Data processing method, electronic equipment and computer readable storage medium

Abstract

The invention provides a data processing method, electronic equipment and a computer readable storage medium, and relates to the technical field of data processing. The method comprises the steps that initial power distribution network data are acquired, target power distribution network data are generated according to the initial power distribution network data, and the data formats of the initial power distribution network data and the target power distribution network data are different; performing classification processing on the initial power distribution network data to obtain a data classification result, the data classification result including a classification label corresponding to the initial power distribution network data; performing grading processing on the target power distribution network data to obtain a data grading result, the data grading result comprising a grade to which the target power distribution network data belongs; and generating classification and grading evaluation information corresponding to the initial power distribution network data according to the data classification result and the data grading result. Through double data stream processing, semantic clustering and big language model driven risk reasoning, automatic classification and grading of the power data are realized, and various standards and requirements in a high-safety requirement scene are met.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and more specifically, to a data processing method, an electronic device, and a computer-readable storage medium. Background Technology

[0002] With the construction of new power systems and the advancement of digital transformation, distribution networks have generated massive amounts of multi-source heterogeneous business data. This distribution network data is not only the core asset driving the intelligent operation and maintenance of the power grid, but also a key target for network security protection. Therefore, accurate classification and grading of distribution network data is the foundation for achieving differentiated security protection.

[0003] Existing data classification and grading methods mainly include manual experience-driven approaches, rule-based automation, and traditional machine learning methods. Manual methods are inefficient, costly, and highly subjective, making it difficult to guarantee network-wide consistency. Rule-driven methods rely on preset keywords or regular expressions, but because the rules are relatively fixed, they struggle to adapt to dynamic business changes and have high maintenance costs. While traditional machine learning models possess some adaptability, their decision-making process lacks interpretability, making it difficult to meet the power industry's requirements for compliance and auditability. Furthermore, due to their reliance on large amounts of labeled data, their generalization ability is limited. Therefore, existing technologies have significant shortcomings in terms of efficiency, consistency, interpretability, adaptability, and reliability, making them unsuitable for direct application in power data classification scenarios with high security requirements. Summary of the Invention

[0004] The purpose of this application is to address the shortcomings of the prior art by providing a data processing method, electronic device, and computer-readable storage medium, thereby solving the problem that the prior art has obvious defects in terms of efficiency, consistency, interpretability, adaptability, and reliability, making it difficult to directly apply to power data classification scenarios with high security requirements.

[0005] To achieve the above objectives, the technical solutions adopted in the embodiments of this application are as follows: In a first aspect, embodiments of this application provide a data processing method, the method comprising: Acquire initial distribution network data and generate target distribution network data based on the initial distribution network data, wherein the initial distribution network data and the target distribution network data have different data formats; The initial distribution network data is classified to obtain a data classification result, which includes the classification label corresponding to the initial distribution network data. The target distribution network data is subjected to hierarchical processing to obtain a data hierarchical result, which includes the level to which the target distribution network data belongs; Based on the data classification results and the data grading results, classification and grading evaluation information corresponding to the initial distribution network data is generated.

[0006] As one possible implementation, the classification processing of the initial distribution network data to obtain data classification results includes: Extract multiple key data pairs from the initial distribution network data and generate semantic vectors for each key data pair, wherein the key data pair includes field name and field value; The semantic vectors of each key data pair are subjected to hierarchical clustering to obtain the data classification results.

[0007] As one possible implementation, the hierarchical clustering of the semantic vectors of each key data pair to obtain the data classification result includes: The semantic vectors of each key data pair are clustered using a preset clustering algorithm to determine the first-level cluster, the second-level cluster, and the third-level cluster to which the semantic vectors of each key data pair belong. The first-level cluster is used to represent the business theme to which the key data pair belongs, the second-level cluster is used to represent the business object corresponding to the key data pair under the business theme, and the third-level cluster is used to represent the entity case corresponding to the key data pair under the corresponding business object. Based on the first-level cluster, second-level cluster, and third-level cluster to which the semantic vectors of each key data pair belong, a set of business tags for each key data pair is generated. The set of business tags includes the business tags of the key data pair in the first-level cluster, second-level cluster, and third-level cluster. Based on the business tag set of each key data pair, determine the classification tag corresponding to the initial distribution network data.

[0008] As one possible implementation, the step of performing hierarchical processing on the target distribution network data to obtain data hierarchical results includes: Based on the key fields in the target distribution network data, the business context information corresponding to the target distribution network data is determined, and the business context information includes: risk scenarios and loss profiles; The data classification result is determined based on the business context information corresponding to the target distribution network data.

[0009] As one possible implementation, determining the business context information corresponding to the target distribution network data based on key fields in the target distribution network data includes: Based on the key fields in the target distribution network data, context enhancement information corresponding to the target distribution network data is retrieved from multiple different types of first databases. The context enhancement information includes key business processes and historical security events associated with the target distribution network data. Based on the context enhancement information corresponding to the target distribution network data, a risk scenario corresponding to the target distribution network data is generated.

[0010] As one possible implementation, determining the business context information corresponding to the target distribution network data based on key fields in the target distribution network data includes: Based on the risk scenarios corresponding to the target distribution network data, loss information corresponding to the target distribution network data is retrieved from multiple different types of second databases. Based on the loss information corresponding to the target distribution network data, a loss profile of the target distribution network data is generated.

[0011] As one possible implementation, determining the data classification result based on the business context information corresponding to the target distribution network data includes: Based on the target distribution network data, the risk scenarios corresponding to the target distribution network data, and the loss profile corresponding to the target distribution network data, the classification information corresponding to the target distribution network data is retrieved from multiple third-type databases of different types. Based on the classification information corresponding to the target distribution network data, the level to which the target distribution network data belongs is determined.

[0012] As one possible implementation, the method further includes: Obtain classification and grading assessment information corresponding to multiple distribution network data, as well as revision information of the classification and grading assessment information corresponding to each distribution network data; Training samples are constructed based on the distribution network data, the classification and grading evaluation information corresponding to the distribution network data, and the revision information of the classification and grading evaluation information corresponding to the distribution network data. The loss assessment model is optimized based on the training samples to obtain an optimized loss assessment model, which is used to generate business context information corresponding to distribution network data.

[0013] Secondly, embodiments of this application provide a data processing apparatus, the apparatus comprising: An acquisition module is used to acquire initial distribution network data and generate target distribution network data based on the initial distribution network data, wherein the initial distribution network data and the target distribution network data have different data formats. The classification module is used to classify the initial distribution network data to obtain a data classification result, which includes the classification label corresponding to the initial distribution network data. A classification module is used to classify the target distribution network data to obtain a data classification result, wherein the data classification result includes the level to which the target distribution network data belongs; The generation module is used to generate classification and grading evaluation information corresponding to the initial distribution network data based on the data classification results and the data grading results.

[0014] As one possible implementation, the classification module is specifically used for: Extract multiple key data pairs from the initial distribution network data and generate semantic vectors for each key data pair, wherein the key data pair includes field name and field value; The semantic vectors of each key data pair are subjected to hierarchical clustering to obtain the data classification results.

[0015] As one possible implementation, the classification module is specifically used for: The semantic vectors of each key data pair are clustered using a preset clustering algorithm to determine the first-level cluster, the second-level cluster, and the third-level cluster to which the semantic vectors of each key data pair belong. The first-level cluster is used to represent the business theme to which the key data pair belongs, the second-level cluster is used to represent the business object corresponding to the key data pair under the business theme, and the third-level cluster is used to represent the entity case corresponding to the key data pair under the corresponding business object. Based on the first-level cluster, second-level cluster, and third-level cluster to which the semantic vectors of each key data pair belong, a set of business tags for each key data pair is generated. The set of business tags includes the business tags of the key data pair in the first-level cluster, second-level cluster, and third-level cluster. Based on the business tag set of each key data pair, determine the classification tag corresponding to the initial distribution network data.

[0016] As one possible implementation, the hierarchical module is specifically used for: Based on the key fields in the target distribution network data, the business context information corresponding to the target distribution network data is determined, and the business context information includes: risk scenarios and loss profiles; The data classification result is determined based on the business context information corresponding to the target distribution network data.

[0017] As one possible implementation, the hierarchical module is specifically used for: Based on the key fields in the target distribution network data, context enhancement information corresponding to the target distribution network data is retrieved from multiple different types of first databases. The context enhancement information includes key business processes and historical security events associated with the target distribution network data. Based on the context enhancement information corresponding to the target distribution network data, a risk scenario corresponding to the target distribution network data is generated.

[0018] As one possible implementation, the hierarchical module is specifically used for: Based on the risk scenarios corresponding to the target distribution network data, loss information corresponding to the target distribution network data is retrieved from multiple different types of second databases. Based on the loss information corresponding to the target distribution network data, a loss profile of the target distribution network data is generated.

[0019] As one possible implementation, the hierarchical module is specifically used for: Based on the target distribution network data, the risk scenarios corresponding to the target distribution network data, and the loss profile corresponding to the target distribution network data, the classification information corresponding to the target distribution network data is retrieved from multiple third-type databases of different types. Based on the classification information corresponding to the target distribution network data, the level to which the target distribution network data belongs is determined.

[0020] As one possible implementation, the data processing device further includes: a training module, specifically used for: Obtain classification and grading assessment information corresponding to multiple distribution network data, as well as revision information of the classification and grading assessment information corresponding to each distribution network data; Training samples are constructed based on the distribution network data, the classification and grading evaluation information corresponding to the distribution network data, and the revision information of the classification and grading evaluation information corresponding to the distribution network data. The loss assessment model is optimized based on the training samples to obtain an optimized loss assessment model, which is used to generate business context information corresponding to distribution network data.

[0021] Thirdly, embodiments of this application provide an electronic device, including: a processor, a storage medium, and a bus. The storage medium stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the machine-readable instructions to perform the steps of the data processing method as described in any of the first aspects above.

[0022] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the data processing method described in any of the first aspects above.

[0023] According to the data processing method, electronic device, and computer-readable storage medium of this application, initial distribution network data is acquired, and target distribution network data is generated based on the initial distribution network data. The initial distribution network data and the target distribution network data have different data formats. The initial distribution network data is classified to obtain a data classification result, which includes a classification label corresponding to the initial distribution network data. The target distribution network data is graded to obtain a data grading result, which includes the level to which the target distribution network data belongs. Based on the data classification result and the data grading result, classification and grading evaluation information corresponding to the initial distribution network data is generated. According to the embodiments of this application, by performing differentiated processing on the initial distribution network data using both structured and natural language data streams, the flexibility and richness of data processing are ensured, and the basic quality of subsequent analysis is improved. Then, a pre-defined clustering algorithm combined with a large language model is used to progressively cluster key data pairs and automatically generate semantically consistent business tags. This achieves automatic discovery and annotation of the inherent semantic level of the data, significantly improving the consistency and efficiency of classification. Subsequently, based on the key fields of the target distribution network data, risk scenarios and loss profiles are generated using multi-source knowledge base retrieval and deep reasoning from the large language model. Furthermore, data grading and its transparent grading path are determined by integrating similar cases and compliance rules. This not only enhances the accuracy and interpretability of the grading results but also ensures its dynamic adaptability to new threats. The entire data processing flow in this application, from data transformation, classification and grading, to assessment information generation, demonstrates a high degree of automation, intelligence, and decision support based on regulations and historical experience. This greatly improves the refinement of power system data security management and its ability to cope with complex risk environments, thereby meeting various standards and requirements under high security requirements. Attached Figure Description

[0024] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 A flowchart illustrating a data processing method provided in an embodiment of this application is shown; Figure 2 A flowchart illustrating a data classification method provided in an embodiment of this application is shown; Figure 3 A flowchart illustrating a data classification method provided in an embodiment of this application is shown; Figure 4 A flowchart illustrating another data processing method provided in an embodiment of this application is shown; Figure 5 A flowchart illustrating another data processing method provided in an embodiment of this application is shown; Figure 6 A flowchart illustrating a model optimization method provided in an embodiment of this application is shown. Figure 7 This paper shows a schematic diagram of the structure of a data processing apparatus provided in an embodiment of the present application; Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of this application is shown. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the accompanying drawings in this application are for illustrative and descriptive purposes only and are not intended to limit the scope of protection of this application. Furthermore, it should be understood that the schematic drawings are not drawn to scale. The flowcharts used in this application illustrate operations implemented according to some embodiments of this application. It should be understood that the operations in the flowcharts may not be implemented in sequence, and steps without logical contextual relationships may be reversed or implemented simultaneously. In addition, those skilled in the art, guided by the content of this application, may add one or more other operations to the flowcharts, or remove one or more operations from the flowcharts.

[0027] Furthermore, the described embodiments are merely some, not all, of the embodiments of this application. The components of the embodiments of this application described and illustrated herein can typically be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0028] It should be noted that the term "comprising" will be used in the embodiments of this application to indicate the presence of the features declared thereafter, but does not exclude the addition of other features.

[0029] Figure 1 A flowchart illustrating a data processing method provided in an embodiment of this application is shown, wherein the method is executed by an electronic device. (Refer to...) Figure 1 As shown, the method specifically includes the following steps: S101. Obtain initial distribution network data and generate target distribution network data based on the initial distribution network data.

[0030] Optionally, the initial distribution network data is structured data, and includes multiple structured data records. After receiving the initial distribution network data input by the user, the electronic device performs differential processing on the initial distribution network data, forming two independent data streams. The first data stream is a structured data stream, retaining the complete format of the initial distribution network data; that is, the initial distribution network data itself can be used as the first data stream. The second data stream is a natural language data stream, obtained by converting each structured data record in the initial distribution network data into a natural language description rich in business context. Thus, after receiving the initial distribution network data, the target distribution network data is generated by performing data structure conversion processing on the initial distribution network data, ensuring that the data formats of the initial distribution network data and the target distribution network data are different. That is, what was once a single data stream input by the user becomes two data streams, which can then be processed in parallel.

[0031] Optionally, in application scenarios that classify and grade high-value industrial user data of the distribution network, an initial distribution network data is received from the marketing management system. This initial distribution network data is represented in JSON format as follows: { "record_id": "REC-20231027-001", "system_name": "Marketing Management System", "data_description": "Monthly Electricity Consumption Behavior Analysis Report of High-Value Industrial Users", "user_id": "IND-USR-6001", "user_type": "High-value industrial user", "location": "No. 1, Area A, XX High-tech Development Zone, XX City, XX Province", "voltage_level": "10kV", "avg_monthly_consumption_kwh": 50000, "security_contact_person": "Manager Wang", "contact_phone": "138********" } Optionally, key fields in the aforementioned structured initial distribution network data can be concatenated and refined to transform the initial distribution network data into a fluent and natural language description rich in business context. For example, after processing the aforementioned structured initial distribution network data, the corresponding generated target distribution network data might be: "In the marketing management system, there exists a monthly electricity consumption behavior analysis report for a high-value industrial user with user ID 'IND-USR-6001'. This user is located in the XX High-tech Development Zone, with a voltage level of 10kV, an average monthly electricity consumption of 50,000 kWh, and their safety contact person is Manager Wang, with the contact number 138******."

[0032] Optionally, in application scenarios where key control commands of the power grid dispatch automation system SCADA are classified and graded, an initial distribution network data from the power grid dispatch automation system SCADA is received. This initial distribution network data is represented in JSON format as follows: { "log_id": "LOG-SCADA-20231101-554", "system": "SCADA Master Station", "command": "REMOTE_CLOSE", "command_desc": "Remote closing", "target_device_id": "CB-SUBSTATION_A-MAIN_TX-01", "target_device_desc": "Substation A - Main Transformer No. 1 - Circuit Breaker CB01", "operator_id": "DISPATCHER_ZHAO", "reason": "Planned line maintenance work completed, power restored." "timestamp": "2023-11-01 16:05:10" } Optionally, key fields in the above-mentioned structured initial distribution network data can be spliced ​​and refined to convert the initial distribution network data into a fluent and natural language description rich in business context. For example, after processing the above-mentioned structured initial distribution network data, the corresponding target distribution network data generated is as follows: "In the SCADA master station system, dispatcher DISPATCHER_ZHAO issued a remote closing command to 'Substation A-No. 1 Main Transformer-Circuit Breaker CB01' at 16:05:10 on 2023-11-01 because the planned line maintenance work was completed and power was restored."

[0033] S102. Classify the initial distribution network data to obtain the data classification results.

[0034] Optionally, the data classification results may include classification labels corresponding to the initial distribution network data.

[0035] Optionally, multiple key data pairs containing field names and values ​​are extracted from the initial distribution network data, and each key data pair is encoded into a high-dimensional semantic vector. Based on this, a pre-defined clustering algorithm is used to progressively cluster the semantic vectors of each key data pair, determining their respective hierarchical clusters and obtaining the clustering results. Specifically, the first-level clusters divide the global semantic space into macro-level business theme clusters; the second-level clusters further cluster within each theme cluster to form finer-grained business object sub-clusters; and the third-level clusters perform refined clustering within the object sub-clusters to generate specific entity case clusters. In this way, the inherent semantic hierarchy of the data can be automatically discovered without manual annotation.

[0036] Furthermore, to improve the readability and business usability of the clustering results, this application introduces a Large Language Model (LLM) to automatically generate labels for each level of clusters. Specifically, representative samples are selected near the cluster centers at each level, natural language prompts are constructed and input into the LLM, which generates semantically consistent high-level business labels. Finally, each key data pair obtains a structured set of business labels based on its three level clusters, and the business labels in this set are combined into a complete classification path, which serves as the final classification label for the initial distribution network data.

[0037] S103. Perform hierarchical processing on the target distribution network data to obtain the data hierarchical results.

[0038] Optionally, the data classification results may include the level to which the target distribution network data belongs.

[0039] Optionally, based on key fields in the target distribution network data, different types of databases are searched in parallel to obtain context-enhanced information related to the target distribution network data. Then, a Large Language Model (LLM) is used to perform deep semantic understanding and fusion reasoning on the context-enhanced information to generate structured risk scenarios. Based on this, a multi-subject knowledge base covering multiple entities such as enterprises, individuals, and society is retrieved according to the generated risk scenarios to obtain potential loss information under different dimensions. A multi-dimensional, concrete loss profile is generated based on the loss information, transforming abstract risks into quantifiable business impacts. Further, based on the fusion of the original target distribution network data, risk scenarios, and loss profiles, relevant classification criteria are retrieved from similar case knowledge bases and compliance rule knowledge bases. The LLM integrates all the above information to generate the final data classification result and its interpretable classification path. This interpretable classification path clearly lists the logical basis for each step from input to conclusion, ensuring that the classification process is transparent and auditable. In this way, the entire data classification process achieves closed-loop classification from data to context, from risk to impact, and from experience to rules, significantly improving the intelligence, refinement, and compliance level of power data security management.

[0040] S104. Based on the data classification results and data grading results, generate classification and grading evaluation information corresponding to the initial distribution network data.

[0041] Optionally, the data classification results and data grading results are integrated, with the interpretable grading path in the data grading results as the core narrative framework, and the classification labels in the data classification results as summary information, to generate classification and grading assessment information corresponding to the initial distribution network data. This classification and grading assessment information is, for example, a structured comprehensive assessment report. This comprehensive assessment report can be exported as a PDF for user review or as a JSON for other systems to call.

[0042] It is worth noting that after obtaining the initial distribution network data and the target distribution network data, this application processes these two data streams in parallel. This parallel processing includes a macro-level classification path and a micro-level grading path. The macro-level classification path refers to classifying the initial distribution network data, while the micro-level grading path refers to grading the target distribution network data. Specifically, in the macro-level classification path, the structured data stream of the initial distribution network data undergoes multi-level automated classification, transforming the structured data into semantic vectors. Then, a multi-level clustering algorithm is used to cluster these semantic vectors, forming clusters at three levels: business themes, business objects, and entity cases. Finally, a large language model is used to generate interpretable business labels and summaries for each cluster, completing the data classification. In the micro-level grading path, the natural language data stream of the target distribution network data undergoes a three-stage progressive deep grading process, including risk analysis, loss assessment, and grading justification. Finally, the classification labels output from the macro-level classification path and the grading information output from the micro-level grading path are integrated to generate a comprehensive assessment report with a clear structure and logical traceability.

[0043] Based on this, the data processing method according to the embodiments of this application ensures the flexibility and richness of data processing by performing differentiated processing on the initial distribution network data using both structured and natural language data streams, thereby improving the basic quality of subsequent analysis. Then, a preset clustering algorithm combined with a large language model is used to progressively cluster key data pairs and automatically generate semantically consistent business tags, realizing the automatic discovery and annotation of the inherent semantic level of the data, significantly improving the consistency and efficiency of classification. Subsequently, based on the key fields of the target distribution network data, risk scenarios and loss profiles are generated using multi-source knowledge base retrieval and deep reasoning with the large language model. Furthermore, data grading and its transparent grading path are determined by comprehensively considering similar cases and compliance rules, which not only enhances the accuracy and interpretability of the grading results but also ensures its dynamic adaptability to new threats. The entire data processing flow in this application, from data transformation, classification and grading, to evaluation information generation, reflects a high degree of automation, intelligence, and decision support based on regulations and historical experience. This greatly improves the refinement level of power system data security management and its ability to cope with complex risk environments, thereby meeting various standards and requirements under high security requirements.

[0044] As one possible implementation, step S102 above classifies the initial distribution network data to obtain data classification results, including: extracting multiple key data pairs from the initial distribution network data, generating semantic vectors for each key data pair, performing hierarchical clustering on the semantic vectors of each key data pair, and obtaining data classification results.

[0045] Optionally, the key data pair includes a field name and a field value, and the structure of the key data pair is, for example, "field name: field value". In one embodiment, taking the initial distribution network data obtained in the application scenario of classifying and grading high-value industrial user data of the distribution network as shown above as an example, "user_type" is a field name, and its corresponding field value is "high-value industrial user". The corresponding key data pair is "user_type": "high-value industrial user". "data_description" is also a field name, and its corresponding field value is "monthly electricity consumption behavior analysis report of high-value industrial users". The corresponding key data pair is "data_description": "monthly electricity consumption behavior analysis report of high-value industrial users". In another embodiment, taking the initial distribution network data obtained in the application scenario of classifying and grading key control commands of the power grid dispatch automation system SCADA as an example, as shown above, "command" is a field name with a corresponding field value of "REMOTE_CLOSE", and the corresponding key data pair is "command": "REMOTE_CLOSE". "target_device_desc" is also a field name with a corresponding field value of "A substation-No.1 main transformer-circuit breaker CB01", and the corresponding key data pair is "target_device_desc": "A substation-No.1 main transformer-circuit breaker CB01".

[0046] Optionally, in this embodiment, key data pairs in the initial power distribution network data can be encoded into high-dimensional semantic vectors using a pre-trained domain language model (Bidirectional Encoder Representations from Transformers, BERT). Specifically, the key data pairs are converted into a format recognizable and acceptable to the BERT model, and the processed key data pairs are input into the BERT model. The BERT model automatically captures lexical, syntactic, and semantic information through its internal multi-layer Transformer structure, obtaining multiple tokens. During the forward propagation of the model, each token is mapped to a context-dependent hidden state vector, ultimately resulting in a fixed-dimensional vector, which is the semantic vector corresponding to the input key data pair. This semantic vector not only contains the original textual information of the key data pair but also incorporates the domain knowledge learned by the BERT model during the pre-training and fine-tuning stages, thereby supporting subsequent semantic matching, clustering, or retrieval tasks.

[0047] Furthermore, this application embodiment employs an unsupervised clustering algorithm to classify the semantic vectors of each key data pair obtained by encoding in a unified semantic space at three levels (business theme layer, business object layer, and entity case layer) to obtain data classification results, which include classification labels corresponding to the initial distribution network data.

[0048] Figure 2 A flowchart illustrating a data classification method provided in an embodiment of this application is shown. (Refer to...) Figure 2 As shown, the above steps perform hierarchical clustering on the semantic vectors of each key data pair to obtain the data classification results. Specifically, the steps include the following: S201. Use a preset clustering algorithm to cluster the semantic vectors of each key data pair to determine the first-level cluster, second-level cluster, and third-level cluster to which the semantic vectors of each key data pair belong.

[0049] Optionally, the first-level cluster is used to represent the business theme to which the key data pair belongs, the second-level cluster is used to represent the business object corresponding to the key data pair under the business theme, and the third-level cluster is used to represent the entity case corresponding to the key data pair under the corresponding business object. Specifically, the first-level cluster (Level-1: Business Theme Layer) is a large cluster, (Level-2: Business Object Layer) is a sub-cluster within the first-level cluster, and the third-level cluster (Level-3: Entity Case Layer) is a fine-grained cluster within the second-level cluster.

[0050] Optionally, the preset clustering algorithm is, for example, an unsupervised clustering algorithm. Using an unsupervised clustering algorithm to cluster the semantic vectors of key data pairs means automatically grouping key data pairs into semantic clusters of different levels based on the similarity between semantic vectors without prior labels. Specifically, the unsupervised clustering algorithm calculates the cosine similarity or Euclidean distance between semantic vectors, aggregating semantically similar vectors together to form an initial cluster structure. Then, combined with a preset cluster size or density threshold, a first-level cluster can be defined, corresponding to a macro-level business theme. Based on this, a second clustering is performed on the semantic vectors within the first-level cluster to generate a finer-grained second-level cluster, used to represent specific business objects under this business theme. Further, refined clustering is performed again within the second-level cluster to obtain a third-level cluster, corresponding to specific entity cases. This multi-level unsupervised clustering method provided in this application can automatically discover the semantic hierarchy structure in data without manual annotation, supporting subsequent intelligent retrieval, data classification, and knowledge organization.

[0051] For example, taking the initial distribution network data obtained in the application scenario of classifying and grading high-value industrial user data of the distribution network as shown above, an unsupervised clustering algorithm is used to perform three-level clustering of the semantic vectors of each key data pair in the initial distribution network data in a unified semantic space. The first-level cluster (Level-1: business theme layer) is determined to be the cluster representing "user marketing and service", the second-level cluster (Level-2: business object layer) is the sub-cluster representing "large customer information", and the third-level cluster (Level-3: entity case layer) is the fine cluster representing "high-value user electricity consumption behavior analysis".

[0052] For example, taking the initial distribution network data obtained in the application scenario of classifying and grading key control instructions of the power grid dispatch automation system SCADA as shown above, an unsupervised clustering algorithm is used to perform three-level clustering of the semantic vectors of each key data pair in the initial distribution network data in a unified semantic space. The first-level cluster (Level-1: business theme layer) is determined to be the cluster representing "power grid operation and control", the second-level cluster (Level-2: business object layer) is the sub-cluster representing "dispatch operation instructions", and the third-level cluster (Level-3: entity case layer) is the fine cluster representing "substation circuit breaker operation".

[0053] S202. Generate a set of business tags for each key data pair based on the first-level cluster, second-level cluster, and third-level cluster to which the semantic vectors of each key data pair belong.

[0054] Optionally, the business tag set includes business tags for key data pairs in the first-level cluster, the second-level cluster, and the third-level cluster. In this embodiment, to improve the readability and business usability of the above clustering results, after completing multi-level unsupervised clustering, a loss assessment model, a Large Language Model (LLM), is introduced to automatically label the semantic clusters at each level, thereby giving intuitive and understandable business tags to the clusters that originally lacked semantic explanation.

[0055] Optionally, for the first-level cluster, several representative samples whose semantic vectors are closest to the cluster center are selected from the key data pairs contained therein. These representative samples, i.e., samples near the cluster center, have the highest intra-class similarity. These representative samples are then organized into a prompt in natural language and input into the Large Language Model (LLM). Based on its language understanding capabilities, the LLM outputs a semantically consistent high-level business label. Similarly, the same operation is performed on the second-level cluster, extracting representative samples from the sub-clusters, constructing a prompt, and requesting the LLM to generate more concrete business object labels. For the third-level cluster, the LLM is further requested to generate specific scenario or instance descriptions. Finally, each key data pair, according to its three-level cluster, obtains a structured set of business labels. This set of business labels not only preserves the hierarchical structure of the original clustering but also endows each layer with clear business semantics through the LLM, significantly improving the interpretability and usability of the data.

[0056] For example, taking the first-level cluster (Level-1: Business Theme Layer) as the cluster representing "User Marketing and Service", the second-level cluster (Level-2: Business Object Layer) as the sub-cluster representing "Key Customer Information", and the third-level cluster (Level-3: Entity Case Layer) as the refined cluster representing "High-Value User Electricity Consumption Behavior Analysis", the generated business tag set includes business tags such as user marketing, key customer information, and electricity consumption behavior analysis.

[0057] For example, taking the first-level cluster (Level-1: business theme layer) as the cluster representing "power grid operation and control", the second-level cluster (Level-2: business object layer) as the sub-cluster representing "dispatch operation instructions", and the third-level cluster (Level-3: entity case layer) as the fine cluster representing "substation circuit breaker operation", the generated business tag set includes business tags such as operation control, dispatch instructions, and circuit breaker instructions.

[0058] S203. Based on the business label set of each key data pair, determine the classification label corresponding to the initial distribution network data.

[0059] Optionally, multiple business tags from the business tag set can be used as classification tags corresponding to the initial distribution network data. In one embodiment, taking business tags such as user marketing, large customer information, and electricity consumption behavior analysis from the aforementioned business tag set as an example, the classification tag corresponding to the initial distribution network data is "User Marketing / Large Customer Information / Electricity Consumption Behavior Analysis". In another embodiment, taking business tags such as operation control, dispatching instructions, and circuit breaker instructions from the aforementioned business tag set as an example, the classification tag corresponding to the initial distribution network data is "Operation Control / Dispatch Instructions / Circuit Breaker Operation".

[0060] Based on this, this application utilizes an unsupervised hierarchical clustering algorithm to mine the inherent relationships between key data pairs in a unified semantic space, constructing a three-level cluster structure of "business theme—business object—entity case," effectively capturing the logical hierarchical relationships in power business scenarios. Furthermore, by combining this with a Large Language Model (LLM), natural language business labels are generated for each level of cluster, significantly improving the readability and usability of the clustering results. This method not only overcomes the problems of semantic ambiguity and difficulty in understanding traditional clustering results but also avoids dependence on large amounts of labeled data, achieving automated and intelligent classification of heterogeneous and complex distribution network data. Thus, without manual annotation, this application automatically organizes key information in initial distribution network data into a classification structure with clear semantic hierarchy, achieving highly interpretable and business-aligned data classification results.

[0061] Figure 3 A flowchart illustrating a data classification method provided in an embodiment of this application is shown. (Refer to...) Figure 3 As shown, step S103 above performs hierarchical processing on the target distribution network data to obtain the data hierarchical results, specifically including the following steps: S301. Determine the business context information corresponding to the target distribution network data based on the key fields in the target distribution network data.

[0062] Optionally, the business context information includes risk scenarios and loss profiles. In this embodiment, a structured risk scenario is generated based on dual-channel knowledge base retrieval, and a multi-dimensional loss profile is generated based on multi-agent knowledge base retrieval. Furthermore, data levels and interpretable classification paths can be generated based on similar cases and rule bases.

[0063] One possible implementation involves identifying risk scenarios, specifically including: retrieving context-enhanced information corresponding to the target distribution network data from multiple different types of primary databases based on key fields in the target distribution network data; and generating risk scenarios corresponding to the target distribution network data based on this context-enhanced information. The context-enhanced information includes key business processes and historical security events associated with the target distribution network data.

[0064] Optionally, multiple different types of primary databases include a business process knowledge base and a risk case knowledge base. The business process knowledge base is constructed in the form of a knowledge graph, while the risk case knowledge base is stored in vectorized text format.

[0065] For example, taking the application scenario of classifying and grading high-value industrial user data in the distribution network as shown above, the target distribution network data obtained by differentiating the initial distribution network data is used as an example. The key fields in the target distribution network data are, for example, "high-value industrial users" and "electricity consumption behavior analysis". Based on these key fields, the business process knowledge base and the risk case knowledge base are searched in parallel. For the business process knowledge base, the search results show that this type of data is mainly used for two key business links: "precision marketing decision-making" and "energy efficiency optimization service". For the risk case knowledge base, through similarity search, a historical security event was matched: "An industrial park lost in the bidding for key projects because its large customer's electricity consumption data was leaked and its production cycle and capacity were analyzed by competitors."

[0066] For example, taking the application scenario described above where key control commands of the SCADA system for power grid dispatch automation are classified and graded, the target distribution network data obtained by differentiating the initial distribution network data is used as an example. Key fields in the target distribution network data include, for example, "SCADA", "remote closing", and "main transformer circuit breaker". Based on these key fields, the business process knowledge base and the risk case knowledge base are searched in parallel. For the business process knowledge base, the search results show that this operation is a core step in the "power grid fault recovery" or "power restoration after planned maintenance" process, which is directly related to the power supply of downstream areas. For the risk case knowledge base, through similarity search, multiple historical security events are matched, such as "a power grid was forcibly powered on the line under maintenance due to hackers forging closing commands, resulting in the injury or death of multiple on-site personnel" and "the circuit breaker was closed under unsafe conditions due to the command being tampered with, causing equipment explosion and power grid oscillation".

[0067] Furthermore, based on the aforementioned contextual enhancement information, the Large Language Model (LLM) in this application performs reasoning with the enhancement of contextual enhancement information, which includes dual knowledge of key business processes and historical security events, to generate structured risk scenarios.

[0068] For example, taking the above contextualized information, including "This type of data is mainly used in two key business processes: 'precision marketing decision-making' and 'energy efficiency optimization services,' and matching a historical security incident as: 'An industrial park lost a key project bidding due to the leakage of a major customer's electricity consumption data, which allowed competitors to analyze its production cycle and capacity,' the generated structured risk scenario is: 'Risk Dimension: Confidentiality. Risk Scenario: Once the sensitive information of this high-value user (precise location, detailed electricity consumption patterns, contact information) is leaked, it may be used by external entities (such as competitors) for business intelligence analysis, or by criminals to carry out precise phishing, extortion, and other attacks.'"

[0069] For example, using the aforementioned contextualized information including "This operation is a core step in the 'grid fault recovery' or 'planned maintenance followed by power restoration' process, directly related to the power supply of downstream areas, and matched with multiple historical safety incidents, such as 'a power grid was forcibly powered on a line under maintenance due to a hacker forging a closing command, resulting in injuries and deaths of multiple on-site personnel' and 'the command was tampered with, causing the circuit breaker to close under unsafe conditions, triggering equipment explosion and grid oscillation' as examples, the generated structured risk scenario is: "Risk Dimension: Integrity, Availability. Risk Scenario: If the integrity of the remote closing command is compromised (e.g., forged, tampered with, or replayed), it may lead to forced power restoration under unsafe conditions (e.g., maintenance personnel not evacuated, line faults), directly threatening the lives of on-site personnel and the safety of power grid equipment, and potentially causing a large-scale power outage."

[0070] Based on this, this application utilizes key fields of the target distribution network data to obtain multi-dimensional contextualized information through parallel retrieval of a dual-channel knowledge base—a business process knowledge base and a risk case knowledge base. It then combines this with a Large Language Model (LLM) for deep semantic understanding and reasoning, automatically generating structured risk scenarios that are clear and relevant to business contexts. This method not only achieves semantic expansion from isolated data to business context but also maps abstract fields to specific business processes and real historical security events, significantly improving the accuracy and interpretability of risk identification. Especially in high-security scenarios within power systems, it can accurately identify key risk dimensions related to confidentiality, integrity, and availability, and generate specific risk scenarios. This provides a solid and traceable basis for subsequent data classification, security strategy formulation, and threat modeling, effectively solving the problems of traditional classification methods relying on human experience, lacking contextual support, and struggling to dynamically adapt to new threats.

[0071] As one possible implementation, determining the loss profile specifically includes: retrieving loss information corresponding to the target distribution network data from multiple different types of second databases based on the risk scenarios corresponding to the target distribution network data, and generating a loss profile of the target distribution network data based on the loss information corresponding to the target distribution network data.

[0072] Optionally, multiple different types of second databases include knowledge bases from multiple different entities, such as enterprises (e.g., power companies), individuals (e.g., users and contacts, field workers), and society. Based on the aforementioned risk scenarios, this application generates a loss profile of the target distribution network data by retrieving knowledge bases from multiple entities, and this loss profile is also multi-dimensional.

[0073] For example, taking the above risk scenario as an example: "Risk Dimension: Confidentiality. Risk Scenario: Once the sensitive information of this high-value user (precise location, detailed electricity usage patterns, contact information) is leaked, it may be used by external entities (such as competitors) for business intelligence analysis, or by criminals to carry out precise phishing, extortion, and other attacks." The generated multi-dimensional loss profile is as follows: "Impact on the enterprise (power company): It may lead to the loss of this high-value customer, face huge fines from regulatory authorities in accordance with the Data Security Law, and have a serious negative impact on the company's data security reputation (reference: legal provisions, historical penalty cases). Impact on individuals (users and contacts): Security contact Manager Wang may suffer targeted telecommunications fraud, resulting in personal property losses; the leakage of the user's trade secrets may lead to a decline in its market competitiveness (reference: Personal Information Protection Law, trade secret infringement cases). Impact on society: If the user is a core enterprise in a key industrial chain in the region, its business losses may have a chain reaction impact on the upstream and downstream supply chains (reference: industry analysis report)."

[0074] For example, taking the above risk scenario as an example: "Risk Dimensions: Integrity, Availability. Risk Scenario: If the integrity of the remote closing command is compromised (e.g., forged, tampered with, or replayed), it may lead to forced power supply under unsafe conditions (e.g., maintenance personnel not evacuated, line faults), directly threatening the lives of on-site personnel and the safety of power grid equipment, and may cause a large-scale power outage accident," the generated multi-dimensional loss profile is as follows: "Impact on the enterprise (power company): May trigger the highest level of production safety accident, resulting in huge economic compensation, equipment scrapping losses, relevant responsible persons may face criminal liability, and the enterprise's operating qualifications may be affected (reference: power safety accident level classification standards, historical accident handling reports). Impact on individuals (on-site staff): Directly leads to extreme consequences of personal injury or death (reference: power safety work procedures). Impact on society: Equipment damage or power grid oscillation may lead to large-scale, long-term power outages, affecting the normal operation of key social functions such as industrial production, transportation, and medical care in the region, causing serious public safety incidents (reference: large-scale power outage emergency plan)."

[0075] Based on this, this application utilizes a multi-subject knowledge base covering enterprises, individuals, and society to conduct precise retrieval and correlation analysis based on identified risk scenarios, automatically generating comprehensive, multi-dimensional, and concrete loss assessment results. This method overcomes the limitations of traditional data classification methods, which often describe the scope of impact in a vague and unsubstantiated manner. It transforms abstract risks into quantifiable business impacts and enhances its authority and interpretability by referencing legal provisions, historical cases, and emergency plans. The loss profile generated by this application not only clearly reveals the chain reaction of data leakage or tampering at different subject levels but also provides objective and traceable decision support for subsequent data security level classification, significantly improving the refinement, intelligence, and compliance level of power system data security management.

[0076] S302. Determine the data classification result based on the business context information corresponding to the target distribution network data.

[0077] Optionally, in the embodiments of this application, the Large Language Model (LLM) integrates complete business context information and the target distribution network data itself, and simultaneously introduces key knowledge for collaborative judgment, ultimately generating a rating conclusion and a completely transparent and explainable path.

[0078] Optionally, based on the target distribution network data, the risk scenarios corresponding to the target distribution network data, and the loss profile corresponding to the target distribution network data, the classification information corresponding to the target distribution network data is retrieved from multiple third databases of different types, and the classification information corresponding to the target distribution network data is used to determine the level to which the target distribution network data belongs.

[0079] For example, the third database includes a similar case knowledge base and a compliance rule knowledge base. In one embodiment, based on the target distribution network data, the risk scenario corresponding to the target distribution network data, and the loss profile corresponding to the target distribution network data in the aforementioned application scenario of classifying and grading high-value industrial user data of the distribution network, the rating information retrieved from the similar case knowledge base is "similar electricity consumption analysis data of 'XX Group' has been manually rated as 'serious'", and the rating information retrieved from the compliance rule knowledge base is "an internal regulation is injected: 'Data involving the operation information of industrial users with annual electricity consumption exceeding 1 million kWh shall not be initially rated lower than 'serious'".

[0080] Furthermore, based on the above-mentioned rating information, the Large Language Model (LLM) generates the rating conclusion and a fully transparent interpretable path as follows: "Rating Conclusion: "Level 4 - Severe". Interpretable rating path: (1) Input: Electricity consumption data of high-value industrial users; (2) Risk identification: There is a risk of leakage of trade secrets and precise attacks; (3) Loss assessment: It may cause significant losses to enterprises and individuals; (4) Case reference: Consistent with the historical rating conclusion (severe) of 'XX Group'; (5) Rule compliance: Complies with the internal regulation that "key customer data is not lower than severe"; (6) Final conclusion: Comprehensive judgment is Level 4 - Severe". Accordingly, the level of the target distribution network data can be determined to be Level 4 - Severe.

[0081] In another embodiment, based on the aforementioned application scenario of classifying and grading key control commands of the power grid dispatch automation system SCADA, the target distribution network data, the risk scenario corresponding to the target distribution network data, and the loss profile corresponding to the target distribution network data, the classification information retrieved from the similar case knowledge base is "multiple historical records were found indicating that all remote control commands involving backbone network equipment and potentially causing personal injury or death are classified as the highest security level," and the classification information retrieved from the compliance rules knowledge base is "injected core security regulations: according to the 'Regulations on Security Protection of Power Monitoring Systems,' any remote control operation on the production control area is a highest-risk operation and must adopt the strongest security protection measures."

[0082] Furthermore, based on the above-mentioned grading information, the Large Language Model (LLM) generates the grading conclusion and a fully transparent interpretable path as follows: "Grading Conclusion: Level 5 - Extremely Severe". Interpretable grading path: (1) Input: SCADA remote closing command; (2) Risk identification: There is a risk of personal injury and equipment damage caused by forged commands; (3) Loss assessment: It may trigger the highest level of production safety accident, causing serious social impact; (4) Case reference: Consistent with the grading (extremely severe) of all historical core control commands; (5) Rule compliance: Complies with the highest risk definition of the "Regulations on Security Protection of Power Monitoring Systems"; (6) Final conclusion: Comprehensive judgment is Level 5 - Extremely Severe". Accordingly, the level of the target distribution network data can be determined to be Level 5 - Extremely Severe.

[0083] Based on this, this application integrates business context information, risk scenarios, and loss profiles through a Large Language Model (LLM), and conducts comprehensive analysis in conjunction with a key knowledge base to achieve accurate classification and grading of target distribution network data. This method not only generates clear grading conclusions but also provides a completely transparent and traceable explanation path, making the entire assessment process highly interpretable and authoritative. This significantly improves the refinement and accuracy of data security management and decision-making, ensuring that even in complex and ever-changing risk environments, data protection priorities can be quickly and accurately determined based on regulations and historical experience, thereby effectively guaranteeing the safe and stable operation of the power system and its related social functions.

[0084] Figure 4 A flowchart illustrating another data processing method provided in an embodiment of this application is shown. (Refer to...) Figure 4 As shown, this application provides a user-input-based method for classifying and grading power data. First, the user-input data undergoes augmentation processing, followed by parallel data classification and grading. Data classification generates structured labels through semantic vectorization and clustering, while data grading combines risk analysis, loss assessment, and grading justification, generating interpretable grading conclusions from a large language model. Finally, a report is generated for user review, and the large language model is optimized based on user feedback, forming a closed-loop iteration that outputs the final conclusion. This achieves efficient, intelligent, and auditable data security assessment.

[0085] Figure 5 A flowchart illustrating another data processing method provided in an embodiment of this application is shown. (Refer to...) Figure 5 As shown, this application performs a three-level progressive classification of data under a unified semantic space to achieve structured organization of business themes, business objects, and entity cases. Then, risk analysis is completed through dual-channel knowledge base retrieval and multi-dimensional risk generation. A loss profile is constructed by combining a multi-subject knowledge base to assess potential impact, and a rating demonstration is conducted based on similar cases and a rule base. Finally, the data classification results and data rating results are integrated to generate a structured report containing risks, losses, and rating criteria, thereby achieving automation, intelligence, and interpretability of data security assessment.

[0086] As one possible approach, after generating the comprehensive evaluation report, it can be submitted to domain experts for manual review. If the domain experts revise the report, the difference between the original report and the revised report will be automatically captured, and this difference will be used as a feedback signal to optimize and update the large language model or knowledge base in the macro classification path or micro hierarchical path, thus forming a closed-loop learning mechanism.

[0087] Figure 6 A schematic flowchart of a model optimization method provided in an embodiment of this application is shown. (Refer to...) Figure 6As shown, the method specifically includes the following steps: S601. Obtain classification and grading assessment information corresponding to multiple distribution network data, as well as revision information of the classification and grading assessment information corresponding to each distribution network data.

[0088] Optionally, for distribution network data input by different users, the aforementioned method is used to generate classification and grading evaluation information corresponding to the distribution network data, i.e., a comprehensive evaluation report. The comprehensive evaluation report of each distribution network data is then submitted to domain experts for review. If the domain experts revise the report content, the differences between the original report and the revised report are automatically captured, and the revision information is obtained. This revision information may be, for example, added annotation information.

[0089] S602. Based on the data of each distribution network, the classification and grading evaluation information corresponding to each distribution network data, and the revision information of the classification and grading evaluation information corresponding to each distribution network data, construct training samples.

[0090] Optionally, the training samples consist of three parts: the first part is the original distribution network data and its key fields; the second part is the generated initial classification and grading assessment information, including risk scenarios, loss profiles, and grading paths; and the third part is the final grading conclusions and annotations modified by domain experts. By aligning and labeling the above three parts of information, high-quality fine-tuning samples that match the input and expected output are formed and given high weights and stored in the training data pool for subsequent model iterations.

[0091] S603. Optimize the loss assessment model based on the training samples to obtain the optimized loss assessment model.

[0092] Optionally, the loss assessment model is used to generate business context information corresponding to the distribution network data, that is, the Large Language Model (LLM) used in the aforementioned applications for risk assessment, loss profiling, and rating demonstration.

[0093] Optionally, after accumulating a certain number of training samples, the model optimization process can be initiated. Specifically, the constructed training sample set is used to perform supervised fine-tuning of the existing loss assessment model, focusing on optimizing its performance in loss assessment sub-tasks, such as identifying semantic cues like "key projects" and "core suppliers," and improving its risk sensitivity in dimensions such as social impact and strategic security. For example, during training, a cross-entropy loss function can be used to guide the model to output results closer to expert judgment. After optimization, the resulting optimized loss assessment model will be verified for its reasoning consistency and accuracy on historical cases. Once the evaluation indicators meet the standards, it will be formally deployed as a new loss assessment model, thereby achieving continuous learning from expert experience and continuously improving risk identification capabilities and classification accuracy.

[0094] Based on this, this application automatically transforms the feedback from domain experts on the classification and grading results into high-quality training samples, achieving a closed-loop iteration from initial classification and grading judgment to domain expert correction and model relearning. This not only enables the loss assessment model to continuously absorb domain expert knowledge, improving its sensitivity to key semantics and the accuracy of risk judgment, but also significantly enhances its reasoning ability in complex dimensions such as strategic security and social impact, thereby generating more comprehensive and accurate business context information and grading recommendations in subsequent tasks.

[0095] Based on the same inventive concept, this application also provides a data processing device corresponding to the data processing method. Since the principle of the data processing device in this application is similar to that of the data processing method described above, the implementation of the data processing device can refer to the implementation of the data processing method, and the repeated parts will not be described again.

[0096] Reference Figure 7 The diagram shown is a structural schematic of a data processing device provided in an embodiment of this application. The data processing device 700 includes: an acquisition module 701, a classification module 702, a grading module 703, and a generation module 704, wherein: The acquisition module 701 is used to acquire initial distribution network data and generate target distribution network data based on the initial distribution network data. The data formats of the initial distribution network data and the target distribution network data are different. The classification module 702 is used to classify the initial distribution network data and obtain the data classification result, which includes the classification label corresponding to the initial distribution network data. The classification module 703 is used to classify the target distribution network data to obtain the data classification result, which includes the level to which the target distribution network data belongs. The generation module 704 is used to generate classification and grading evaluation information corresponding to the initial distribution network data based on the data classification results and data grading results.

[0097] Based on this, the data processing apparatus according to the embodiments of this application ensures the flexibility and richness of data processing by performing differentiated processing on the initial distribution network data using both structured and natural language data streams, thereby improving the basic quality of subsequent analysis. Then, a preset clustering algorithm combined with a large language model is used to progressively cluster key data pairs and automatically generate semantically consistent business tags, realizing the automatic discovery and annotation of the inherent semantic level of the data, significantly improving the consistency and efficiency of classification. Subsequently, based on the key fields of the target distribution network data, risk scenarios and loss profiles are generated using multi-source knowledge base retrieval and deep reasoning with the large language model. Furthermore, data grading and its transparent grading path are determined by comprehensively considering similar cases and compliance rules, which not only enhances the accuracy and interpretability of the grading results but also ensures its dynamic adaptability to new threats. The entire data processing flow in this application, from data transformation, classification and grading, to evaluation information generation, reflects a high degree of automation, intelligence, and decision support based on regulations and historical experience. This greatly improves the refinement level of power system data security management and its ability to cope with complex risk environments, thereby meeting various standards and requirements under high security requirements.

[0098] In one possible implementation, the classification module 702 is specifically used for: Extract multiple key data pairs from the initial distribution network data and generate semantic vectors for each key data pair, where each key data pair includes a field name and a field value. Hierarchical clustering is performed on the semantic vectors of each key data pair to obtain the data classification results.

[0099] In one possible implementation, the classification module 702 is specifically used for: The semantic vectors of each key data pair are clustered using a pre-defined clustering algorithm to determine the first-level cluster, second-level cluster, and third-level cluster to which the semantic vectors of each key data pair belong. The first-level cluster is used to represent the business theme to which the key data pair belongs, the second-level cluster is used to represent the business object corresponding to the key data pair under the business theme, and the third-level cluster is used to represent the entity case corresponding to the key data pair under the corresponding business object. Based on the first-level cluster, second-level cluster, and third-level cluster to which the semantic vectors of each key data pair belong, a set of business tags for each key data pair is generated. The set of business tags includes the business tags of the key data pairs in the first-level cluster, second-level cluster, and third-level cluster. Based on the business tag set of each key data pair, determine the classification tag corresponding to the initial distribution network data.

[0100] In one possible implementation, the hierarchical module 703 is specifically used for: Based on the key fields in the target distribution network data, determine the corresponding business context information for the target distribution network data. The business context information includes: risk scenarios and loss profiles. The data classification results are determined based on the business context information corresponding to the target distribution network data.

[0101] In one possible implementation, the hierarchical module 703 is specifically used for: Based on the key fields in the target distribution network data, context enhancement information corresponding to the target distribution network data is retrieved from multiple different types of first databases. The context enhancement information includes key business processes and historical security events associated with the target distribution network data. Based on the contextual enhancement information corresponding to the target distribution network data, risk scenarios corresponding to the target distribution network data are generated.

[0102] In one possible implementation, the hierarchical module 703 is specifically used for: Based on the risk scenarios corresponding to the target distribution network data, loss information corresponding to the target distribution network data is retrieved from multiple different types of second databases. Based on the loss information corresponding to the target distribution network data, a loss profile of the target distribution network data is generated.

[0103] In one possible implementation, the hierarchical module 703 is specifically used for: Based on the target distribution network data, the risk scenarios corresponding to the target distribution network data, and the loss profiles corresponding to the target distribution network data, the classification information corresponding to the target distribution network data is retrieved from multiple third-party databases of different types. Based on the classification information corresponding to the target distribution network data, determine the level to which the target distribution network data belongs.

[0104] In one possible implementation, the data processing device 700 further includes a training module, which is specifically used for: Obtain classification and grading assessment information corresponding to multiple distribution network data, as well as revision information of the classification and grading assessment information corresponding to each distribution network data; Training samples are constructed based on data from each distribution network, classification and grading assessment information corresponding to each distribution network data, and revision information of classification and grading assessment information corresponding to each distribution network data. The loss assessment model is optimized based on the training samples to obtain the optimized loss assessment model, which is used to generate business context information corresponding to the distribution network data.

[0105] The processing flow of each module in the device and the interaction flow between each module can be referred to the relevant descriptions in the above method embodiments, and will not be detailed here.

[0106] This application also provides an electronic device 800, such as... Figure 8 The diagram shown is a structural schematic of an electronic device 800 provided in an embodiment of this application, including: a processor 801, a memory 802, and optionally, a bus 803. The memory 802 stores machine-readable instructions executable by the processor 801. When the electronic device 800 is running, the processor 801 and the memory 802 communicate via the bus 803. When the machine-readable instructions are executed by the processor 801, they perform the method steps in the data processing method described in any of the preceding claims.

[0107] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the method steps of the data processing method described in any of the preceding claims.

[0108] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems and devices described above can be referred to the corresponding processes in the method embodiments, and will not be repeated here. In the several embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection can be through some communication interfaces; the indirect coupling or communication connection of devices or modules can be electrical, mechanical, or other forms.

[0109] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. If the functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes: USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, optical disks, and other media capable of storing program code.

[0110] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A data processing method, characterized in that, include: Acquire initial distribution network data and generate target distribution network data based on the initial distribution network data, wherein the initial distribution network data and the target distribution network data have different data formats; The initial distribution network data is classified to obtain a data classification result, which includes the classification label corresponding to the initial distribution network data. The target distribution network data is subjected to hierarchical processing to obtain a data hierarchical result, which includes the level to which the target distribution network data belongs; Based on the data classification results and the data grading results, classification and grading evaluation information corresponding to the initial distribution network data is generated.

2. The method according to claim 1, characterized in that, The process of classifying the initial distribution network data to obtain data classification results includes: Extract multiple key data pairs from the initial distribution network data and generate semantic vectors for each key data pair, wherein the key data pair includes field name and field value; The semantic vectors of each key data pair are subjected to hierarchical clustering to obtain the data classification results.

3. The method according to claim 2, characterized in that, The hierarchical clustering process performed on the semantic vectors of each key data pair to obtain the data classification result includes: The semantic vectors of each key data pair are clustered using a preset clustering algorithm to determine the first-level cluster, the second-level cluster, and the third-level cluster to which the semantic vectors of each key data pair belong. The first-level cluster is used to represent the business theme to which the key data pair belongs, the second-level cluster is used to represent the business object corresponding to the key data pair under the business theme, and the third-level cluster is used to represent the entity case corresponding to the key data pair under the corresponding business object. Based on the first-level cluster, second-level cluster, and third-level cluster to which the semantic vectors of each key data pair belong, a set of business tags for each key data pair is generated. The set of business tags includes the business tags of the key data pair in the first-level cluster, second-level cluster, and third-level cluster. Based on the business tag set of each key data pair, determine the classification tag corresponding to the initial distribution network data.

4. The method according to claim 1, characterized in that, The step of performing hierarchical processing on the target distribution network data to obtain data hierarchical results includes: Based on the key fields in the target distribution network data, the business context information corresponding to the target distribution network data is determined, and the business context information includes: risk scenarios and loss profiles; The data classification result is determined based on the business context information corresponding to the target distribution network data.

5. The method according to claim 4, characterized in that, The step of determining the business context information corresponding to the target distribution network data based on key fields in the target distribution network data includes: Based on the key fields in the target distribution network data, context enhancement information corresponding to the target distribution network data is retrieved from multiple different types of first databases. The context enhancement information includes key business processes and historical security events associated with the target distribution network data. Based on the context enhancement information corresponding to the target distribution network data, a risk scenario corresponding to the target distribution network data is generated.

6. The method according to claim 5, characterized in that, The step of determining the business context information corresponding to the target distribution network data based on key fields in the target distribution network data includes: Based on the risk scenarios corresponding to the target distribution network data, loss information corresponding to the target distribution network data is retrieved from multiple different types of second databases. Based on the loss information corresponding to the target distribution network data, a loss profile of the target distribution network data is generated.

7. The method according to claim 6, characterized in that, The step of determining the data classification result based on the business context information corresponding to the target distribution network data includes: Based on the target distribution network data, the risk scenarios corresponding to the target distribution network data, and the loss profile corresponding to the target distribution network data, the classification information corresponding to the target distribution network data is retrieved from multiple third-type databases of different types. Based on the classification information corresponding to the target distribution network data, the level to which the target distribution network data belongs is determined.

8. The method according to claim 1, characterized in that, The method further includes: Obtain classification and grading assessment information corresponding to multiple distribution network data, as well as revision information of the classification and grading assessment information corresponding to each distribution network data; Training samples are constructed based on the distribution network data, the classification and grading evaluation information corresponding to the distribution network data, and the revision information of the classification and grading evaluation information corresponding to the distribution network data. The loss assessment model is optimized based on the training samples to obtain an optimized loss assessment model, which is used to generate business context information corresponding to distribution network data.

9. An electronic device, characterized in that, include: A processor and a memory, the memory storing machine-readable instructions executable by the processor, wherein when the electronic device is in operation, the processor executes the machine-readable instructions to perform the steps of the data processing method as described in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the data processing method as described in any one of claims 1 to 8.

Images