An agent-based equal protection evaluation report automatic verification and rule matching system

Abstract

The application provides an equal protection evaluation report automatic checking and rule matching system based on an intelligent agent, comprising a report acquisition module for pulling a to-be-reviewed and historical equal protection report; an audit processing module for calling a Bi-LSTM model with attention embedded by reinforcement learning fine-tuning and knowledge graph fusion to score the report sentence by sentence; a rule management module for storing and analyzing equal protection 2.0 structured machine rules to perform secondary accurate matching on low-confidence sentences; a knowledge graph module for maintaining a multi-dimensional association graph of standard families, control measures and evaluation items and providing graph reasoning; an intelligent agent decision module for generating pass, return, manual review or automatic correction actions according to the audit state; a feedback learning module for collecting manual review differences, incrementally training the model, strategy network and graph vector; and a storage module for saving the report, model, rule, graph and log in a multi-modal manner in a relational database, a graph database and a vector database to implement data governance and access control. The application can improve the audit efficiency, accuracy and standard consistency of the evaluation report.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security and information processing, and more particularly, to an agent-based evaluation report automatic verification and rule matching system. BACKGROUND

[0002] In the field of information security, the evaluation of the protection level (evaluation of the protection level) is an important link to ensure that the information system meets the national information security standards. The traditional evaluation report audit mainly relies on manual operation, and the auditors need to check the report content item by item according to the evaluation standard to judge its compliance. This process not only consumes time and effort, but also is prone to inconsistency and accuracy problems in the audit results due to human factors. With the rapid development of information technology, the scale and complexity of information systems are increasing, and the number and content of the evaluation report are also growing, so the traditional manual audit method has been difficult to meet the efficient and accurate audit demand.

[0003] In recent years, artificial intelligence technology has been widely applied in many fields, and the development of natural language processing (NLP) technology has made it possible to automate text auditing. Some research attempts to use machine learning algorithms to conduct preliminary audits of the evaluation report, but these methods mostly stay at the level of simple text matching and rule application, and cannot effectively handle the complex semantics and multi-dimensional correlation in the report. In addition, the existing technology also has deficiencies in the training and optimization of the audit model, lacks effective feedback learning mechanism, and is difficult to dynamically adjust and optimize according to the actual audit results.

[0004] In the implementation of the embodiments of the present application, there are at least the following problems or defects in the prior art: first, the audit efficiency is low, and the traditional manual audit method is difficult to deal with a large number of complex evaluation reports; second, the audit accuracy is insufficient, and the manual audit is easily affected by subjective factors, resulting in inconsistency of the audit results; third, the existing automatic audit technology cannot effectively handle the complex semantics and multi-dimensional correlation in the report, and the audit precision is limited; fourth, there is a lack of effective feedback learning mechanism, and the audit model is difficult to dynamically optimize and adjust according to the actual audit results. SUMMARY

[0005] The present application provides an agent-based evaluation report automatic verification and rule matching system, comprising:

[0006] The report acquisition module is configured to acquire the to-be-audited evaluation report and the historical evaluation report with the labeled compliance from the evaluation management platform through a secure file transfer protocol; the audit processing module is configured to load the trained audit model and automatically audit the compliance of the to-be-audited evaluation report; the rule management module is configured to store, analyze and match machine-readable audit rules structured according to the clauses of the evaluation 2.0 standard; the knowledge graph module is configured to construct and store a domain knowledge graph based on the multi-dimensional association relationship among the evaluation 2.0 standard family, the security control measures and the evaluation items; the intelligent agent decision module is configured to generate and execute an audit decision action according to the output result of the audit processing module in combination with a reinforcement learning strategy; the feedback learning module is configured to collect the difference between the artificial review result and the system decision result, and generate an incremental training sample; and the storage module is configured to vectorize all report data, model parameters, rule sets, knowledge graph entity relationships and decision logs.

[0007] Further, the trained audit model is obtained by the following steps: the report acquisition module acquires a set of training samples of the historical evaluation report with the labeled compliance; the rule management module provides a basic rule set as prior knowledge; multi-granularity text preprocessing is performed on each report in the training sample set, including document structure analysis and sentence segmentation, to generate corresponding word vector sequences and sentence vector sequences; a bidirectional long short-term memory network model with a fusion attention mechanism is constructed, the word vector sequences and the sentence vector sequences, and relevant entity embedding vectors obtained from the knowledge graph module are fused as model inputs for joint training, and model parameters are optimized until convergence; the feedback learning module is used to continuously obtain incremental samples to fine-tune the model, and the final deployed trained audit model is obtained.

[0008] Further, the multi-granularity text preprocessing includes: using a domain adaptive Chinese word segmentation tool to perform word segmentation processing on the input evaluation report to obtain a Chinese word sequence; performing part-of-speech tagging and named entity recognition on the Chinese word sequence to identify key entities such as security control points, evaluation items, device models and configuration parameters in the report; removing general stop words and domain stop words from the part-of-speech tagged sequence; applying a TF-IDF statistical method to remove low-frequency words with a frequency lower than a preset threshold or to retain a set number of words with the highest word frequency; applying a word2vec extension model trained in combination with the domain knowledge graph to perform word vectorization on the processed word sequence to generate word vector representations with domain semantic features; and simultaneously performing structural analysis on table data in the report, converting the analysis result into a standardized key-value pair sequence and performing vectorization representation.

[0009] Further, the audit processing module uses the trained audit model to audit the to-be-audited cybersecurity evaluation report, specifically including: receiving the to-be-audited cybersecurity evaluation report; performing the multi-granularity text preprocessing consistent with the training phase on the report to obtain its word vector and sentence vector representation; inputting the vector representation into the trained audit model, and calling the knowledge graph module for real-time semantic correlation query, outputting the compliance score and confidence of each sentence in the cybersecurity evaluation report with respect to a specific cybersecurity clause; aggregating the sentence-level scores to generate chapter-level compliance conclusions and overall report compliance conclusions; establishing an audit context vector, recording the decision path and key judgment basis in the audit process, and providing a reference for subsequent audits.

[0010] Further, the audit processing module is further configured to: when the compliance score of a sentence is lower than a preset threshold or the confidence is lower than another preset threshold, mark the sentence as a high-uncertainty abnormal sentence; submit the high-uncertainty abnormal sentence, its context vector, and the associated cybersecurity clause ID to the rule management module for accurate rule matching; update the audit result of the sentence according to the result of accurate rule matching, and send the case to the feedback learning module; and perform root cause analysis on the abnormal sentence to identify the problem type and potential correction scheme causing the compliance problem.

[0011] Further, the rule management module includes a rule library unit, a rule parsing engine, and a rule updating unit; the rule library unit is configured to store the specific security control measure clauses in the cybersecurity 2.0 requirements at all levels in a structured form; the rule parsing engine is configured to perform semantic similarity calculation and logical condition matching on the submitted sentence content and vector features with the clauses in the rule library, and output the matching result and compliance judgment; the rule updating unit is configured to receive manual revision instructions for the rule library from a system administrator, or automatically generate new rule logic according to the output of the feedback learning module; the rule management module further includes a rule conflict detection and resolution mechanism to ensure the consistency and non-contradiction of the rules in the rule library.

[0012] Further, the knowledge graph module includes an entity recognition and linking unit, a relationship extraction unit, and a graph reasoning unit; the entity recognition and linking unit is configured to extract security field entities from the audit report and link them to standard nodes in the knowledge graph; the relationship extraction unit is configured to identify and store the belonging, dependency, mutual exclusion, and satisfaction relationships between entities based on a predefined ontology schema; the graph reasoning unit is configured to provide subgraph query and relationship reasoning services based on graph neural networks for the audit processing module and the rule management module; the knowledge graph module further supports dynamic graph updating and version management to ensure that the graph data is consistent with the latest cybersecurity standards.

[0013] Further, the intelligent agent decision module comprises a policy network unit and an action execution unit; the policy network unit is a neural network based on deep Q learning, which generates an optimal processing strategy according to the current audit state including compliance score distribution, number of high-uncertainty abnormal sentences, knowledge graph query result and historical decision effectiveness; the action execution unit is used for executing the strategy action output by the policy network unit, and the action includes marking the report as automatically passed, returning to a specified modification link, triggering a manual expert review process, or calling an automatic correction submodule to make a suggested modification to the report text.

[0014] Further, the storage module adopts an intelligent multi-modal database system, including a relational database, a graph database and a vector database; the relational database is used for storing structured report metadata and system logs; the graph database is used for storing the knowledge graph data; the vector database is used for storing high-dimensional vector representations of all reports and sentences, and parameters of the trained audit model, and providing a fast retrieval function based on similarity; the storage module further comprises a data governance unit responsible for lifecycle management, quality inspection and access control of data, ensuring consistency and security of data.

[0015] Further, the feedback learning module comprises a difference comparison unit, a sample generation unit and a model optimization unit; the difference comparison unit is used for monitoring and collecting the difference between the manual final review result and the system initial audit result; the sample generation unit converts the difference cases into labeled samples and calculates the sample weight; the model optimization unit uses the weighted incremental samples to periodically fine-tune and optimize the trained audit model, the policy network of the intelligent agent decision module and the entity vector representation of the knowledge graph; the feedback learning module further comprises an effect evaluation unit, which evaluates the performance of the optimized system through A / B testing method, ensuring the stability and effectiveness of system iteration.

[0016] The above-mentioned embodiments according to the present application have at least the following beneficial effects:

[0017] 1. The report acquisition module safely acquires the ETSI EN 506017 report to be audited and the labeled compliance from the ETSI EN 506017 evaluation management platform, providing an accurate and reliable audit data source for the system, ensuring that the audit processing module can be trained and audited based on high-quality samples, thereby improving the accuracy and reliability of the audit result, and solving the audit deviation problem caused by inaccurate data acquisition in traditional manual audit.

[0018] 2、The audit processing module combines multi-granularity text preprocessing, a bidirectional long short-term memory network model with a fusion attention mechanism, and real-time semantic association queries of the knowledge graph module, can perform deep semantic understanding and accurate compliance scoring on the cybersecurity evaluation report, not only improves the audit efficiency, but also enhances the processing capability of complex semantics and multi-dimensional association relationships, and solves the problem of limited audit accuracy and inability to effectively process complex semantics in the prior art.

[0019] 3、The feedback learning module generates incremental training samples by collecting the differences between the artificial review results and the system decision results, and periodically fine-tunes and optimizes the strategy network of the audit model, the agent decision module, and the entity vector representation of the knowledge graph, realizes the dynamic update and continuous improvement of the audit model, ensures that the system can be dynamically adjusted and optimized according to the actual audit results, and solves the problem of lack of effective feedback learning mechanism and difficulty in dynamic optimization and adjustment of the audit model according to the actual audit results in the prior art. BRIEF DESCRIPTION OF DRAWINGS

[0020] The above and other objects, features and advantages of the present application will become more apparent from the following detailed description read in conjunction with the accompanying drawings, in which several embodiments of the application are shown. In the drawings:

[0021] Figure 1 A structural schematic diagram of an agent-based cybersecurity evaluation report automatic verification and rule matching system provided by an embodiment of the present application. DETAILED DESCRIPTION

[0022] The technical solutions in the present application will be described in detail below with reference to the drawings in the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all the embodiments.

[0023] In the traditional existing cybersecurity evaluation report audit process, artificial audit needs to compare each item with the cybersecurity 2.0 standard clauses, and the average time for a single report is more than 4 hours, so the audit efficiency is limited by the artificial reading speed and cognitive load. The existing automatic audit system uses a rule engine based on regular expressions, which can only identify explicit keyword matching scenarios, and lacks semantic understanding ability for complex security control measures involving multiple clause association reasoning, resulting in a misjudgment rate of more than 25% in complex scenarios. The static rule library cannot dynamically adapt to standard version updates, and when new security control points or evaluation items are added or adjusted, the system needs to rebuild the rule logic, and the maintenance period is as long as two weeks.

[0024] For example, in the third-level evaluation scene of large cloud service platforms, the system needs to process evaluation reports containing 12 security categories and 156 control points. The existing method uses a bag-of-words-based classifier for clause matching, which cannot identify cross-layer architecture description statements such as "access control policy needs to cover virtualization layer and physical network equipment", resulting in 32% of the associated control measures not being correctly classified. When auditing the dependency relationship between "secure communication network" and "area boundary protection" in the knowledge graph, the traditional system incorrectly determines the compliant defense-in-depth architecture as non-compliant due to the lack of entity relationship reasoning capability.

[0025] As shown in Figure 1 The present application proposes an agent-based evaluation report automatic verification and rule matching system, which includes:

[0026] The report acquisition module 101 is used to obtain the to-be-audited evaluation report and the historical evaluation report with annotated compliance from the evaluation management platform through the secure file transfer protocol; the audit processing module 102 is used to load the trained audit model and automatically audit the to-be-audited evaluation report; the rule management module 103 is used to store, analyze and match the machine-readable audit rules structured by the evaluation 2.0 standard clauses; the knowledge graph module 104 is used to construct and store the domain knowledge graph based on the multi-dimensional association relationship between the evaluation 2.0 standard family, security control measures and evaluation items; the agent decision module 105 is used to generate and execute the audit decision action according to the output result of the audit processing module combined with the reinforcement learning strategy; the feedback learning module 106 is used to collect the difference between the artificial review result and the system decision result, and generate incremental training samples; the storage module 107 is used to vectorize all report data, model parameters, rule sets, knowledge graph entity relationships and decision logs.

[0027] The report acquisition module is a component for obtaining the to-be-audited report and the historical report from the network security protection evaluation management platform. The SFTP protocol can be used to realize secure file transmission, and the problem of low efficiency of traditional manual acquisition can be solved. The audit processing module is a component for automatically performing compliance audit. A pre-trained deep learning model can be used to realize semantic understanding and rule matching, and the problem of strong subjectivity of manual audit can be solved. The rule management module is a structured component for storing and analyzing the network security protection 2.0 standard. A rule engine can be used to realize machine readability of the clauses, and the problem of inaccurate rule application can be solved. The knowledge graph module is a component for storing field association relationships. A graph database can be used to realize multi-dimensional entity relationship modeling, and the problem of missing complex semantic association can be solved. The intelligent agent decision module is a component for generating audit decisions. A reinforcement learning algorithm can be used to realize dynamic strategy optimization, and the problem of poor adaptability of static rules can be solved. The feedback learning module is a component for system iterative optimization. An incremental learning framework can be used to realize model parameter updating, and the problem that the traditional model cannot be dynamically adjusted can be solved. The storage module is a component for multi-modal data management. A hybrid architecture of a relational database, a graph database and a vector database can be used to solve the problem of low storage efficiency of heterogeneous data.

[0028] The application cooperates the knowledge graph and the dynamic rule base through the intelligent agent decision mechanism, realizes the continuous optimization of the automatic audit system by combining the incremental feedback learning, simultaneously utilizes the multi-modal storage architecture to improve the data retrieval and processing efficiency, and forms a closed-loop optimized network security protection report audit system.

[0029] Specifically, the report acquisition module obtains the to-be-audited network security protection evaluation report and the historical network security protection evaluation report with labeled compliance from the network security protection evaluation management platform through the secure file transfer protocol. The audit processing module loads the trained audit model to automatically perform compliance audit on the to-be-audited network security protection evaluation report. The rule management module stores, analyzes and matches the machine-readable audit rules structured from the network security protection 2.0 standard clauses. The knowledge graph module constructs and stores the field knowledge graph based on the multi-dimensional association relationships among the network security protection 2.0 standard family, the security control measures and the evaluation items. The intelligent agent decision module generates and executes the audit decision action according to the output result of the audit processing module in combination with the reinforcement learning strategy. The feedback learning module collects the difference between the manual review result and the system decision result to generate incremental training samples. The storage module vectorizes to store all report data, model parameters, rule sets, knowledge graph entity relationships and decision logs.

[0030] The modules work together to realize the automatic verification and rule matching of the network security protection evaluation report. The report acquisition module first acquires the report to be audited and the historical report, providing a data basis for subsequent processing. The audit processing module uses the trained model to preliminarily audit the report and generate compliance evaluation results. The rule management module and the knowledge graph module provide rule matching and semantic understanding support for the audit process, improving the accuracy of the audit. The agent decision module dynamically generates decisions based on the audit results, realizing flexible audit strategies. The feedback learning module continuously optimizes the audit model by comparing system decisions and manual review results. The storage module uniformly manages system data, supporting efficient retrieval and analysis.

[0031] The technical scheme selects an agent-based architecture, combines machine learning and knowledge graph technology, can effectively process complex semantics and multi-dimensional association relationships in network security protection evaluation reports, and improve the efficiency and accuracy of the audit. The reinforcement learning strategy enables the system to dynamically adjust decisions based on actual audit conditions, adapting to different types of reports and audit requirements. The feedback learning mechanism ensures that the system can continuously optimize and improve long-term use effects.

[0032] As a preferred embodiment, the scheme of the present application is implemented as follows:

[0033] The report acquisition module uses the SFTP protocol to acquire the report to be audited and the historical report from the network security protection evaluation management platform. The audit processing module uses a pre-trained language model based on BERT, combined with field-specific fine-tuning, to perform semantic understanding and compliance evaluation on the report. The rule management module uses a JSON format to store structured audit rules and uses the Rete algorithm for efficient rule matching. The knowledge graph module is based on a Neo4j graph database and stores network security standard entities and relationships, supporting graph traversal and reasoning queries. The agent decision module uses the Deep Q-Network (DQN) algorithm to select the optimal decision action based on the current audit state. The feedback learning module uses an incremental learning algorithm, such as Online Gradient Descent, to continuously update the audit model. The storage module uses a hybrid storage architecture, combining a relational database MySQL and a vector database Milvus, to achieve efficient storage and retrieval of structured data and high-dimensional vectors.

[0034] When the system is running, the report to be audited is first acquired and input into the audit model after text preprocessing. The model outputs preliminary audit results, triggers knowledge graph queries and rule matching. The agent decision module integrates these information to decide whether human intervention or automatic passing is needed. The audit results are stored in the database and compared with the manual review results regularly to generate feedback data for model optimization. The entire process is highly automated, which can greatly improve the efficiency and accuracy of network security protection evaluation report audits.

[0035] This application further proposes that the trained review model is trained through the following steps: The report acquisition module obtains a training sample set of labeled historical information security assessment reports; the rule management module provides a basic rule set as prior knowledge; each report in the training sample set undergoes multi-granularity text preprocessing, including document structure parsing, sentence segmentation, and multi-granularity text preprocessing, generating corresponding word vector sequences and sentence vector sequences; a bidirectional long short-term memory network model with an attention mechanism is constructed, fusing the word vector sequences, sentence vector sequences, and relevant entity embedding vectors obtained from the knowledge graph module as input for joint training, optimizing model parameters until convergence; and the feedback learning module continuously acquires incremental samples to fine-tune the model, resulting in the final deployed trained review model.

[0036] The multi-granular text preprocessing includes document structure parsing and sentence segmentation to ensure hierarchical text processing. Word vector sequences and sentence vector sequences are generated using a domain-adaptive word segmentation tool and a word vectorization model, preserving semantic features of the security domain. Entity embedding vectors provided by the knowledge graph module are extracted through graph neural networks to reflect multidimensional relationships between entities. A bidirectional long short-term memory network model with an attention mechanism captures cross-modal semantic relationships by jointly training word vectors, sentence vectors, and entity embedding vectors. Incremental sample fine-tuning employs an online learning strategy, dynamically adjusting model parameters based on differential data collected by the feedback learning module. For example, in the word vectorization stage, a word2vec extended model trained with a domain knowledge graph maps professional terms such as access control and identity authentication to adjacent regions in a high-dimensional vector space, enhancing the model's ability to recognize domain concepts.

[0037] Specifically, after the training sample set is obtained through the report acquisition module, the document structure is first parsed, splitting the report into chapters, paragraphs, and sentence levels, preserving the original document's logical structure. After sentence segmentation, the text is processed using a domain-adaptive word segmentation tool to identify key entities such as security control points and evaluation items, while removing common stop words and low-frequency words. The word vector sequence and sentence vector sequence are generated by the extended word2vec model and sentence encoder, respectively, while the knowledge graph module queries relevant entity embedding vectors. The three are then weighted and fused through an attention mechanism before being input into a bidirectional long short-term memory network. During training, the model optimizes parameters through backpropagation to ensure that the compliance prediction results are consistent with the labeled tags. After deployment, the feedback learning module continuously collects cases of discrepancies from manual review, transforms them into incremental samples, and injects them into the model for fine-tuning, ensuring that the model parameters are dynamically optimized as the review scenario changes. For example, when a new compliance clause is added, the incremental samples contain the labeled report corresponding to the new clause. The model quickly learns the new rules and semantic patterns through fine-tuning, avoiding the resource consumption caused by retraining.

[0038] As a preferred embodiment, the trained auditing model is trained through the following steps: the report acquisition module obtains a training sample set of labeled historical compliance assessment reports; the rule management module provides a basic rule set as prior knowledge; each report in the training sample set undergoes multi-granularity text preprocessing, including document structure parsing, sentence segmentation, and multi-granularity text preprocessing, generating corresponding word vector sequences and sentence vector sequences; a bidirectional long short-term memory network model with an attention mechanism is constructed, fusing the word vector sequences, sentence vector sequences, and relevant entity embedding vectors obtained from the knowledge graph module, and using them as model input for joint training to optimize model parameters until convergence; the feedback learning module continuously acquires incremental samples to fine-tune the model, resulting in the final deployed trained auditing model.

[0039] Specifically, the report acquisition module first obtains a batch of historical compliance assessment reports that have been manually reviewed and marked as compliant from the compliance assessment management platform. These reports constitute the initial training sample set. The rule management module provides machine-readable review rules structured from the compliance 2.0 standard clauses as prior knowledge for model training.

[0040] Furthermore, multi-granular text preprocessing is performed on each report. First, document structure parsing is conducted to identify the report's chapter and paragraph structure. Then, sentence segmentation is performed to divide continuous text into independent sentence units. Next, a multi-granular text preprocessing workflow is executed, including Chinese word segmentation, part-of-speech tagging, named entity recognition, stop word filtering, TF-IDF feature extraction, and other steps, ultimately generating word vector sequences and sentence vector sequences.

[0041] Therefore, a bidirectional long short-term memory network model incorporating an attention mechanism is constructed. This model takes word vector sequences and sentence vector sequences as input, and simultaneously queries relevant entity embedding vectors from a knowledge graph module for fusion. The model's parameters are optimized using a backpropagation algorithm until the loss function converges.

[0042] For example, the Adam optimizer can be used with a learning rate of 0.001, a batch size of 64, and 100 training epochs. After each training epoch, the model performance is evaluated using a validation set. Training is terminated early when the performance on the validation set no longer improves after 5 consecutive epochs.

[0043] Finally, the feedback learning module continuously acquires new review cases as incremental samples, and the model is fine-tuned periodically. New review cases can be collected weekly, and when the cumulative number of samples reaches 1000, incremental training is performed, using a small learning rate such as 0.0001 for fine-tuning to maintain the stability of the model.

[0044] The present application further proposes a multi-granularity text preprocessing method, including: using a domain-adaptive Chinese word segmentation tool to segment the input equal protection assessment report to obtain a Chinese word sequence; performing词性标注与命名实体识别 on the Chinese word sequence to identify key entities such as security control points, assessment items, device models, and configuration parameters in the report; removing general stop words and domain stop words from the sequence after词性标注; applying the TF-IDF statistical method to remove low-frequency words with a frequency lower than a preset threshold or retain a set number of words with the highest word frequency; applying a word2vec extended model trained in combination with a domain knowledge graph to vectorize the processed word sequence to generate a word vector representation with domain semantic features; at the same time, performing structured parsing on the table data in the report, converting the parsing result into a standardized key-value pair sequence and performing vectorization representation.

[0045] Among them, the domain-adaptive Chinese word segmentation tool optimizes the word segmentation boundary by loading a network security domain dictionary to ensure the complete segmentation of compound terms such as firewall policies.词性标注 uses a sequence annotation model based on bidirectional LSTM, and the named entity recognition module outputs security control point entity labels through the CRF layer. Two-level word lists are set in the stop word filtering stage. The general word list contains function words such as "的", "是", etc., and the domain word list contains high-frequency but non-discriminative nouns such as "系统", "设备", etc. The TF-IDF threshold is set to 0.03, and 500 words with the highest word frequency are retained. The word2vec extended model performs incremental training by injecting the co-occurrence relationship of knowledge graph entities based on the training of general corpus. Table parsing uses a rule-based regular matching method to convert configuration item: value format data into a JSON structure.

[0046] Specifically, in the Chinese word segmentation stage, through domain dictionary matching, the three-level equal protection requirements are correctly segmented into complete phrases instead of single characters.词性标注 identifies that "访问控制" is a verb-object structure phrase and marks it as a verb phrase, and the named entity recognition module classifies it as a security control point entity. In the stop word filtering stage, high-frequency function words in legal texts such as "应当", "必须" are removed. The TF-IDF processing retains highly discriminative terms such as "双因素认证", "日志审计", and filters out generalization words such as "计算机", "服务器". In the word vectorization stage, through the knowledge graph-enhanced embedding model, "入侵检测" and "IDS" obtain similar vector representations. In the table parsing stage, the scattered firewall configuration parameter table in the original report is converted into a standard key-value sequence of {"协议类型": "TCP", "端口范围": "80-443"}. These processing steps jointly construct an input representation containing precise semantic features and structured data, providing high-quality vectorized features for the subsequent review model, and effectively improving the accuracy and interpretability of compliance judgment.

[0047] As a preferred embodiment, the solution of the present application is specifically implemented as follows:

[0048] It should be noted that the "词性标注与命名实体识别" in the original text needs to be replaced with the correct English expression according to the actual situation. Here, it is temporarily left in Chinese for the need of translation. You can adjust it according to the specific content.Multi-granularity text preprocessing includes the following steps:

[0049] First, use a domain-adaptive Chinese word segmentation tool to segment the input equal protection assessment report to obtain a Chinese word sequence. Specifically, adopt a word segmentation algorithm based on conditional random fields and perform adaptive word segmentation in combination with an equal protection domain dictionary.

[0050] Secondly, perform词性标注与命名实体识别 on the Chinese word sequence to identify key entities such as security control points, assessment items, device models, and configuration parameters in the report.词性标注 uses a hidden Markov model, and命名实体识别 uses a bidirectional long short-term memory network model.

[0051] Furthermore,剔除通用停用词与领域停用词 from the sequence after词性标注.通用停用词 include的,了,在, etc., and领域停用词 include high-frequency but low-information words such as系统,设备, etc.

[0052] Subsequently, apply the TF-IDF statistical method to剔除出现频率低于预设阈值的低频词 or保留词频最高的设定数目个词语. The TF-IDF threshold is set to 0.001, and 1000 words with the highest word frequencies are retained.

[0053] Then, apply a word2vec extended model trained in combination with a domain knowledge graph to词向量化 the processed word sequence to generate a word vector representation with domain semantic features. The word vector dimension is set to 300 dimensions, the window size is 5, and negative sampling is used to optimize the training.

[0054] Finally, perform structured parsing on the table data in the report, convert the parsing result into a standardized key-value pair sequence, and perform vector representation. Table parsing uses a rule-based method to extract the table header and cell content and generate key-value pairs in the form of field name: field value.

[0055] This application further proposes that the audit processing module uses the trained audit model to audit the to-be-audited equal protection assessment report, specifically including: receiving the to-be-audited equal protection assessment report; performing multi-granularity text preprocessing consistent with the training stage on the report to obtain its word vector and sentence vector representations; inputting the vector representation into the trained audit model, and the model calls the knowledge graph module to perform real-time semantic association queries, and outputs the compliance score and confidence level of each sentence in the equal protection assessment report relative to specific equal protection clauses; aggregating the sentence-level scores to generate chapter-level compliance conclusions and overall report compliance conclusions; establishing an audit context vector to record the decision-making path and key judgment basis during the audit process for reference in subsequent audits.

[0056] It should be noted that the terms "词性标注与命名实体识别", "剔除通用停用词与领域停用词", "剔除出现频率低于预设阈值的低频词", and "词向量化" in the original text seem to be in Chinese and need to be replaced with the correct English expressions according to the actual situation. The above translation is a rough version for reference only. You may need to adjust it according to the accurate English terms for these operations.The multi-granularity text preprocessing uses the same word segmentation tools and word vector generation models as the training phase to ensure consistency in the input feature space. Real-time semantic association queries are implemented through the graph neural network subgraph query interface in the knowledge graph module, dynamically obtaining the embeddings of standard clause entities related to the current sentence. Compliance score aggregation uses a weighted average algorithm, with weights dynamically adjusted based on the sentence's position and confidence level in the report. The review context vector encodes key judgment nodes in the review process through a long short-term memory network, forming a traceable decision path sequence.

[0057] Specifically, after the audit report is preprocessed to generate a structured vector, it is input into the audit model for sentence-by-sentence analysis. When calculating the compliance score, the model simultaneously initiates a query request to the knowledge graph module to obtain the embedding vectors of standard clause entities related to the current sentence. For example, when processing sentences involving firewall configuration, the model retrieves the vectors of security control measures clauses related to access control in the Cybersecurity Classified Protection 2.0 standard through a knowledge graph query. In the scoring aggregation stage, chapter-level conclusions are derived by calculating the weighted scores of all sentences within that chapter, with the weight coefficients determined based on sentence confidence and chapter structure hierarchy. The audit context vector is updated with each scoring operation, recording key parameters of the current audit status, including the entity identifier that triggered the knowledge graph query, the rule version number used for scoring calculation, and confidence distribution data. This vector is stored in a vector database as key-value pairs, allowing historical decision-making basis to be retrieved through vector similarity when subsequent audits involve similar content.

[0058] As a preferred embodiment, the solution of this application is specifically implemented as follows:

[0059] The review and processing module uses a trained review model to review the compliance assessment reports to be reviewed. First, it receives the compliance assessment reports. Then, it performs multi-granularity text preprocessing on the reports, consistent with the training phase, to obtain word and sentence vector representations. Next, the vector representations are input into the trained review model, which calls the knowledge graph module to perform real-time semantic association queries, outputting the compliance score and confidence level of each sentence in the compliance assessment report relative to a specific compliance clause. Further, sentence-level scores are aggregated to generate chapter-level compliance conclusions and overall report compliance conclusions. Finally, a review context vector is established to record the decision-making path and key judgment criteria during the review process, providing a reference for subsequent reviews.

[0060] Specifically, the compliance assessment report to be reviewed is obtained from the compliance assessment management platform via a secure file transfer protocol. Multi-granular text preprocessing includes segmentation using a domain-adaptive Chinese word segmentation tool, part-of-speech tagging and named entity recognition on the segmentation results, stop word removal, TF-IDF statistical method for word selection, and word2vec extended model for generating word vector representations. The review model employs a bidirectional long short-term memory network structure with an attention mechanism, combined with entity embedding vectors from the knowledge graph for reasoning. Compliance scoring uses a standardized score of 0-1, with confidence expressed as a percentage. Chapter-level and overall report compliance conclusions are generated using a weighted average method. The review context vector contains the input features, output results, and associated knowledge graph entity IDs for each decision node.

[0061] This application further proposes that when a sentence's compliance score is lower than a preset threshold or its confidence level is lower than another preset threshold, the sentence is marked as a high-uncertainty anomalous sentence; the high-uncertainty anomalous sentence, its context vector, and the associated information security clause ID are submitted to the rule management module for precise rule matching; the review result of the sentence is updated based on the precise rule matching result, and this case is sent to the feedback learning module; at the same time, root cause analysis is performed on the anomalous sentence to identify the problem type that leads to the compliance issue and potential remedial solutions.

[0062] Specifically, when marking sentences with high uncertainty, a preset threshold and a confidence threshold are used as judgment conditions, and the threshold settings are based on the statistical analysis of historical review data; the context vector contains the structured information of the chapter in which the sentence is located and the semantic features of adjacent sentences; the precise rule matching of the rule management module is achieved through semantic similarity calculation and logical condition comparison, and the matching results cover clause citation relationships and constraints; the root cause analysis is based on the rule matching results and the association with knowledge graph entities to construct a problem type classification model and output correction scheme suggestions.

[0063] Specifically, when a sentence's compliance score or confidence level fails to meet a preset standard, the system automatically triggers an exception handling process. The exception sentence and its context vector are transmitted to the rule management module, where the rule parsing engine performs a step-by-step logical match between the sentence content and structured clauses, eliminating uncertainty in the model's initial judgment. The matching results are used to correct the sentence's review conclusion, and discrepancies are stored in the feedback learning module to generate incremental training samples. The root cause analysis module, combining the violation clause IDs from the rule matching results, extracts associated security control measures and evaluation items from the knowledge graph, identifies the root cause of the problem through path reasoning, and generates specific correction suggestions including configuration parameter adjustments or supplementary detection items. This process improves the accuracy of the review results through a secondary verification mechanism, while providing targeted cases for model optimization, reducing the probability of similar errors recurring.

[0064] As a preferred embodiment, the solution of this application is specifically implemented as follows:

[0065] When the review processing module reviews the information security compliance assessment report to be reviewed using the trained review model, it marks a sentence as a high-uncertainty anomalous sentence if it finds that the compliance score is lower than a preset threshold or the confidence level is lower than another preset threshold. For example, the compliance score threshold is set to 0.7 and the confidence level threshold is set to 0.8. For a specific sentence, if its compliance score is 0.65 or its confidence level is 0.75, then the sentence will be marked as a high-uncertainty anomalous sentence.

[0066] Furthermore, the review and processing module submits the highly uncertain abnormal sentence, its context vector, and the associated information security compliance clause ID to the rule management module for precise rule matching. Specifically, the context vector contains the semantic representations of the five sentences before and after the sentence, and the information security compliance clause ID is the specific information security compliance 2.0 standard clause number corresponding to the sentence.

[0067] Therefore, after receiving the submitted information, the rule management module uses the rule parsing engine to calculate the semantic similarity and logical condition matching of the sentence content and vector features with the clauses in the rule base, and outputs the matching result and compliance judgment. Based on the accurate rule matching result, the review processing module updates the review result of the sentence and sends this case to the feedback learning module.

[0068] The review and processing module also performs root cause analysis on abnormal sentences to identify the types of issues leading to compliance problems and potential remedial solutions. For example, issue types might include insufficient descriptions of security measures, incomplete control point coverage, or parameter configurations that do not meet requirements. Potential remedial solutions provide corresponding suggestions for different issue types, such as supplementing specific security measure descriptions, adding missing control points, or adjusting parameter configurations.

[0069] This application further proposes a rule management module comprising a rule base unit, a rule parsing engine, and a rule update unit. The rule base unit stores specific security control measures and clauses from each level of the Cybersecurity Classified Protection 2.0 (CCP 2.0) requirements in a structured format. The rule parsing engine performs semantic similarity calculations and logical condition matching between the submitted sentence content and vector features and the clauses in the rule base, outputting the matching results and compliance determination. The rule update unit receives manual revision instructions from the system administrator for the rule base or automatically generates new rule logic based on the output of the feedback learning module. The rule management module also includes a rule conflict detection and resolution mechanism to ensure the consistency and consistency of rules in the rule base.

[0070] The rule base unit stores clauses in XML format, with each clause corresponding to a security control point number, applicable level, control requirement text, and logical condition expression. The rule parsing engine incorporates a BERT-based semantic similarity calculation model, using a cosine similarity threshold to determine the match between sentences and clauses, while simultaneously parsing logical expressions to verify condition fulfillment. The rule update unit has a version control interface; upon receiving a manual revision instruction, it automatically generates a new version of the rule and records the operation log. For automatically generated rule logic, inductive logic programming techniques are used to extract rule patterns from incremental samples. The conflict detection and resolution mechanism establishes a rule dependency graph, uses a graph traversal algorithm to detect mutually exclusive rules, and automatically resolves them according to a preset priority strategy.

[0071] Specifically, when a highly uncertain anomalous sentence is submitted to the rule management module, the rule parsing engine first extracts the sentence vector features and calculates their similarity with the clause vectors stored in the rule base unit, filtering candidate clauses with a similarity higher than 0.85. Then, the logical conditional expressions of the candidate clauses are parsed to verify whether the sentence content meets all necessary conditions. If a match is successful, the compliance determination result is returned to the review processing module; if a match fails, the rule update process is triggered. The rule update unit generates new logical rules based on the difference cases provided by the feedback learning module through pattern mining, and writes them into the rule base after conflict detection confirms there are no contradictions. For example, when a conflict is detected between the applicability level of a clause and a newly added rule, the conflict resolution mechanism automatically retains the higher version rule based on the priority of the security compliance standard version. This process ensures the accuracy of rule matching and system adaptability through structured storage and dynamic update mechanisms.

[0072] As a preferred embodiment, the solution of this application is specifically implemented as follows:

[0073] The rule management module comprises a rule base unit, a rule parsing engine, and a rule update unit. The rule base unit stores the specific security control measures and clauses from each level of the Cybersecurity Classified Protection 2.0 (CCP 2.0) requirements in a structured format. The rule parsing engine calculates semantic similarity and performs logical condition matching between the submitted sentence content and vector features and the clauses in the rule base, outputting the matching results and compliance determination. The rule update unit receives manual revision instructions from the system administrator for the rule base, or automatically generates new rule logic based on the output of the feedback learning module. The rule management module also includes a rule conflict detection and resolution mechanism to ensure the consistency and consistency of rules in the rule base.

[0074] Specifically, the rule base unit uses a relational database to store the security control measures clauses in the Cybersecurity Classified Protection 2.0 standard. Each rule includes fields such as clause ID, clause content, applicable level, and keywords. The rule parsing engine uses a BERT-based semantic similarity calculation model to match the input sentence with the rule clauses based on similarity. Simultaneously, the engine also includes a decision tree-based logical matching module for handling rules with explicit logical relationships. The rule update unit receives revision instructions from the administrator via a web interface and automatically generates new rules based on feedback data using an incremental learning algorithm. Rule conflict detection employs graph theory algorithms, representing rules as a directed graph and detecting potential conflicts by finding cycles.

[0075] This application further proposes a knowledge graph module including an entity recognition and linking unit, a relation extraction unit, and a graph reasoning unit. The entity recognition and linking unit is used to extract security domain entities from the audit report and link them to standard nodes in the knowledge graph. The relation extraction unit identifies and stores the membership, dependency, mutual exclusion, and satisfaction relationships between entities based on a predefined ontology schema. The graph reasoning unit is used to provide subgraph query and relation reasoning services based on graph neural networks for the audit processing module and the rule management module. The knowledge graph module also supports dynamic graph updates and version management to ensure that the graph data is consistent with the latest security compliance standards.

[0076] The entity recognition and linking unit employs a sequence labeling model combining bidirectional LSTM and CRF. It enhances entity boundary recognition by loading a domain entity dictionary and performs similarity matching between extracted entities and predefined compliance standard nodes in the knowledge graph to achieve accurate linking. The relation extraction unit defines the relationship types and constraints between entities using a predefined ontology schema and employs a graph attention-based relation classification model to extract multi-dimensional relation features from sentence context and entity attributes. The graph reasoning unit integrates a graph neural network model and achieves subgraph reasoning through multi-hop neighbor information aggregation, supporting semantic queries with complex logical rules. Dynamic graph updates are implemented through a version control mechanism for incremental updates. When a new version of the compliance standard is detected, the graph structure migration and entity relationship reconstruction process is automatically triggered.

[0077] Specifically, the entity recognition and linking unit first performs word segmentation and part-of-speech tagging on the review report text. It then identifies entities such as security control points and evaluation items using a sequence labeling model, and calculates similarity by combining the vector representations of existing nodes in the knowledge graph to complete entity alignment. The relation extraction unit extracts semantic features from the context of entity co-occurrence based on the relation types defined in the ontology schema. It determines the specific relation type between entities using a relation classification model and stores it in the graph database. After receiving query requests from the review processing module, the graph reasoning unit performs embedding representation learning on relevant subgraphs based on graph neural networks, generating reasoning results through multi-level neighbor node information propagation. During dynamic updates, the version management module compares the differences between old and new standards, updates the graph structure through entity mapping and relation reconstruction algorithms, and retains historical version data for backtracking. Through these technical means, the knowledge graph module can accurately identify entity associations, support multi-dimensional relation reasoning, and maintain synchronization with the latest standards, thereby improving the accuracy and completeness of semantic association queries during the review process.

[0078] As a preferred embodiment, the solution of this application is implemented as follows: The knowledge graph module includes an entity recognition and linking unit, a relation extraction unit, and a graph reasoning unit. The entity recognition and linking unit is used to extract security domain entities from the audit report and link them to standard nodes in the knowledge graph. The relation extraction unit, based on a predefined ontology schema, identifies and stores the membership, dependency, mutual exclusion, and satisfaction relationships between entities. The graph reasoning unit is used to provide subgraph query and relation reasoning services based on graph neural networks for the audit processing module and the rule management module. The knowledge graph module also supports dynamic graph updates and version management to ensure that the graph data is consistent with the latest security compliance standards.

[0079] Specifically, the entity recognition and linking unit employs a deep learning-based named entity recognition model, such as the BiLSTM-CRF model, to process the audit report and identify key entities such as security control measures, evaluation items, and equipment names. The identified entities are then matched with existing entity nodes in the knowledge graph using an entity linking algorithm to establish associations. The relation extraction unit uses a remote supervision method, combined with predefined relation patterns, to extract semantic relationships between entities from the report text. The graph reasoning unit employs a graph attention network (GAT) model to perform representation learning on the knowledge graph, generating low-dimensional vector representations of entities and relations, supporting complex semantic query and reasoning tasks.

[0080] Furthermore, the dynamic update mechanism of the knowledge graph periodically crawls the latest information security standards documents, uses natural language processing technology to extract newly added or changed entities and relationships, and integrates them into the existing graph. The version management function records the evolution history of the graph through timestamps and difference comparison algorithms, and supports backtracking and querying the graph status at a specific point in time.

[0081] This application further proposes an intelligent agent decision-making module comprising a policy network unit and an action execution unit. The policy network unit is a neural network based on deep Q-learning, which generates the optimal processing policy based on the current review status, including compliance score distribution, the number of high-uncertainty abnormal sentences, knowledge graph query results, and historical decision-making efficiency. The action execution unit is used to execute the policy actions output by the policy network unit. These actions include marking the report as automatically approved, returning it to a specified modification stage, triggering a human expert review process, or calling the automatic correction submodule to make suggested modifications to the report text.

[0082] The policy network unit employs a deep Q-learning framework to construct a multilayer perceptron network. The input layer receives a multidimensional state vector consisting of a compliance score distribution vector, a count of high-uncertainty abnormal sentences, a knowledge graph subgraph embedding vector, and historical decision performance indicators. The hidden layer abstracts features through a fully connected layer, and the output layer generates Q-value estimates for each selectable action. The action execution unit is equipped with a policy mapping table that maps the action with the highest Q-value to a predefined set of operation instructions. The operation instruction set includes automatic approval instructions, return modification instructions, manual review request instructions, and automatic correction instructions. The automatic correction submodule has a built-in text generation model that generates compliance modification suggestions based on the knowledge graph reasoning results.

[0083] Specifically, the policy network unit learns the state-action value function through offline training. During training, an experience replay mechanism is used to store state transition samples, and the target network is updated periodically to stabilize the training process. In the online inference stage, the compliance score distribution and abnormal sentence count output by the review processing module are received in real time. Combined with the embedded vectors of the related entity subgraph returned by the knowledge graph module, the feature representation of the current state is calculated. After the policy network outputs the Q-value of each selectable action, the action execution unit selects the action with the largest Q-value to execute according to a preset threshold. When the difference in Q-values ​​is less than the set threshold, the manual review action is given priority. For example, when the number of highly uncertain abnormal sentences exceeds the set threshold and the knowledge graph query shows that there are mutually exclusive clauses, the policy network generates a decision action to trigger manual review to ensure the reliability of the review conclusion.

[0084] As a preferred embodiment, the solution of this application is implemented as follows: The intelligent agent decision-making module includes a policy network unit and an action execution unit. The policy network unit adopts a deep Q-learning neural network architecture, which includes an input layer, three fully connected hidden layers, and an output layer. The number of nodes in the input layer is consistent with the feature dimensions of the current review status, including the compliance score distribution vector, the normalized value of the number of high-uncertainty abnormal sentences, the entity association degree matrix of the knowledge graph query results, and the sliding window statistics of historical decision effectiveness. The hidden layers use the ReLU activation function, and the output layer corresponds to the probability distribution of four preset review actions. The action execution unit is configured with a multi-threaded processing architecture. After the policy network outputs the action probability distribution, it selects the action type with the highest probability value. If the action is to trigger the manual expert review process, a work order containing abnormal sentence location information and compliance defect classification is generated and pushed to the designated review terminal through a message queue. If the action is to call the automatic correction submodule, suggestions for completing missing control items in the report text are generated based on the compliance benchmark template provided by the knowledge graph module.

[0085] This application further proposes an intelligent agent decision-making module comprising a policy network unit and an action execution unit. The policy network unit is a neural network based on deep Q-learning, which generates the optimal processing policy based on the current review status, including compliance score distribution, the number of high-uncertainty abnormal sentences, knowledge graph query results, and historical decision-making efficiency. The action execution unit is used to execute the policy actions output by the policy network unit. These actions include marking the report as automatically approved, returning it to a specified modification stage, triggering a human expert review process, or calling the automatic correction submodule to make suggested modifications to the report text.

[0086] The strategy network unit employs a deep Q-learning algorithm to construct a neural network model. The input layer of this network receives compliance score distribution vectors, statistical values ​​of the number of abnormal sentences, knowledge graph-related entity vectors, and historical decision-making effectiveness index vectors. The hidden layer performs feature fusion through a fully connected layer, and the output layer generates Q-value evaluations for each candidate action. The action execution unit is configured with interface components that interface with the review process, including automatic approval, return for modification, manual review triggering, and text correction interfaces. After receiving action instructions from the strategy network, the interface components call the corresponding business logic modules to execute the operations.

[0087] Specifically, after the review and processing module completes the report compliance score calculation, the strategy network unit receives the current review status data and calculates the expected reward value of each candidate action through forward propagation of the neural network. For example, when the compliance score is higher than the threshold and the number of abnormal sentences is zero, the strategy network outputs the highest Q-value for the automatic pass action, and the action execution unit calls the automatic interface to complete the report marking. When the number of highly uncertain abnormal sentences exceeds the set threshold, the strategy network selects to trigger the manual review process based on historical decision-making efficiency data to avoid erroneous decisions. The deep Q-learning network continuously optimizes the network weight parameters through a reward function mechanism, based on the review result difference data provided by the subsequent feedback learning module, so that the strategy generation process gradually approaches the optimal decision path.

[0088] As a preferred embodiment, the solution of this application is implemented as follows: The storage module adopts a multimodal database architecture. The relational database uses a MySQL cluster to store report metadata, including report number, creation time, audit status fields, and user ID and timestamp from the system operation log. The graph database deploys a Neo4j instance to store knowledge graph data, where node types include entities of security compliance standards and security control measures, and edge relationships use an attribute graph model to record the hierarchical affiliation and logical dependencies between entities. The vector database uses a Milvus distributed architecture to store 768-dimensional sentence vectors generated by the BERT model from the report text, while also saving the weight matrix of the fully connected layer of the audit model. The data governance unit has a built-in automated data cleaning pipeline that performs integrity checks and outlier filtering on the incoming data, and establishes a role-based access control policy to implement dynamic permission approval for similarity retrieval requests in the vector database.

[0089] This application further proposes a feedback learning module comprising a difference comparison unit, a sample generation unit, a model optimization unit, and an effectiveness evaluation unit. The difference comparison unit captures the difference data between the manual review results and the system review conclusions in real time; the sample generation unit converts the difference cases into labeled samples and calculates the sample weights; the model optimization unit uses weighted incremental samples to periodically fine-tune the review model, strategy network, and knowledge graph entity vectors; and the effectiveness evaluation unit verifies the performance of the optimized system through A / B testing.

[0090] The system comprises several functionalities: The discrepancy comparison unit obtains the final judgment results from the manual review database in real time via a data interface, performs field-level comparisons with the system's initial review conclusions, and generates discrepancy records containing discrepancy types, discrepancy locations, and correction annotations. The sample generation unit vectorizes the text fragments and corresponding annotation information in the discrepancy records, sets sample weight coefficients based on the discrepancy type, with samples of compliance judgment errors having higher weights than samples with insufficient confidence. The model optimization unit employs a mini-batch gradient descent algorithm, inputting weighted samples into the bidirectional long short-term memory network layer of the review model, and simultaneously updating the embedding vectors of relevant entities in the knowledge graph and the Q-value function parameters of the policy network. The performance evaluation unit proportionally allocates system traffic to model instances before and after optimization, and generates a performance comparison report by statistically analyzing compliance review accuracy, abnormal sentence recall rate, and manual review intervention rate.

[0091] Specifically, when manual reviewers modify the compliance conclusions automatically generated by the system through the management interface, the difference comparison unit automatically records the original score, correction result, and associated information security clause number of the modified sentence. The sample generation unit extracts the word vectors, context vectors, and associated knowledge graph subgraphs of the sentence, combines them with the correction results to generate training samples, and assigns weight values ​​based on the error frequency of the sentence in historical reviews. The model optimization unit initiates a fine-tuning process during preset low-load periods, using a dynamic learning rate mechanism to update the attention layer parameters of the review model, while adjusting the vector representations of relevant entity nodes in the knowledge graph. Under the control of the effect evaluation unit, the optimized model and policy network process some reports in real-time review tasks. By comparing the changes in F1 scores of the versions before and after optimization on the same test set, the effectiveness of model iteration is verified. When A / B testing shows that the accuracy improvement of the optimized version exceeds a preset threshold and the false positive rate does not increase significantly, the system automatically completes a full model switch.

[0092] As a preferred embodiment, the specific implementation of this application's solution is as follows: The difference comparison unit of the feedback learning module collects JSON format data records of the final review results of manual review and the initial review results of the system in real time through the log interface. The comparison fields include compliance judgment conclusions, abnormal sentence identifiers, and correction opinions. When the sample generation unit transforms cases with differences into labeled samples, it adopts a weight calculation method based on edit distance, assigning higher weight coefficients to samples involving multiple clause conflicts. The model optimization unit adopts an incremental learning algorithm with weighted sampling, inputting new samples into the fully connected layer of the review model every 24 hours for parameter fine-tuning, while simultaneously optimizing the vector representations of related entities in the knowledge graph using cosine similarity alignment. The effect evaluation unit deploys the optimized model copy in the pre-release environment, processes the same batch of evaluation reports in parallel with the production environment model, and compares the differences in the compliance conclusion distribution of the two sets of outputs using a chi-square test. When the P-value is less than 0.05, a version rollback mechanism is triggered.

[0093] Through the above technical solution, this application effectively solves the problem of traditional review systems lacking dynamic optimization capabilities. By establishing a closed-loop feedback mechanism, it achieves continuous iterative optimization of the review model and knowledge graph. This solution can automatically identify cases where there are discrepancies between manual review and system judgment, transforming them into high-quality training samples, and improving the model's ability to handle complex cases through weighted fine-tuning. Simultaneously, a rigorous A / B testing verification mechanism ensures the stability of the system during updates, avoiding abnormal fluctuations in review conclusions caused by model parameter drift.

[0094] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. An automated verification and rule matching system for information security compliance assessment reports based on intelligent agents, characterized in that, The system includes: The report acquisition module is used to obtain the pending information security assessment report and the historical information security assessment report marked as compliant from the information security assessment management platform via a secure file transfer protocol. The review processing module is used to load the trained review model and perform automated compliance review on the information security level assessment report to be reviewed. The rule management module is used to store, parse, and match machine-readable audit rules structured from the terms of the Cybersecurity Classified Protection 2.0 standard. The knowledge graph module is used to construct and store domain knowledge graphs based on the multi-dimensional relationships between the Classified Protection 2.0 standard family, security control measures, and evaluation items; The intelligent agent decision-making module is used to generate and execute review decision actions based on the output of the review processing module and in conjunction with a reinforcement learning strategy. The feedback learning module is used to collect the differences between the results of manual review and the system decision, and generate incremental training samples; The storage module is used to vectorize and store all report data, model parameters, rule sets, knowledge graph entity relationships, and decision logs; the trained auditing model is obtained through the following steps: The report acquisition module obtains a training sample set of labeled historical information security assessment reports; the rule management module provides a basic rule set as prior knowledge. For each report in the training sample set, multi-granular text preprocessing is performed to generate corresponding word vector sequences and sentence vector sequences; a bidirectional long short-term memory network model with an attention mechanism is constructed, and the word vector sequences, sentence vector sequences, and relevant entity embedding vectors obtained from the knowledge graph module are fused and used as model input for joint training to optimize model parameters until convergence; incremental samples are continuously obtained through the feedback learning module to fine-tune the model, resulting in the final deployed audit model; the audit processing module uses the trained audit model to audit the compliance assessment reports to be audited, including: Receive the pending information security compliance assessment report; The report is subjected to the same multi-granularity text preprocessing as during the training phase to obtain its word vectors and sentence vector representations. The vector representation is input into the trained audit model, which calls the knowledge graph module to perform real-time semantic association query and outputs the compliance score and confidence level of each sentence in the information security protection assessment report relative to the specific information security protection clause. Aggregate sentence-level scores to generate chapter-level compliance conclusions and overall report compliance conclusions; establish an audit context vector to record the decision-making path and key judgment criteria during the audit process, providing a reference for subsequent audits.

2. The system according to claim 1, characterized in that, The multi-granularity text preprocessing includes: using a domain-adaptive Chinese word segmentation tool to segment the input information security assessment report to obtain a Chinese word sequence; Part-of-speech tagging and named entity recognition are performed on the Chinese word sequence to identify key entities in the report, such as safety control points, evaluation items, equipment models, and configuration parameters. Remove general stop words and domain stop words from the part-of-speech tagging sequence; The TF-IDF statistical method is used to remove low-frequency words that occur below a preset threshold or to retain a set number of words with the highest frequency. The word2vec extended model, trained with a domain knowledge graph, is applied to vectorize the processed word sequence, generating word vector representations with domain semantic features. Simultaneously, the tabular data in the report is subjected to structured parsing, and the parsing results are converted into a standardized key-value pair sequence and then vectorized.

3. The system according to claim 2, characterized in that, The audit processing module is used for: When a sentence has a compliance score below a preset threshold or a confidence level below another preset threshold, the sentence is marked as a high-uncertainty abnormal sentence. The highly uncertain abnormal sentence, its context vector, and the associated information security clause ID are submitted to the rule management module for precise rule matching. The review result of the sentence is updated based on the result of precise rule matching, and this case is sent to the feedback learning module. Perform root cause analysis on abnormal sentences to identify the types of problems that lead to compliance issues and potential remedial measures.

4. The system according to claim 3, characterized in that, The rule management module includes a rule base unit, a rule parsing engine, and a rule update unit; The rule base unit is used to store the specific security control measures clauses in the requirements of each level of the Cybersecurity Classified Protection 2.0 in a structured form; The rule parsing engine is used to perform semantic similarity calculation and logical condition matching between the submitted sentence content and vector features and the terms in the rule base, and output the matching results and compliance judgment. The rule update unit is used to receive manual revision instructions for the rule base from the system administrator, or to automatically generate new rule logic based on the output of the feedback learning module.

5. The system according to claim 4, characterized in that, The knowledge graph module includes an entity recognition and linking unit, a relation extraction unit, and a graph reasoning unit. The entity recognition and linking unit extracts security domain entities from the audit report and links them to standard nodes in the knowledge graph. The relation extraction unit identifies and stores membership, dependency, mutual exclusion, and satisfaction relationships between entities based on a predefined ontology schema. The graph reasoning unit provides subgraph query and relation reasoning services based on graph neural networks for the audit processing module and the rule management module. The knowledge graph module also supports dynamic graph updates and version management to ensure that the graph data is consistent with the latest security compliance standards.

6. The system according to claim 5, characterized in that, The intelligent agent decision-making module includes a strategy network unit and an action execution unit. The strategy network unit is a deep Q-learning-based neural network that generates the optimal processing strategy based on the current review status, including compliance score distribution, the number of high-uncertainty abnormal sentences, knowledge graph query results, and historical decision-making efficiency. The action execution unit is used to execute the strategy actions output by the strategy network unit. These actions include marking the report as automatically approved, returning it to a specified modification stage, triggering a human expert review process, or calling the automatic correction submodule to make suggestive modifications to the report text.

7. The system according to claim 1, characterized in that, The storage module employs an intelligent multimodal database system, including a relational database, a graph database, and a vector database. The relational database stores structured report metadata and system logs. The graph database stores the knowledge graph data. The vector database stores high-dimensional vector representations of all reports and sentences, as well as the parameters of the trained auditing model, and provides a fast retrieval function based on similarity. The storage module also includes a data governance unit responsible for data lifecycle management, quality checks, and access control to ensure data consistency and security.

8. The system according to claim 1, characterized in that, The feedback learning module includes a difference comparison unit, a sample generation unit, and a model optimization unit. The difference comparison unit monitors and collects the differences between the final manual review results and the initial system review results. The sample generation unit converts the difference cases into labeled samples and calculates the sample weights. The model optimization unit uses weighted incremental samples to periodically fine-tune and optimize the trained review model, the policy network of the agent decision-making module, and the entity vector representation of the knowledge graph. The feedback learning module also includes an effect evaluation unit, which evaluates the performance of the optimized system through A / B testing to ensure the stability and effectiveness of system iteration.

Images