Enabling decision assistance method, device and equipment for data security control

Abstract

The invention relates to the technical field of data processing for risk management, in particular to an enabling decision assistance method, device and equipment for data security control. The method provided by the invention comprises the following steps: acquiring multi-data-source information applied by data security enabling, and constructing a standardized feature vector according to the multi-data-source information; calling a first large model, retrieving historical similar cases based on the standardized feature vector, counting risk distribution features in the similar cases, and generating a decision evaluation criterion according to the risk distribution features; and calling a second large model, taking a decision evaluation standard output by the first large model as a decision framework, performing structured verification analysis on the multi-data-source information, and outputting an enabling decision suggestion, thereby preventing the multi-data-source information from directly influencing the preference of the enabling decision suggestion. According to the method and the device, non-technical approval personnel can be more accurately assisted to make a decision on whether the data control permission is enabled or not.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing for risk management, and in particular to an enabling decision assistance method, device and equipment for data security control. BACKGROUND

[0002] In the modern industrial information environment, enabling refers to granting specific users access, operation and / or management rights to critical data and production control systems within a certain period of time through authorization. The enabling approval of data security control is a key link of enterprise information security management, involving the evaluation and decision of the rights application proposed by external suppliers, technical service personnel and temporary personnel.

[0003] The main difficulty at present is that although enterprises have established relatively perfect identity authentication and rights management mechanisms at the technical level, the actual approval is still undertaken by non-technical personnel in the business or administrative department. Such personnel, although having management and business judgment ability, have limited understanding of complex system architecture, network security risks and data sensitivity, and it is difficult to accurately evaluate the rationality of the rights demand, whether the application scope is appropriate and whether the potential risks are controllable.

[0004] The gap between this ability and technical complexity easily leads to problems such as strong subjectivity, inconsistent standards and insufficient risk identification in enabling decision-making. On the one hand, excessive caution may restrict reasonable business needs and affect production efficiency and supplier cooperation; on the other hand, insufficient judgment may release applications with hidden dangers, threatening the data security of the enterprise.

[0005] Therefore, it is necessary to propose a method and device for enabling decision assistance for data security control for non-technical approvers, so that non-technical approvers can more accurately decide whether to enable data control rights, and realize the security control of data. SUMMARY

[0006] In order to solve the above technical problems or at least partially solve the above technical problems, the present application provides an enabling decision assistance method and device for data security control, which can more accurately assist non-technical approvers to decide whether to enable data control rights.

[0007] In a first aspect, the present application provides an enabling decision assistance method for data security control, which comprises the following steps: Obtain multi-source information of a data security enabling application, and construct a standardized feature vector according to the multi-source information; calling a first large model to retrieve historical similar cases based on the standardized feature vector, counting risk distribution features in the similar cases, and generating decision evaluation criteria according to the risk distribution features; calling a second large model to perform structured verification analysis on the multi-data-source information based on the decision evaluation criteria output by the first large model as a decision framework, and outputting an enabling decision suggestion to avoid the multi-data-source information directly affecting the preference of the enabling decision suggestion.

[0008] Optionally, the process of calling the first large model to retrieve historical similar cases based on the standardized feature vector, counting risk distribution features in the similar cases, and generating decision evaluation criteria according to the risk distribution features includes the following steps: The first large model matches the standardized feature vector with a historical case vector database to obtain a preset statistical number of historical cases with the highest similarity; The approval results and subsequent event records are extracted from the historical cases to count the approval pass rate, problem occurrence rate, and problem type distribution; Based on the statistical results, the risk differentiation ability of the four risk dimensions of identity verification, permission control, time limit, and business evaluation in similar historical cases is analyzed, and the risk differentiation ability is normalized to form a dynamic weight configuration; The decision evaluation criteria containing the dynamic weight configuration are output as verification criteria for each risk dimension to guide the structured verification analysis of the second large model.

[0009] Optionally, the process of calling the first large model to generate decision evaluation criteria further includes the following steps: Cross-data-source conflict detection is performed on the multi-data-source information to calculate the conflict intensity between different data source information; The dynamic weight configuration is adjusted based on the conflict intensity, wherein the conflict degree is positively correlated with the weight adjustment amplitude of the corresponding risk dimension; The output of the decision evaluation criteria containing the dynamic weight configuration as the verification criteria for each risk dimension to guide the structured verification analysis of the second large model includes that the first large model outputs the decision evaluation criteria containing the adjusted dynamic weight configuration to guide the second large model to perform structured verification analysis based on the adjusted weight configuration.

[0010] Optionally, the process of detecting cross-data-source conflicts in the multi-data-source information and calculating the conflict intensity between different data source information includes the following steps: Performing time consistency verification: comparing the failure start time recorded by the monitoring system data with the time point described by the applicant in the application form data, and the logical relationship between the application submission time and the claimed urgency to analyze the time conflict intensity; Performing phenomenon description consistency verification: comparing the corresponding relationship between the fault phenomenon described by the applicant in the application form and the abnormal event in the monitoring system data, and the matching degree between the impact range description and the actual monitored device range, to analyze the phenomenon conflict intensity; Performing authority requirement rationality verification: analyzing the matching degree between the authority application range in the application form and the fault impact range displayed by the monitoring system data, and determining the minimum necessary authority range based on fault location, to analyze the authority conflict intensity.

[0011] Optionally, the process of adjusting the dynamic weight configuration based on the conflict intensity includes the following steps: Calculate the conflict intensity total value based on the time conflict intensity, phenomenon conflict intensity and authority conflict intensity; Calculate the proportion of each conflict dimension in the conflict intensity total value; Determine the weight adjustment range according to the size of the conflict intensity total value, and adjust the weight of the corresponding risk dimension in the dynamic weight configuration according to the weight adjustment range and the proportion of each conflict dimension; Normalize the adjusted weight to ensure that the total weight is 1.

[0012] Optionally, the process of matching the standardized feature vector with the historical case vector database by the first large model to obtain the highest similarity of a preset statistical number of historical cases includes the following steps: Calculate the similarity between the standardized feature vector and the standardized feature vector of the historical case stored in the historical case vector database, and obtain the database search identifier corresponding to the highest similarity of a preset statistical number of historical cases; Retrieve the corresponding historical case detailed data from the independently stored case database according to the database search identifier, including approval results, subsequent event records and problem classification information; Wherein, the historical case vector database stores the standardized feature vector representation and the corresponding identifier of the historical case, and the case database stores the detailed content of the historical case, so that the two are stored separately to avoid the direct influence of detailed case content on the feature matching process.

[0013] Optionally, the second large model uses the decision evaluation standard output by the first large model as the decision framework, and the structured verification analysis of the multi-data source information specifically includes: Performing differential verification process based on the adjusted dynamic weight configuration, and adopting different depth verification strategies for different risk dimensions according to the weight; Wherein, the high weight dimension executes the preset comprehensive verification strategy, the medium weight dimension executes the preset key verification strategy, and the low weight dimension executes the preset basic verification strategy; Output natural language-enabled decision recommendations for non-technical managers, including dimension verification results, overall compliance, approval decision types, and implementation requirements.

[0014] In a second aspect, the present application provides an enabling decision assistance device for data security control, comprising at least one module for executing the enabling decision assistance method for data security control of any of the first aspect.

[0015] In a third aspect, the present application provides a computer device comprising a processor for executing a computer program stored in a memory to implement the enabling decision assistance method for data security control of any of the first aspect.

[0016] The technical scheme provided by the present application has the following advantages compared with the prior art: One of its beneficial effects and working principle is that: When the manager processes multi-modal raw data containing monitoring system ERROR logs, applicant urgent expressions, etc. with strong emotional color, it is easy to be disturbed by emotional information and make biased judgments. When faced with a large number of abnormal errors, it is easy to think that the situation is indeed urgent and tend to recommend approval, and when the emotional expression of the application text is strong, it is easy to be affected by emotional description and objective analysis ability. This phenomenon leads to a lack of consistency and objectivity in approval decisions.

[0017] Similarly, when the large model that aligns with human preferences directly contacts these multi-modal data with emotional color, similar judgment biases also occur. In the face of dense error logs or emotional language in the application, the large model is easy to be misled by the emotional intensity, and thus make a less objective decision recommendation.

[0018] The present application solves this problem by designing a double large model separation architecture. The first large model obtains decision evaluation standards through cleaned historical case statistical data, avoiding emotional expressions that may exist in the current application. The second large model analyzes the current application materials under the guidance of this objective standard. Since there is a rational decision framework as a constraint, even in the face of emotionally intense application content, it can maintain an objective position. The two models cooperate with each other, one ensures the objectivity of the standard, and the other ensures the comprehensiveness of the analysis, avoiding the undue influence of emotional information in multi-modal information on the final decision.

[0019] This separation architecture enables the approval decision to maintain consistent objectivity in various situations. No matter how many error messages the monitoring system reports, no matter how urgent the applicant's description is, the method proposed by the present application can make a rational judgment and will not be influenced by the surface emotional intensity.

[0020] Therefore, the problem of relaxing the review standard due to excessive tension is avoided, and the problem of excessive strictness due to emotional resistance is avoided, so that non-technical background managers can obtain objective, consistent and reliable decision-making suggestions.

[0021] Therefore, the enabling decision assistance method for data security control provided in the present application can more accurately assist non-technical approvers in making decisions on whether to enable data control permissions.

[0022] The second beneficial effect and its working principle are: Different types of industrial data security applications exhibit different risk distribution characteristics in historical practice. Some types of applications are prone to problems in identity verification, such as incomplete or expired identity documents of external suppliers, while others are prone to permission abuse, such as maintenance personnel accessing sensitive data beyond their maintenance scope after obtaining permissions. The traditional approval system uses fixed evaluation criteria and cannot adjust according to these historical experiences.

[0023] The present application converts the multi-data source information of the current application into a standardized feature vector, and finds a similar case set in the historical case database through similarity calculation. Statistical analysis is performed on these similar cases, and the problem occurrence frequency and risk discrimination ability of each risk dimension in the historical cases are calculated. If 40% of the similar cases retrieved have permission abuse problems, and identity verification problems only account for 15%, the system will increase the weight of the permission control dimension and reduce the weight of the identity verification dimension. This dynamic weight adjustment mechanism allows each evaluation to utilize the risk distribution rules in historical experience.

[0024] This weight adjustment based on historical experience improves the evaluation accuracy. Different types of applications obtain evaluation criteria that conform to their historical risk characteristics, avoiding the problem of uniform standards. More attention is paid to risk points that have often caused problems in the past, and the process is appropriately simplified for aspects that have performed well historically. This improves the accuracy of risk identification and avoids unnecessary delays in the approval process.

[0025] The third beneficial effect and its working principle are: Data security applications in industrial environments involve multiple independent data sources such as forms filled out by applicants, system automatically monitored data, uploaded attachments, and business-related information. When an applicant attempts to provide false information or exaggerate the severity of the problem, there will be logical conflicts in the factual level between different data sources.

[0026] For example, the applicant claims that the device has failed from a certain time point, but the monitoring system records show that the device is running normally during this period, or the applicant describes the need for full system administrator privileges, but the actual monitoring data shows that the problem is only concentrated in individual modules. The traditional approval system lacks conflict detection capabilities across data sources and cannot identify such inconsistencies.

[0027] The present application detects cross-data-source fact conflicts through three dimensions of time consistency verification, phenomenon description consistency verification, and privilege requirement rationality verification. For example, compare the failure start time recorded by the monitoring system with the time point described by the applicant, analyze the correspondence between the failure phenomenon described by the applicant and the abnormal events in the monitoring log, and evaluate the matching degree of the application privilege range and the actual failure impact range. By identifying these conflicts, quantifying the strength of the conflicts, calculating a comprehensive conflict index, and dynamically adjusting the sensitivity weight of risk assessment according to the conflict degree, the higher the conflict degree, the greater the weight of the key risk dimension, thus making the risk assessment more sensitive.

[0028] This multi-data-source cross-verification mechanism improves the ability to identify false applications. Through multi-source data cross-verification, it avoids being deceived by a single data source. At the same time, according to the conflict degree, the strictness of the approval is adjusted, which ensures safety and avoids hindering normal applications.

[0029] Therefore, the enabling decision assistance method for data security control proposed in the present application can more accurately assist non-technical approval personnel in making decisions on whether to enable data control privileges. BRIEF DESCRIPTION OF DRAWINGS

[0030] Figure 1 Application scenario diagram of the enabling decision method for data security control provided by the embodiments of the present application; Figure 2 Flowchart of the enabling decision method for data security control provided by the embodiments of the present application; Figure 3 Flowchart of the enabling decision method for data security control provided by the embodiments of the present application; Figure 4 Flowchart of the enabling decision method for data security control provided by the embodiments of the present application. DETAILED DESCRIPTION

[0031] The technical solutions in the present application will be described below with reference to the accompanying drawings.

[0032] To make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in further detail below with reference to the accompanying drawings.

[0033] Before the embodiments of the present application are explained in detail, the application scenarios involved in the embodiments of the present application are introduced.

[0034] Figure 1 The application scenario of the enabling decision method for data security control provided by the embodiments of the present application is shown in FIG. 1. Figure 1 As shown in FIG. 1, a data control authority requester submits a data security enabling application to a non-technical approval personnel, and the non-technical approval personnel performs approval through an enabling decision auxiliary device and feeds back relevant opinions.

[0035] The enabling decision auxiliary device performs the enabling decision auxiliary method according to the embodiments described below. First, a first large model (which can be configured in a cloud server) is called to retrieve historical similar cases based on a standardized feature vector and generate a decision evaluation standard. Then, a second large model (which can be configured in a cloud server) is called to perform structured verification analysis on multi-source information with the decision evaluation standard as a framework. The enabling decision auxiliary device outputs a natural language enabling decision suggestion for the non-technical approval personnel according to the analysis result, assisting the non-technical approval personnel to make a decision on whether to enable the data control authority. The first large model and the second large model described in the embodiments of the present application can be implemented by using existing general large language models, such as Wenxin Yiyang, Tongyi Qianwen series, etc.

[0036] The enabling decision auxiliary method for data security control provided by the embodiments of the present application can be executed by an enabling decision auxiliary device for data security control. The device includes at least one module for executing the enabling decision auxiliary method for data security control described in the embodiments below.

[0037] Figure 2 One of the flowcharts of the enabling decision method for data security control provided by the embodiments of the present application is shown in FIG. 2. Figure 2 As shown in FIG. 2, the enabling decision auxiliary method for data security control includes the following steps: S201: Obtain multi-source information of a data security enabling application, and construct a standardized feature vector according to the multi-source information.

[0038] Specifically, in the embodiments of the present application, the multi-source information includes application form data, system background data, monitoring system data, uploaded attachment data, and business association data.

[0039] For example, in the embodiments of the present application, the application form data includes basic information filled by the applicant, including applicant type, authority level, access method, application purpose, text description of application reason, emergency level, and estimated processing time.

[0040] System background data includes the applicant's historical records, credit rating, application time, network environment information and department status information automatically obtained from the system.

[0041] Monitoring system data includes relevant device monitoring logs, event statistics, device status snapshots and fault distribution statistics automatically associated by the system.

[0042] Upload attachment data includes fault phenomenon screenshots, explanatory documents and their metadata information provided by the applicant.

[0043] Business association data includes impact range analysis, production status information and related personnel information automatically associated by the system.

[0044] The process of constructing a 35-dimensional standardized feature vector according to the multi-data source information includes: Extract the applicant type code (3-dimensional one-hot vector), permission level code (4-dimensional one-hot vector), access method code (3-dimensional one-hot vector) and pre-processing time data after logarithmic normalization (1-dimensional) from the application form data.

[0045] Extract the application time code (3-dimensional one-hot vector), historical application frequency and credit rating normalization value (each 1-dimensional) and department status code (3-dimensional) from the system background data.

[0046] Extract the data sensitivity level (1-dimensional), business association degree calculation value (1-dimensional) and department affiliation code (5-dimensional one-hot vector) from the business system association data.

[0047] Extract the fault severity, device impact range and system stability normalization values (each 3-dimensional) from the monitoring system data.

[0048] Combine the above dimensional features to form a 35-dimensional standardized feature vector.

[0049] S202: Call the first large model, retrieve historical similar cases based on the standardized feature vector, count the risk distribution characteristics in the similar cases, and generate decision evaluation standards according to the risk distribution characteristics.

[0050] Figure 3 Flowchart two of the enabling decision method for data security control provided by the embodiments of the present application. Referring to Figure 3 As shown, specifically, the process of calling the first large model, retrieving historical similar cases based on the standardized feature vector, counting the risk distribution characteristics in the similar cases, and generating decision evaluation standards according to the risk distribution characteristics includes the following steps: S301: The first large model matches the standardized feature vector with the historical case vector database to obtain a preset statistical number of historical cases with the highest similarity.

[0051] Figure 4 A flowchart of a third method for enabling decision-making for data security control is provided in an embodiment of the present application. Referring to Figure 4 As shown, the process of matching the standardized feature vector with the historical case vector database by the first large model to obtain a preset statistical number of historical cases with the highest similarity includes the following steps: S401: Calculate the similarity between the standardized feature vector and the standardized feature vector of the historical case stored in the historical case vector database to obtain the database search identifier corresponding to a preset statistical number of historical cases with the highest similarity.

[0052] Specifically, in the embodiment of the present application, the historical case vector database is constructed as a knowledge base, and the first large model retrieves by calling the RAG retrieval tool through MCP (Model Context Protocol).

[0053] The knowledge base stores a plurality of 35-dimensional standardized feature vectors converted from historical approval cases, and each vector corresponds to a unique database search identifier. When the first large model receives the standardized feature vector of the current application, it performs retrieval and matching in the knowledge base.

[0054] Among them, the similarity calculation adopts the cosine similarity algorithm to calculate the cosine similarity between the 35-dimensional standardized feature vector of the current application and each historical case feature vector in the knowledge base. The RAG system sorts the similarity of all historical cases and selects a preset statistical number of historical cases with the highest similarity. For example, in the embodiment of the present application, the preset statistical number is 10, so 10 historical cases with the highest similarity are selected, and a list of database search identifiers corresponding to these high-similarity historical cases is returned.

[0055] S402: Retrieve the corresponding historical case detailed data including the approval result, subsequent event record and problem classification information from the independently stored case database according to the database search identifier.

[0056] Specifically, in the embodiment of the present application, the first large model calls the database retrieval tool through MCP to retrieve the corresponding historical case detailed data from the independently stored case database using the database search identifier list returned by the RAG retrieval tool in step S401.

[0057] The detailed data stored in the case database includes complete application information of the case, approval process records, final approval results (pass, rejection or conditional pass), actual implementation after approval and subsequent event records (such as misuse of authority, time out of control or security incidents, etc.). It also includes problem classification information, which classifies the problems found later into types such as identity verification problems, authority control problems, time limit problems and business evaluation problems. In this way, the complete information of the most similar historical case to the current application is obtained to provide statistical analysis for subsequent statistical analysis.

[0058] The historical case vector database stores the standardized feature vector representation and corresponding identification of the historical case as the RAG knowledge base, and the case database stores the detailed content of the historical case. The two are stored separately to avoid the direct influence of the detailed case content on the RAG retrieval process. This separate storage design ensures the objectivity of the RAG feature retrieval process and avoids the interference of the emotional description in the historical case on the similarity calculation.

[0059] S302: Extract the approval results and subsequent event records from the pre-set statistical number of historical cases with the highest similarity, and statistically analyze the approval pass rate, problem occurrence rate and problem type distribution; based on the statistical results, analyze the risk differentiation ability of the four risk dimensions of identity verification, authority control, time limit and business evaluation in similar historical cases, and normalize the risk differentiation ability to form a dynamic weight configuration.

[0060] Specifically, after the first large model receives the 10 highest similarity historical case detailed data obtained in step S301, it analyzes these cases by calling the statistical analysis tool through MCP. That is, by extracting the subsequent problem records of each historical case, and classifying and counting the problems according to the four risk dimensions of identity verification, authority control, time limit and business evaluation. For example, among the 10 similar cases, identity verification problems occur 1 time, authority control problems occur 4 times, time limit problems occur 2 times, and business evaluation problems occur 1 time.

[0061] Subsequently, the first large model calculates the dynamic weight based on the problem occurrence frequency of each dimension by calling the weight calculation tool through MCP. The principle of weight calculation is that the higher the problem occurrence frequency of a dimension, the greater the risk in similar application types, and higher weight should be allocated for focus. Therefore, in the weight calculation tool in the embodiment of the application, the problem frequencies of each dimension are normalized: identity verification weight = 1 / 8 = 0.125, authority control weight = 4 / 8 = 0.5, time limit weight = 2 / 8 = 0.25, and business evaluation weight = 1 / 8 = 0.125, to form a dynamic weight configuration of each risk dimension.

[0062] S303: Perform cross-data-source conflict detection on the multi-data-source information, and calculate the conflict strength between different data source information.

[0063] Specifically, the following steps are included: Perform time consistency verification: compare the fault start time recorded by the monitoring system data with the time point described by the applicant in the application form data, and the logical relationship between the application submission time and the claimed urgency level, to analyze the time conflict strength.

[0064] Perform phenomenon description consistency verification: compare the fault phenomenon described by the applicant in the application form with the corresponding relationship of abnormal events in the monitoring system data, and the matching degree of the impact range description and the actual monitored device range, to analyze the phenomenon conflict strength.

[0065] Perform authority demand rationality verification: analyze the matching degree of the authority application range in the application form and the fault impact range shown by the monitoring system data, determine the minimum necessary authority range based on fault location, to analyze the authority conflict strength.

[0066] Specifically, in the embodiments of the present application, specifically, the first large model receives multi-data-source information, and performs cross-data-source conflict detection according to the following task prompt word examples: One of the prompt word templates: Role definition: you are a professional industrial data security approval analyst with rich experience in multi-data-source information verification, good at finding logical conflicts and factual inconsistencies between different data sources.

[0067] Analysis dimensions: Time consistency verification: compare the application description time with the monitoring record time, and analyze the logical rationality of application delay and urgency level. Scoring standard: time difference is small and logical rationality is 0 to 0.3, there is slight contradiction is 0.3 to 0.6, obvious contradiction is 0.6 to 1.0.

[0068] Phenomenon description consistency verification: compare the matching degree of application description and monitoring record, and analyze the consistency of fault impact range. Scoring standard: high matching is 0 to 0.3, basic matching but with difference is 0.3 to 0.6, obvious inconsistency is 0.6 to 1.0.

[0069] Authority demand rationality verification: analyze the matching degree of the application authority range and the actual fault impact range, and infer the minimum necessary authority. Scoring standard: conform to the minimum necessary principle is 0 to 0.3, slightly larger than the actual demand is 0.3 to 0.6, obviously over apply is 0.6 to 1.0.

[0070] Output format: { Time conflict strength: numerical value 0 to 1; phenomenon conflict intensity: a value from 0 to 1; authority conflict intensity: a value from 0 to 1; }.

[0071] Specifically, the first large model does not rely on preset fixed thresholds or hard-coded rules when performing the above three types of verification, but rather based on the semantic understanding ability, logical reasoning ability, domain knowledge and common sense learned by the large model from massive texts in the training stage, it makes autonomous comprehensive judgments on multi-data source information (i.e. using the fuzzy reasoning ability of the large model itself to analyze the results). In essence, the actual role of the task prompt word is to give the semantic guidance and guiding scoring interval as a framework guide to help the first large model map the qualitative judgment derived from reasoning to a quantitative conflict intensity value. The determination of the specific value is autonomously completed by the first large model according to the semantic understanding of the conflict degree.

[0072] And in the dimension of time consistency verification, the essence is to make a logical judgment similar to a professional engineer: that is, to compare the device monitoring log record time in the monitoring system data with the time mentioned in the text description of the application reason in the application form data, and analyze the time deviation of the two. At the same time, analyze the logical consistency between the application time and the claimed urgency in the application form, and judge whether the application delay is consistent with the claimed urgency.

[0073] Similarly, in the dimension of phenomenon description consistency verification, the essence is to compare the fault phenomenon described in the text description of the application reason in the application form with the monitoring log record in the monitoring system data, and analyze the semantic consistency of the two in terms of fault type and severity. At the same time, compare the matching degree of the impact range described in the application reason with the impact range analysis in the business correlation data. Thus, the consistency of the phenomenon description with the true phenomenon is judged.

[0074] Similarly, in the dimension of authority demand rationality verification, the essence is to infer the minimum necessary authority range required for fault handling based on the fault distribution statistics in the monitoring system data and the impact range analysis in the business correlation data. Compare the authority level and access method in the application form data with the inferred minimum necessary authority, and judge whether the application authority exceeds the necessary range.

[0075] S304: adjusting the dynamic weight configuration based on the conflict intensity, wherein the conflict degree is positively correlated with the weight adjustment amplitude of the corresponding risk dimension.

[0076] calculating a conflict intensity total value based on the time conflict intensity, the phenomenon conflict intensity, and the authority conflict intensity; calculating the proportion of each conflict dimension in the conflict intensity total value; A weight adjustment range is determined according to the magnitude of the conflict intensity sum value, and the weight of the corresponding risk dimension in the dynamic weight configuration is adjusted according to the weight adjustment range and the proportion of each conflict dimension. Normalization processing is performed on the adjusted weight to ensure that the sum of the weights is 1.

[0077] Specifically, after receiving the conflict intensity of each dimension output by step S303, the first large model adjusts the weight according to the following calculation process: The first large model calculates the conflict intensity sum value, and directly sums the time conflict intensity, phenomenon conflict intensity and permission conflict intensity.

[0078] For example, assuming that the time conflict intensity output by step S303 is 0.1, the phenomenon conflict intensity is 0.05, and the permission conflict intensity is 0.8, the first large model calculates the conflict intensity sum value as follows: conflict sum = 0.1 + 0.05 + 0.8 = 0.95.

[0079] The first large model calculates the proportion of each conflict dimension in the conflict intensity sum value.

[0080] Based on the above example, the time conflict proportion = 0.1 ÷ 0.95 = 0.105, the phenomenon conflict proportion = 0.05 ÷ 0.95 = 0.053, and the permission conflict proportion = 0.8 ÷ 0.95 = 0.842.

[0081] The first large model determines the weight adjustment range according to the magnitude of the conflict intensity sum value.

[0082] In the embodiments of the present application, the adjustment strategy is: When the conflict sum value is less than 1, the weight adjustment range is 5%; When the conflict sum value is in the range of 1 to 2, the weight adjustment range is 10%; When the conflict sum value is greater than 2, the weight adjustment range is 15%.

[0083] The numerical value of the weight adjustment range is set based on experience and can be fine-tuned by a technician according to actual conditions.

[0084] Based on the above example, the conflict sum value is 0.95, which is less than 1, and the weight adjustment range is determined to be 5%.

[0085] The first large model adjusts the weight of the corresponding risk dimension in the dynamic weight configuration according to the weight adjustment range and the proportion of each conflict dimension.

[0086] The adjustment formula is: adjusted weight = original weight × (1 + conflict proportion × weight adjustment range).

[0087] After the weight adjustment, normalization processing is performed so that the adjusted weight and value are 1.

[0088] S305: The first large model outputs a decision evaluation standard containing the adjusted dynamic weight configuration, which is used to guide the second large model to perform structured verification analysis based on the adjusted weight configuration.

[0089] Specifically, after the first large model completes weight adjustment and normalization processing, it outputs the final dynamic weight configuration as a decision evaluation standard.

[0090] S203: Call the second large model to perform structured verification analysis on the multi-data source information based on the decision evaluation standard output by the first large model as a decision framework, and output an enabling decision suggestion, thereby avoiding the preference of the multi-data source information directly affecting the enabling decision suggestion.

[0091] Specifically, the following steps are included: Based on the adjusted dynamic weight configuration, perform a differentiated verification process, and use different depth verification strategies for different risk dimensions according to the weight; Among them, the high weight dimension executes the preset comprehensive verification strategy, the medium weight dimension executes the preset key verification strategy, and the low weight dimension executes the preset basic verification strategy; Output natural language enabling decision suggestions for non-technical management personnel, including dimension verification results, overall compliance, approval decision types, and execution requirements.

[0092] Specifically, after the second large model receives the decision evaluation standard output by the first large model and the multi-data source information of the current application, it performs structured verification analysis according to the following task prompt word examples: Prompt word template two: Role definition: Professional data security approval verification specialist, based on objective decision evaluation standards to conduct comprehensive verification analysis on the application.

[0093] Verification strategy: High weight dimension verification (i.e. verifying all related information and their corresponding relationships): Perform comprehensive verification on risk dimensions with a weight greater than 0.4, and verify the multi-data source information related to this dimension in detail, including application form data, system background data, monitoring system data, uploaded attachment data, and business-related data, to ensure that all related information is complete and reliable.

[0094] Verification standard: If the information is complete and reliable, the verification conclusion is compliance; if the information is basically complete but there are doubts under mutual verification, the verification conclusion is partial compliance; if the information is incomplete or there are obvious problems under mutual verification, the verification conclusion is non-compliance. The specific judgment is completed by you based on semantic understanding and logical reasoning.

[0095] Medium-weight dimension verification (i.e., verifying the main judgment criteria): Perform key verification on risk dimensions with weights between 0.2 and 0.4, focusing on key information and main risk points in this dimension, and ensuring that the main judgment basis is reliable.

[0096] Verification criteria: If the key information is verified, the verification conclusion is in compliance; if the key information is basically reliable but needs to be supplemented, the verification conclusion is partially compliant; if the key information is questionable or missing, the verification conclusion is not compliant. The specific judgment is completed by you based on semantic understanding and logical reasoning.

[0097] Low-weight dimension verification (i.e., verifying the necessary information): Perform basic verification on risk dimensions with weights less than 0.2 to confirm that the necessary information for this dimension has been provided.

[0098] Verification criteria: If the necessary information is clear, the verification conclusion is in compliance; if the necessary information is vague but acceptable, the verification conclusion is partially compliant; if the necessary information is missing or incorrect, the verification conclusion is not compliant. The specific judgment is completed by you based on semantic understanding and logical reasoning.

[0099] Output format: { Dimension verification results: verification conclusions of each weight dimension in the above order of weight priority; Overall compliance: a value between 0 and 1; Approval decision type: approval / conditional approval / rejection; Implementation requirements: specific implementation conditions and monitoring measures; }.

[0100] Specifically, the second large model does not rely on pre-set fixed rules or hard-coded judgment criteria when performing the above verification analysis, but rather uses its semantic understanding ability, logical reasoning ability, domain knowledge and common sense learned from massive texts during the training phase to make autonomous comprehensive judgments on multiple data sources (i.e., using the large model's own fuzzy reasoning ability to analyze and obtain results). In essence, the actual role of the task prompt word is to provide a verification strategy framework and guiding judgment criteria as a guide to help the second large model make structured verification and decision recommendations. The specific judgment is completed by the second large model based on semantic understanding of information credibility.

[0101] The essence is to form a differentiated verification strategy through the guidance of the prompt word to improve verification efficiency: The verification idea of comprehensive verification is to verify all true, i.e., to cross-verify each item of multiple data sources related to this risk dimension in detail to ensure that all relevant information is complete and reliable.

[0102] For example, in the dimension of identity verification, the information to be verified includes: the applicant type and application purpose in the application form data, the applicant historical record and credit rating in the system background data, the proof documents in the uploaded attachment data, and the related personnel information in the business association data. The second model cross- verifies the integrity and consistency of these information.

[0103] For example, in the dimension of permission control, the information to be verified includes: the permission level, access method and application reason in the application form data, the applicant historical record in the system background data, the fault distribution statistics in the monitoring system data, and the impact range analysis in the business association data. The second model cross- verifies the matching of the application permission range and the actual demand.

[0104] For example, in the dimension of time limit, the information to be verified includes: the urgency and expected processing time in the application form data, the application time in the system background data, and the device monitoring log and event statistics in the monitoring system data. The second model cross- verifies the logical consistency of the fault occurrence time, application submission time and urgency.

[0105] For example, in the dimension of business evaluation, the information to be verified includes: the application purpose and application reason in the application form data, the device status snapshot and fault distribution statistics in the monitoring system data, and the impact range analysis and production status information in the business association data. The second model cross- verifies the rationality of the application purpose and the actual business status.

[0106] The key verification idea is to verify the main judgment standard, that is, to verify the key information of this risk dimension to ensure that the main judgment basis is reliable.

[0107] For example, in the dimension of permission control, the key information to be verified includes: the permission level and access method in the application form data, and the impact range analysis in the business association data. The goal of the second model is to judge the matching of the permission application and the business demand.

[0108] For example, in the dimension of identity verification, the key information to be verified includes: the applicant type in the application form data and the credit rating in the system background data. The goal of the second model is to judge the identity credibility of the applicant.

[0109] For example, in the dimension of time limit, the key information to be verified includes: the urgency in the application form data, the application time in the system background data, and the device monitoring log in the monitoring system data. The goal of the second model is to judge the logical consistency of the application timeliness and the urgency. For example, in the dimension of business evaluation, the key information to be verified includes: the application purpose in the application form data and the production status information in the business association data. The goal of the second model is to judge the rationality of the application purpose and the current business status.

[0110] The verification idea of the basic verification is to verify as long as possible, that is, to confirm the necessary information of the risk dimension and ensure that the basic information is provided.

[0111] Taking the time limit dimension as an example, the necessary information to be confirmed includes the expected processing time and the urgency in the application form data.

[0112] Taking the identity verification dimension as an example, the necessary information to be confirmed includes the applicant type in the application form data.

[0113] Taking the permission control dimension as an example, the necessary information to be confirmed includes the permission level in the application form data.

[0114] Taking the business evaluation dimension as an example, the necessary information to be confirmed includes the application purpose in the application form data.

[0115] The second model aims to confirm that the basic information is filled in and within a reasonable range.

[0116] In the above embodiments, all or part can be realized by software, hardware, firmware or any combination thereof. When realized by software, all or part can be realized in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable devices. The computer instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (for example: coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (for example: infrared, wireless, microwave, etc.) mode. The computer readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available medium can be a magnetic medium (for example: floppy disk, hard disk, magnetic tape), optical medium (for example: digital versatile disc (DVD)), or semiconductor medium (for example: solid state disk (SSD)) and the like.

[0117] In the various embodiments of the present application, the terms and / or descriptions between different embodiments are consistent and can be referred to each other if there is no special description and logical conflict, and the technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationship. In the embodiments of the present application, "at least one" means one or more, and "multiple" means two or more. The "and / or" describes the relationship between the associated objects, which means that there can be three kinds of relationships, for example, A and / or B can represent: A exists alone, A and B exist together, and B exists alone, where A and B can be singular or plural. In the textual description of the embodiments of the present application, the character " / ", generally indicates that the associated objects before and after are in an "or" relationship. In the present application, "first", "second", and various numerical designations are only for the convenience of description and do not limit the scope of the embodiments of the present application. For example, to distinguish different messages, etc., rather than to describe a specific order or sequence.

[0118] It can be understood that the various numerical designations involved in the embodiments of the present application are only for the convenience of description and do not limit the scope of the embodiments of the present application. The size of the serial number of the above processes does not mean the order of execution, and the execution order of the processes should be determined by their functions and inherent logic.

[0119] Finally, it should be noted that the above description is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or replacements within the technical scope disclosed in the present application should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. An enabling decision support method for data security control, characterized in that, The enabling decision support method for data security control includes the following steps: Obtain information from multiple data sources for the data security enablement application, and construct a standardized feature vector based on the information from the multiple data sources; The first major model is invoked to retrieve historical similar cases based on the standardized feature vector, statistical risk distribution characteristics in similar cases are analyzed, and decision evaluation criteria are generated based on the risk distribution characteristics. The second major model is invoked, and the decision evaluation criteria output by the first major model are used as the decision framework to perform structured verification analysis on the information from the multiple data sources, and output enabling decision recommendations, thereby avoiding the direct influence of information from multiple data sources on the preferences of enabling decision recommendations.

2. The enabling decision support method for data security control according to claim 1, characterized in that, The process of calling the first major model, retrieving historical similar cases based on the standardized feature vectors, statistically analyzing the risk distribution characteristics of similar cases, and generating decision evaluation criteria based on the risk distribution characteristics includes the following steps: The first major model matches the standardized feature vector with the historical case vector database to obtain the historical cases with the highest similarity based on a preset statistical number. Extract approval results and subsequent event records from the historical cases, and statistically analyze the approval rate, problem occurrence rate, and problem type distribution. Based on statistical results, the risk differentiation capabilities of four risk dimensions—identity verification, access control, time limit, and business assessment—in similar historical cases are analyzed, and the risk differentiation capabilities are normalized to form a dynamic weight configuration. The output includes the decision evaluation criteria with the dynamic weight configuration as the verification criteria for each risk dimension, which is used to guide the structured verification analysis of the second major model.

3. The enabling decision support method for data security control according to claim 2, characterized in that, The process of using the primary model to generate decision evaluation criteria also includes the following steps: Perform cross-data source conflict detection on the information from the multiple data sources and calculate the conflict intensity between information from different data sources; The dynamic weight configuration is adjusted based on the conflict intensity, wherein the degree of conflict is positively correlated with the weight adjustment magnitude of the corresponding risk dimension; The output includes the decision evaluation criteria of the dynamic weight configuration as the verification criteria for each risk dimension, which is used to guide the structured verification analysis of the second major model. This includes: the output of the first major model includes the decision evaluation criteria of the adjusted dynamic weight configuration, which is used to guide the second major model to perform structured verification analysis based on the adjusted weight configuration.

4. The enabling decision support method for data security control according to claim 3, characterized in that, The process of performing cross-data source conflict detection on the information from multiple data sources and calculating the conflict intensity between different data sources includes the following steps: Execution time consistency verification: Compare the fault start time recorded in the monitoring system data with the time point described by the applicant in the application form data, as well as the logical relationship between the application submission time and the claimed urgency level, in order to analyze the intensity of the time conflict; Perform consistency verification of phenomenon description: compare the correspondence between the fault phenomenon described by the applicant in the application form and the abnormal events in the monitoring system data, as well as the degree of matching between the description of the scope of impact and the actual monitored equipment scope, in order to analyze the intensity of phenomenon conflict. Execution permission request rationality verification: Analyze the matching degree between the permission request scope in the application form and the fault impact scope displayed by the monitoring system data, determine the minimum necessary permission scope based on fault location, and analyze the permission conflict intensity.

5. The enabling decision support method for data security control according to claim 4, characterized in that, The process of adjusting the dynamic weight configuration based on the conflict intensity includes the following steps: Calculate the total conflict intensity value based on the time conflict intensity, phenomenon conflict intensity, and permission conflict intensity; Calculate the proportion of each conflict dimension in the total value of conflict intensity; The weight adjustment range is determined based on the sum of the conflict intensities, and the weights of the corresponding risk dimensions in the dynamic weight configuration are adjusted according to the weight adjustment range and the proportion of each conflict dimension. The adjusted weights are normalized to ensure that the sum of the weights is 1.

6. The enabling decision support method for data security control according to claim 2, characterized in that, The first major model matches the standardized feature vectors with a historical case vector database to obtain a preset number of historical cases with the highest similarity. The process includes the following steps: The standardized feature vector is compared with the standardized feature vector of historical cases stored in the historical case vector database to calculate the similarity, and the database search identifier corresponding to the historical case with the highest preset statistical number of similarities is obtained. Based on the database lookup identifier, retrieve the corresponding historical case details from the independently stored case database, including approval results, subsequent event records, and issue classification information; The historical case vector database stores the standardized feature vector representations and corresponding identifiers of historical cases, while the case database stores the detailed content of historical cases. This separate storage of the two prevents the detailed case content from directly affecting the feature matching process.

7. The enabling decision support method for data security control according to claim 1, characterized in that, The second major model uses the decision evaluation criteria output by the first major model as a decision framework to perform structured verification analysis on the information from the multiple data sources, specifically including: A differentiated verification process is executed based on the adjusted dynamic weight configuration, and verification strategies of different depths are adopted for different risk dimensions according to the weight. Among them, the high-weight dimension executes the preset comprehensive verification strategy, the medium-weight dimension executes the preset key verification strategy, and the low-weight dimension executes the preset basic verification strategy. Output natural language-enabled decision-making suggestions for non-technical managers, including verification results of various dimensions, overall compliance, approval decision types, and implementation requirements.

8. An enabling decision support device for data security control, characterized in that, The apparatus includes at least one module for performing the enabling decision support method for data security control as described in any one of claims 1-7.

9. A computer device, characterized in that, The computer device includes a processor for executing a computer program stored in a memory to implement the enabling decision support method for data security control as described in any one of claims 1-7.

Images