraction unit 10 is further configured to:

[0138] The structured text data is segmented, the segmented text is position-encoded to mark the position information of each word, and the position-encoded text is converted into an embedding vector.

[0139] Based on the embedding vector, n-gram units of different lengths are constructed, and each n-gram unit is explicitly identified to distinguish independent semantic units;

[0140] The explicitly labeled n-gram units are classified and associated to identify the relationships and attribute features between information.

[0141] In one embodiment of this application, the key knowledge point extraction unit 10 is further configured to:

[0142] Based on the training sample data, n-gram unit samples are obtained;

[0143] Based on the mask training task, the n-gram unit samples are trained using a preset loss function until the model converges, and the trained model parameters are obtained.

[0144] Based on the trained model parameters, the n-gram units are classified to identify the relationships and attribute features between information.

[0145] In one embodiment of this application, the preliminary interpretation result generation unit 20 is further configured to:

[0146] The key knowledge point vector is input into the second preset model, and the second preset model performs top-down feature extraction to obtain the initial feature information.

[0147] The initial feature information is used as a feedback signal and input into the dynamic construction module to generate the preliminary interpretation result.

[0148] In one embodiment of this application, the preliminary interpretation result generation unit 20 is further configured to:

[0149] The key knowledge point vector is reduced to a first preset dimension to generate a mid-level feature map.

[0150] The intermediate-level feature mapping is reduced to a second preset dimension to generate an overall overview feature mapping.

[0151] Perform local perception operations on the overall overview feature map to generate local key data;

[0152] The local key data is standardized and processed to a greater depth, and then transformed nonlinearly to generate a context representation and a similarity matrix.

[0153] In one embodiment of this application, the preliminary interpretation result generation unit 20 is further configured to:

[0154] Based on the mid-level feature mapping and the overall overview feature mapping, the dynamic construction module performs feature fusion and optimization to generate effective fused features.

[0155] The effective fused features are split to obtain new context information and new feature representations, and the initial context information is added to the new context information in a learnable scalar manner to obtain the updated context information;

[0156] Based on the updated context information and new feature representations, a dynamic kernel under a preset spatial dimension is defined and generated.

[0157] The similarity of the effective fused features is calculated to obtain the aggregated feature similarity.

[0158] After normalizing the aggregated feature similarity, weights are assigned through the dynamic kernel and key feature association information is aggregated to generate the preliminary interpretation result.

[0159] In one embodiment of this application, the preliminary interpretation result generation unit 20 is further configured to:

[0160] Based on the mid-level feature mapping and the overall overview feature mapping, the state within the dynamic construction module is corrected, and the context information and feature representation at the entry point of the m-th processing block are generated.

[0161] The context information and feature representation at the entry point of the m-th processing block are fused to obtain the fused feature.

[0162] After the fused features are convolved by the dynamic construction module, they are processed by the dynamic gate mechanism to generate effective fused features.

[0163] In one embodiment of this application, the system further includes a model optimization unit, used for:

[0164] The final interpretation result output by the confidence rule base is used as a secondary training parameter and input into the first preset model and the second preset model for model optimization.

[0165] Based on the optimized first and second preset models, subsequent security report interpretation operations are performed.

[0166] In this embodiment, by standardizing the report and extracting key information, redundant and interfering data is effectively filtered out, reducing information omissions and interpretation biases. Combined with feature extraction and fusion of the second preset model, the semantic relevance of information is further strengthened, and the accuracy of the preliminary interpretation results is improved. By introducing a confidence rule base and integrating external heterogeneous data, evidence reasoning is used to complete cross-validation of multi-source data and supplementation of domain knowledge, outputting decision results with confidence distribution. This not only corrects the bias of interpretation by a single model through cross-validation of multi-source data, but also measures the reliability of the results with confidence, further optimizing the accuracy of the answer. This achieves the core requirements of the security field for accurate, reliable, efficient and verifiable report interpretation results.

[0167] Specific limitations regarding the report interpretation system can be found in the limitations of the report interpretation method described above, and will not be repeated here. Each module in the aforementioned report interpretation system can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0168] In one embodiment, a computer device is provided, which may be a terminal device, and its internal structure diagram is shown in Figure 4. The computer device includes a processor, memory, and a network interface connected via a system bus. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes a readable storage medium. The readable storage medium stores computer-readable instructions. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer-readable instructions are executed by the processor, they implement a report interpretation method. The readable storage medium provided in this embodiment includes both non-volatile readable storage media and volatile readable storage media.

[0169] In this application embodiment, a computer device is provided, including a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor. When the processor executes the computer-readable instructions, it implements the steps of the report interpretation method described above.

[0170] In one embodiment of the application, a readable storage medium is provided, which stores computer-readable instructions. When the computer-readable instructions are executed by a processor, they implement the steps of the report interpretation method described above.

[0171] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing related hardware with computer-readable instructions. These computer-readable instructions can be stored in a non-volatile readable storage medium or a volatile readable storage medium. When executed, these computer-readable instructions can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0172] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0173] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for interpreting reports, characterized in that, The method includes: preprocessing the target security report and inputting it into a first preset model to extract key information to obtain key knowledge points, wherein the first preset model is an ERNIE-Gram model; converting the key knowledge points into key knowledge point vectors and inputting them into a second preset model for feature extraction and feature fusion to generate preliminary interpretation results, including: performing dimensionality reduction processing on the key knowledge point vectors through the second preset model to obtain an overall overview feature map; performing local perception operations on the overall overview feature map to obtain local key data; performing standardization and depth enhancement processing on the local key data, and generating a context representation and similarity matrix through nonlinear transformation; completing top-down feature extraction to obtain initial feature information; inputting the initial feature information as a feedback signal into a dynamic construction module to generate preliminary interpretation results, wherein the second preset model is an OverLoCK model; inputting the preliminary interpretation results as core input parameters into a confidence rule base; and performing evidence reasoning and external heterogeneous data fusion on the core input parameters through the confidence rule base to generate a final interpretation result.

2. The report interpretation method as described in claim 1, characterized in that, The preprocessing of the target security report and its input into a first preset model for key information extraction to obtain key knowledge points includes: deconstructing the text structure of the target security report, cleaning and unifying the data format to obtain standardized structured text data; classifying the structured text data to identify the relationships and attribute features between information, thereby converting the structured text data into an input format that can be processed by the first preset model; and performing multiple linear mapping and normalization processes on the converted structured text data through the first preset model, followed by residual connection operations to obtain the key knowledge points.

3. The report interpretation method as described in claim 2, characterized in that, The step of classifying and associating the structured text data to identify the relationships and attribute features between information includes: segmenting the structured text data; performing positional encoding on the segmented text to mark the positional information of each word; and converting the positionally encoded text into an embedding vector; constructing n-gram units of different lengths based on the embedding vectors; explicitly labeling each n-gram unit to distinguish independent semantic units; and classifying and associating the explicitly labeled n-gram units to identify the relationships and attribute features between information.

4. The report interpretation method as described in claim 3, characterized in that, The step of classifying and associating the explicitly labeled n-gram units to identify the relationships and attribute features between information includes: obtaining n-gram unit samples based on training sample data; training the n-gram unit samples using a preset loss function based on a mask training task until the model converges to obtain the trained model parameters; and classifying and associating the n-gram units based on the trained model parameters to identify the relationships and attribute features between information.

5. The report interpretation method as described in claim 1, characterized in that, The step of reducing the dimensionality of the key knowledge point vector through the second preset model to obtain the overall overview feature map includes: reducing the dimensionality of the key knowledge point vector to a first preset dimension to generate a mid-level feature map; and reducing the mid-level feature map to a second preset dimension to generate the overall overview feature map.

6. The report interpretation method as described in claim 5, characterized in that, The initial feature information is input as a feedback signal into the dynamic construction module to generate a preliminary interpretation result, including: based on the mid-level feature mapping and the overall overview feature mapping, feature fusion and optimization are performed by the dynamic construction module to generate effective fused features; the effective fused features are split to obtain new context information and new feature representations, and the initial context information is added to the new context information in a learnable scalar manner to obtain updated context information; based on the updated context information and the new feature representations, a dynamic kernel under a preset spatial dimension is defined and generated; similarity is calculated on the effective fused features to obtain aggregated feature similarity; after normalizing the aggregated feature similarity, weights are assigned through the dynamic kernel and key feature association information is aggregated to generate the preliminary interpretation result.

7. The report interpretation method as described in claim 6, characterized in that, The step of generating effective fused features by performing feature fusion and optimization processing through the dynamic construction module based on the mid-level feature mapping and the overall overview feature mapping includes: correcting the state within the dynamic construction module based on the mid-level feature mapping and the overall overview feature mapping to generate context information and feature representation at the entry point of the m-th processing block; fusing the context information and feature representation at the entry point of the m-th processing block to obtain fused features; and generating effective fused features by performing a convolution operation on the fused features through the dynamic construction module and then processing them through a dynamic gate mechanism.

8. The report interpretation method as described in any one of claims 1-7, characterized in that, After generating the final interpretation result, the method further includes: using the final interpretation result output by the confidence rule base as a secondary training parameter and inputting it into the first preset model and the second preset model for model optimization; and performing subsequent security report interpretation operations based on the optimized first preset model and the second preset model.

9. A report interpretation system, characterized in that, The system includes: a key knowledge point extraction unit, used to preprocess the target security report and input it into a first preset model for key information extraction to obtain key knowledge points, wherein the first preset model is an ERNIE-Gram model; and a preliminary interpretation result generation unit, used to convert the key knowledge points into key knowledge point vectors and input them into a second preset model for feature extraction and feature fusion to generate preliminary interpretation results, including: performing dimensionality reduction processing on the key knowledge point vectors through the second preset model to obtain an overall overview feature map, and performing local perception on the overall overview feature map. The process involves obtaining local key data, standardizing and deepening this data, and then performing nonlinear transformations to generate a context representation and similarity matrix. This process performs top-down feature extraction to obtain initial feature information, which is then used as a feedback signal to input into a dynamic construction module to generate preliminary interpretation results. The second preset model is the OverLock model. A final interpretation result generation unit takes the preliminary interpretation results as core input parameters and inputs them into a confidence rule base. The confidence rule base then performs evidence reasoning and external heterogeneous data fusion on these core input parameters to generate the final interpretation result.

Images