Content security-oriented risk mining and answering method and device, medium and product

Abstract

The specification provides a content security-oriented risk mining and answering method, device, medium and product. The content security-oriented risk mining method comprises: obtaining a question sample to be subjected to content security risk identification from at least one data source, and obtaining a plurality of risk elements from a preset security knowledge base; constructing a prompt word based on the question sample and the plurality of risk elements, and inputting the prompt word into a trained risk identification model to instruct the risk identification model to perform the following identification operation: identifying whether the question sample hits any of the plurality of risk elements; if not, performing content security risk analysis on the question sample to determine whether there is a new risk element; and if the risk identification model outputs a risk identification result that there is a new risk element, updating a risk identification process of an online answering system based on the new risk element in the risk identification result.

Description

Technical Field

[0001] This specification relates to the field of content security technology, and in particular to a risk mining method for content security, a response method for content security, an electronic device, a computer-readable storage medium, and a computer program product. Background Technology

[0002] With the rapid development of AIGC (Artificial Intelligence Generated Content) technology, various applications based on large language models have emerged, creating a fiercely competitive market. These large language models rely on massive amounts of training data and possess powerful content generation and dialogue capabilities, but this technological paradigm has also introduced content security challenges.

[0003] First, the knowledge base of large language models originates from the collection of publicly available data from the internet and other sources. This data itself may contain harmful information that violates public order and good morals, endangers social security, touches on sensitive topics, violates technological ethics, or infringes on individual rights. This means that when generating responses, large language models may unintentionally reproduce or combine this harmful information, posing a risk of outputting information that violates content safety regulations.

[0004] Secondly, the inherent "illusion" characteristic of large language models makes them prone to generating content that is factually inaccurate or entirely fictitious. In a security context, this "illusion" manifests not only as factual errors but also as the fabrication of non-existent risk events, the generation of misleading sensitive information, or the creation of content that violates security safeguards, thus posing serious security risks.

[0005] Therefore, there is an urgent need to develop content security protection solutions that can adapt to the characteristics of AIGC technology in order to address the security challenges of large models. Summary of the Invention

[0006] In view of the above, one or more embodiments of this specification provide the following technical solutions:

[0007] According to a first aspect of one or more embodiments of this specification, a risk mining method for content security is proposed, comprising:

[0008] Obtain problem samples for content security risk identification from at least one data source, and obtain multiple risk elements from a pre-built security knowledge base;

[0009] Based on the problem sample and the multiple risk elements, a prompt word is constructed and input into the trained risk identification model to instruct the risk identification model to perform the following identification operations: identify whether the problem sample hits any of the multiple risk elements; if not, perform content security risk analysis on the problem sample to determine whether there are any new risk elements.

[0010] If the risk identification model outputs a risk identification result containing new risk elements, the risk identification process of the online response system is updated based on the new risk elements in the risk identification result.

[0011] According to a second aspect of one or more embodiments of this specification, a content security-oriented response method is proposed, comprising:

[0012] Receive questions to be answered;

[0013] Multiple risk elements are obtained from a pre-set security knowledge base. Prompt words are constructed based on the question to be answered and the multiple risk elements. The prompt words are then input into a trained online risk identification model to obtain risk identification results. The risk items in the security knowledge base are dynamically updated based on the method described in the first aspect.

[0014] If the risk identification result includes the risk element hit by the question to be answered, a security answer associated with the hit risk element is obtained from the security knowledge base, and a final answer to the question to be answered is generated based on the security answer.

[0015] According to a third aspect of the embodiments of this specification, an electronic device is provided, comprising:

[0016] processor;

[0017] Memory used to store processor-executable instructions;

[0018] Wherein, when the processor executes the executable instructions, it is used to implement the method described in the first aspect.

[0019] According to a fourth aspect of the embodiments of this specification, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps of the method described in the first aspect.

[0020] According to a fifth aspect of the embodiments of this specification, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the method described in the first aspect.

[0021] As can be seen from the above embodiments, this specification constructs prompt words that integrate problem samples and known risk elements, and uses a risk identification model for deep semantic analysis. Through a two-layer identification logic of "first matching existing risk elements + then analyzing new risks", it ensures efficiency and stability when identifying known risks, while also providing flexibility and scalability when identifying unknown risks. After discovering new risk elements, the risk identification process in the online response system is dynamically updated based on the new risk elements, enabling the protection capabilities of the online response system to continuously iterate as risks change.

[0022] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this specification. Attached Figure Description

[0023] Figure 1 This is a flowchart of an exemplary embodiment of a risk mining method for content security.

[0024] Figure 2 This is a schematic diagram of a risk mining process provided in an exemplary embodiment.

[0025] Figure 3 This is a flowchart of a content security-oriented response method provided in an exemplary embodiment.

[0026] Figure 4 This is a schematic diagram of an online response process provided in an exemplary embodiment.

[0027] Figure 5 This is a schematic diagram of the structure of a device provided in an exemplary embodiment. Detailed Implementation

[0028] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0029] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this manual are all information and data authorized by the user or fully authorized by all parties. The collection, use and processing of related data shall comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals shall be provided for users to choose to authorize or refuse.

[0030] The following description, in conjunction with the accompanying drawings, will provide an exemplary account of the specific implementation methods for the content security-oriented risk mining method and online application process of this specification.

[0031] Please see Figure 1 and Figure 2 This specification provides a risk mining method for content security, enabling automated mining and generation of new risk elements. This method can be executed by electronic devices, including but not limited to servers (such as physical servers, virtual servers, etc.), tablet computers, laptops, desktop computers, or other types of devices. The method includes:

[0032] In S100, problem samples to be identified for content security risks are obtained from at least one data source, and multiple risk elements are obtained from a pre-built security knowledge base.

[0033] In this step, the electronic device obtains question samples from one or more data sources. Data sources include, but are not limited to, user questions received in real time by the online response system, publicly available text data from third-party content platforms, and historical interaction records in system logs.

[0034] For example, the security knowledge base includes various types of risk elements, serving as the foundational data support module for feature comparison, semantic reasoning, and new risk discovery in the risk identification model. Risk elements can be categorized into multiple dimensions based on the nature of the content security risk, such as sensitive topics, illegal and irregular activities, ethical and moral issues, false and misleading information, violent and terrorist content, privacy breaches, and negative social influences. The attribute information for each type of risk element includes, but is not limited to, at least one of the following:

[0035] ① A globally unique risk element identifier; this identifier uniquely identifies a risk element, facilitating rapid indexing, tracking, and version management. ② Risk description information; this information defines and explains the core features of the risk element at the semantic level. This description can be represented using natural language text, or it can be represented using a combination of natural language text and structured tags. For example, for a privacy-related risk element, its description information can include natural language explanations (e.g., collection, display, or dissemination of sensitive data such as personal identification information, contact information, address, financial accounts, and biometrics) and structured tags (e.g., category tag: privacy breach; sensitivity level: high). The combination of natural language and structured tags not only facilitates human-computer co-reading but also enhances the model's semantic awareness at different granularities, enabling the risk identification model to understand descriptive semantics and perform accurate matching using structured tags.

[0036] ③ Keywords. Each risk element can be associated with a set of keywords, which can be generated through manual compilation, statistical mining, or attention extraction methods based on language models.

[0037] ④ Examples of risk scenarios; used to describe the typical manifestations of risk elements in real-world contexts, so that the model can understand the context in which the risk occurs during training and inference. For example, a scenario example of the risk element "false medical information" may include typical fictitious drug names, false descriptions of efficacy, and explanations of the potential harms they cause.

[0038] In addition to this, each risk element is also associated with the following extended information:

[0039] ① A set of all questions related to this risk element. This set records all question samples identified as matching this risk element during the risk discovery process. As the risk identification process continues, this set adopts a dynamic expansion mechanism, which can continuously accumulate new empirical cases to form an instance library of this risk element, providing rich sample support for subsequent risk analysis.

[0040] ② A set of safe responses may include one or more of the following response strategies: ⑴ Standardized responses: Pre-designed, standardized text content tailored to the essential characteristics of risk elements. These responses undergo compliance review and security verification to ensure they conform to content security standards in semantic expression, content stance, and guidance direction, and can be directly applied to risk response scenarios. ⑵ Guided responses: Response solutions employing constructive guidance strategies. By providing alternative suggestions, safe operation guidelines, or compliance information prompts, they maintain the continuity of the dialogue while ensuring content security, meeting both risk control requirements and user experience. ⑶ Instanced responses: Safe responses corresponding to the question samples in the question set. These safe responses provide precise response strategies for specific risk manifestations, forming a solution from risk identification to safe response.

[0041] ③ Semantic Vector. A semantic vector is an embedded representation of a risk element in the semantic space, used to support high-dimensional similarity calculation and deep semantic matching. This vector can be obtained by encoding at least one attribute of the risk element using a pre-trained language model (such as Transformer, BERT, or a dedicated semantic encoding network).

[0042] In one possible implementation, the electronic device can obtain all stored risk elements from a pre-built security knowledge base. For example, it can obtain the risk element identifiers, risk description information, and keyword attributes of all stored risk elements, so as to perform full matching and comparison when analyzing problem samples. This implementation is usually suitable for scenarios where the data scale is controllable or the knowledge base scale is small, or for risk identification scenarios that require high accuracy and full coverage.

[0043] In another possible implementation, the electronic device converts both the problem sample and the risk elements into high-dimensional semantic vectors, and then filters out the set of risk elements most relevant to the problem sample by calculating similarity. Specifically, the electronic device can obtain a first vector converted from the problem sample, and a second vector converted from each risk element in the security knowledge base; based on the similarity between the first vector and each of the second vectors, it obtains the risk elements with similarity higher than a preset threshold, or the top N risk elements in the similarity ranking results (ranked from high to low), where N > 0. This implementation can significantly reduce the amount of matching computation, improve response speed, and is suitable for scenarios with a large knowledge base, achieving a balance between efficiency and accuracy.

[0044] In S102, prompt words are constructed based on the problem sample and multiple risk elements, and the prompt words are input into the trained risk identification model to instruct the risk identification model to perform the following identification operations: identify whether the problem sample hits any of the multiple risk elements; if not, perform content security risk analysis on the problem sample to determine whether there are new risk elements.

[0045] In this step, problem samples and various risk elements can be filled into a preset prompt template to generate prompts. The prompt template may include at least one of the following prompts:

[0046] ① Role positioning information: Role positioning information is used to determine the semantic role and thinking framework of the model before model inference, so that the model has a clear identity and task boundary when understanding the relationship between problem samples and risk elements. For example, the model can be set as a "content security review expert" or "semantic risk analyzer". This information enables the model to adopt a security assessment perspective in subsequent inference, rather than a normal question-and-answer perspective.

[0047] ② The objective is used to indicate the final identification or judgment result that the model needs to achieve in the current task. This part usually appears in the form of an instructional description, such as "determine whether the input question involves privacy leakage risks" or "identify the degree of matching between the input text and risk elements in the knowledge base".

[0048] ③ Constraints are used to limit the scope of the model's behavior during inference and output processes, preventing the model from generating inference content that is irrelevant to the task or unsafe. Constraints may include logical scope restrictions (such as "judgments are made only based on given risk elements"), expression scope restrictions (such as "no risky instance content may be generated"), or format constraints (such as "no subjective opinions may be included in the output").

[0049] ④ Output requirements, which specify the format, granularity and hierarchical structure of the model output results. For example, the model may be required to output "the number and confidence value of the hit risk element" or "output 'yes / no' with a brief explanation".

[0050] ⑤ Output examples, used to provide the model with reference samples that meet the format and semantic requirements, enabling the model to understand the expected format and style when generating output. Output examples can include positive and negative examples, such as correct risk assessment results, typical risk description methods, or standard output templates.

[0051] By comprehensively incorporating role positioning information, objectives, constraints, output requirements, and output examples into the prompt template, fine-grained control over the model's semantic behavior can be achieved during the input phase, making the model's reasoning process more targeted and controllable. This design not only improves the semantic constraints and output stability of the risk identification model but also significantly reduces hallucination generation and semantic deviation, thereby enhancing the reliability of overall content security protection while ensuring recognition accuracy.

[0052] The risk identification model can be a language model based on deep neural networks, such as a multi-layer Transformer structure, a dual-tower matching network, or a similarity matching model based on contrastive learning. After receiving prompt words, the risk identification model can perform two types of identification tasks: first, to determine whether the question sample hits an existing risk element; second, when no risk element is hit, to further identify whether there is a new risk pattern not covered by the knowledge base. The risk identification result output by the risk identification model includes any of the following: (1) hitting any one of the multiple risk elements; (2) a new risk element exists; (3) no risk exists.

[0053] In S104, if the risk identification model outputs a risk identification result containing new risk elements, the risk identification process of the online response system is updated based on the new risk elements in the risk identification result.

[0054] When the risk identification model detects a new risk element, a dynamic update process is initiated. This process adjusts the risk identification workflow of the online response system based on the characteristics of the new risk element. By introducing an adaptive update mechanism into the identification process, it gains dynamic learning and self-evolution capabilities. This mechanism enables continuous optimization of the risk identification process, allowing the online response system to maintain efficient identification capabilities when facing emerging risk scenarios, thereby significantly enhancing the robustness and foresight of the overall content security protection system.

[0055] In some embodiments, to ensure the accuracy of risk identification, before updating the risk identification process of the online response system based on new risk elements in the risk identification results, electronic devices may use at least one of the following verification mechanisms to confirm the validity of new risk elements.

[0056] In one possible implementation, the aforementioned prompts can instruct the risk identification model to simultaneously output a confidence level for a new risk element. The confidence level characterizes the certainty of the model's identification results and is typically calculated by combining the model's internal classification probability distribution, vector distance, or attention weights. By using the confidence level as an auxiliary indicator, the reliability of the model's judgment can be quantitatively evaluated at the output stage, thereby avoiding the erroneous addition of risk elements due to occasional "illusions."

[0057] If the confidence level is higher than a preset confidence threshold, a new risk element is initially identified. The electronic device then further calculates the semantic similarity between the new risk element and existing risk elements in the security knowledge base. If the semantic similarity is lower than a preset similarity threshold, it indicates that the new risk element differs significantly from existing risk elements in the semantic space and may belong to a risk category not yet covered by the knowledge base. At this point, the new risk element can be confirmed as a valid new risk element.

[0058] If the risk identification model outputs a risk identification result containing new risk elements, and the new risk elements in the risk identification result are determined to be valid, the risk identification process of the online response system is updated based on the new risk elements in the risk identification result.

[0059] In this embodiment, by introducing a dual verification mechanism of confidence level determination and semantic similarity verification, this implementation achieves reliable filtering of risk identification results and secure update control of the knowledge base. On the one hand, the confidence level threshold can effectively suppress misjudgments caused by low confidence output of the model and reduce the accumulation of noise in the knowledge base; on the other hand, the introduction of the similarity threshold can ensure that newly added risk elements have semantic independence and information increment at the semantic level, avoiding duplicate storage or semantic overlap.

[0060] In another possible implementation, if the risk identification model outputs a risk identification result with new risk elements for the first time for a question sample, the electronic device can generate multiple extended question samples with semantic similarity to the question sample that are higher than a set threshold. The generation of extended question samples can be achieved in a variety of ways, such as: (1) using semantic substitution or sentence transformation to perturb the original question sample at the language level, keeping the semantic core unchanged but the expression form different; (2) generating a set of similar questions around the topic of the question sample in a controlled semantic space based on a language model; (3) combining embedding vector retrieval technology to select question samples with semantic similarity higher than a set threshold from historical corpora or online response systems to construct an extended sample set.

[0061] Subsequently, the electronic device inputs multiple extended problem samples into the risk identification model to obtain the risk identification results for each extended problem sample. Based on the risk identification results of each extended problem sample, the proportion of new risk elements identified as matching the risk identification results in the multiple extended problem samples is calculated out of the total number of extended problem samples. This proportion can be used as a quantitative indicator of the stability and generalization ability of the model's identification results to assess whether new risk elements have consistent reproducibility.

[0062] If the proportion exceeds the preset proportion threshold, it indicates that the new risk element can be consistently identified by the model in multiple semantic neighborhood samples, demonstrating its high stability and semantic independence, and confirming the validity of the new risk element in the risk identification results. Conversely, if the proportion is below the preset proportion threshold, it may indicate that the risk judgment lacks semantic consistency or is an occasional output of the model, and it can be determined that the new risk element is not yet valid.

[0063] When the risk identification model outputs a risk identification result containing new risk elements, and the new risk elements in the risk identification result are determined to be valid, the electronic device can update the risk identification process of the online response system based on the new risk elements in the risk identification result.

[0064] In this embodiment, by introducing an extended sample verification mechanism after the model outputs risk identification results containing new risk elements, the robustness of the model's judgment can be verified from the perspective of data consistency, significantly improving the reliability and interpretability of the risk identification results. On the one hand, this scheme avoids the model introducing invalid risk elements due to accidental misjudgment or single-sample illusion; on the other hand, through the generation and consistency verification of semantic neighborhood extended samples, the universality and stability of risk judgments can be evaluated in a multi-dimensional semantic space, ensuring that the risk identification process of the online response system is only updated when the model shows consistent judgments in similar contexts.

[0065] In another possible implementation, there are multiple risk identification models. Electronic devices can input the constructed prompts into each of these risk identification models to obtain their respective risk identification results. These multiple risk identification models can employ different model architectures, training corpora, or fine-tuning strategies, such as language models based on different corpora, cross-linguistic models, or sub-models focused on specific risk categories, thereby forming a risk identification system with diverse reasoning characteristics.

[0066] For example, electronic devices can also input the prompt word into the same risk identification model once or more to obtain one or more output risk identification results. This design can utilize the model's random sampling mechanism to generate multiple independent inference results under the same task conditions, thereby improving the coverage and statistical robustness of the identification.

[0067] After obtaining risk identification results from multiple risk identification models and / or multiple inferences from the same risk identification model, the electronic device can count the number of risk identification results containing new risk elements. If this number is greater than or equal to a first preset number, it indicates that multiple models exhibit similar risk judgment trends on the current problem sample. In this case, further aggregation analysis can be performed on these risk identification results. The electronic device can cluster the new risk elements in all output risk identification results, thereby classifying new risk elements with semantic similarity higher than a set threshold into the same cluster. Subsequently, the electronic device counts the total number of clusters and determines the cluster containing the most new risk elements as the master cluster. The master cluster represents a risk clustering region where the identification results of multiple models are highly consistent at the semantic level, and its result can be regarded as a cross-model consensus on new risk elements.

[0068] Based on this, if the total number of clusters is less than the second preset number, it means that most new risk elements are highly concentrated in the semantic space, belonging to a few semantic clusters, rather than being scattered across many different clusters. This condition is used to determine whether the output of new risk elements has consistency and concentration. If the output elements are too scattered (the total number of clusters is greater than or equal to the second preset number), it indicates a lack of consensus among models, which may lead to sporadic errors or hallucinations, and the reliability of the new risk is low. Conversely, a small number of clusters means that most models have a consensus on the same risk type, and these can be considered as candidates for valid new risks.

[0069] If the number of new risk elements contained in the main cluster exceeds the third preset number, the main cluster is the cluster containing the most new risk elements. If the number of new risk elements contained in this cluster exceeds the third preset number, it means that the number of new risk elements in this cluster is sufficient and statistically and semantically representative. This condition is used to select the most representative and stable risk categories among multiple model outputs, ensuring that the risk elements updating the knowledge base are fully validated and will not be misjudged due to chance or single model bias.

[0070] If the above two conditions are met, it indicates that the identification results among the models are highly concentrated and consistent, and the new risk element in the main cluster can be determined as a valid risk category. At this time, the electronic device can update the risk identification process of the online response system based on the new risk element in the main cluster.

[0071] This embodiment introduces a multi-model collaborative identification and clustering confirmation mechanism to form a multi-verification closed loop, effectively improving the robustness and consistency of new risk identification results: on the one hand, statistical analysis of multiple model or multiple inference outputs can reduce the risk of misjudgment caused by single model illusion or bias; on the other hand, semantic clustering can identify consensus regions between multiple model outputs in high-dimensional space, thereby confirming the validity of potential new risk categories in a data-driven manner; when the main cluster is formed and the above two conditions are met, the risk identification process can be automatically updated to achieve an autonomous closed loop from model identification to system evolution.

[0072] It is understandable that the three possible implementation methods mentioned above—the verification method based on confidence and semantic similarity, the consistency verification method based on expanded samples, and the multi-model collaborative clustering verification method—can be flexibly selected in practical applications according to specific system requirements, task scenarios, and computing resource conditions. Only one implementation method can be used depending on the security strategy and risk identification accuracy requirements. Alternatively, two or three implementation methods can be combined to achieve multi-level and multi-dimensional risk assessment, depending on actual needs.

[0073] In some embodiments, if the risk identification model outputs a risk identification result containing a new risk element, and the new risk element in the risk identification result is determined to be valid, a dynamic update process for the security knowledge base can be initiated based on the new risk element. First, a globally unique risk element identifier is assigned to the new risk element to ensure its traceability in the security knowledge base. Then, a new risk element object conforming to a predefined data structure is instantiated in the security knowledge base to store the relevant information of the new risk element. The relevant information of the new risk element includes its attribute information, which includes semantic features directly generated by the risk identification model, such as risk description information, keywords, and typical risk scenario examples. The relevant information also includes the following extended information: a sample of questions identifying the new risk element; optionally, it may also include the aforementioned extended sample of questions.

[0074] For example, this embodiment provides two mechanisms for triggering risk identification process updates: The first is an immediate triggering mode. Once a new risk element output by the risk identification model passes validity determination, the update process is immediately initiated. This can be implemented using an event-driven architecture, using the validity confirmation signal as the update instruction. This minimizes the delay from risk discovery to protection deployment, making it suitable for risk scenarios with high timeliness requirements. The second is a storage-triggered mode (e.g., ...). Figure 2As shown in the diagram, the write operation to the security knowledge base serves as the update initiation node. This mechanism ensures that only risk elements that have completed persistent storage are synchronized to the online system, and data consistency is guaranteed through a database transaction mechanism. In some embodiments, the risk identification process of the online response system can be updated through at least one of the following implementation methods to achieve dynamic inclusion of new risk elements and enhanced real-time protection capabilities:

[0075] Implementation Method 1: Risk Identification and Update Based on a Rule Engine. Electronic devices can transform new risk elements from the risk identification results into risk identification rules that can be used for online matching, and add these rules to the rule engine of the online response system. Risk identification rules can include structured information such as risk element identifiers, trigger keywords, semantic matching conditions, and applicable scenarios, enabling the online response system to immediately identify risks in question samples that meet the conditions during real-time response. This implementation method allows for the immediate application of new risk elements, taking effect as soon as a new risk is discovered; through rule-based matching, it improves identification efficiency and controllability, making it suitable for online response scenarios with high real-time requirements.

[0076] Implementation Method 2: Risk Identification Update Based on Prompt Word Enhancement. Electronic devices can incorporate new risk elements from the risk identification results into the prompt words of the online risk identification model. This can be achieved by dynamically adding them to the prompt template of the online risk identification model, or by retrieving the new risk element from the knowledge base during prompt word construction. This allows the model to combine the new risk element with the question to be answered, guiding the model to identify the new risk element in subsequent risk identification tasks. This approach can quickly expand the model's recognition capabilities, incorporating new risk types without retraining; and by guiding the model's attention through prompt words, the risk identification results become more accurate and interpretable.

[0077] Implementation Method 3: Electronic devices can use new risk elements and problem samples from the risk identification results as training samples to optimize and train the online risk identification model. This method allows for the gradual enhancement of the model's ability to identify new risk elements while maintaining its original capabilities, and improves its generalization performance to semantically diverse or ambiguous expressions. It systematically improves the model's recognition ability and robustness, enabling the model to maintain accuracy in more complex semantic environments.

[0078] Among them, implementation methods 1 and 2 can immediately update the online response system, enabling new risk elements to take effect in real-time identification; implementation method 3 requires the accumulation of sufficient training samples for model optimization, which is a medium- to long-term update strategy and can be used in conjunction with the first two methods to form a closed-loop mechanism of short-term response and long-term learning; the three methods can be used individually or in combination according to the actual scenario to balance real-time performance, accuracy and system robustness, and achieve flexibility, adaptability and continuous optimization of the online risk identification process.

[0079] In some embodiments, please refer to Figure 2 Electronic devices can also input new risk elements from question samples and risk identification results into a trained security response model, so that the security response model can generate a security response that is specific to the question sample and complies with content security specifications.

[0080] The secure response model is trained based on secure question-and-answer pairs, which include questions related to any risk element and answers that comply with content security guidelines. During training, the model can be optimized in the following ways: Supervised training is performed by inputting questions related to any risk element from the secure question-and-answer pairs into the model to be trained. The optimization objective is to minimize the error between the predicted answer output by the model and the content security-compliant answers from the secure question-and-answer pairs. The model parameters are adjusted so that the model can comprehensively consider risk element features and content security constraints when generating answers. Cross-validation, model fine-tuning, or incremental training can be used to continuously optimize the model's generation capability on different risk types of questions, improving its generalization ability to identify unseen risk elements and its secure answer generation capability, thereby obtaining a well-trained secure response model.

[0081] In practical applications, electronic devices can perform quality checks on the secure responses generated by the secure response model to ensure that the output responses comply with content security specifications and can be used for knowledge base updates. The quality check process can include, but is not limited to, the following methods: ① Manual quality check: Security experts or auditors manually review the model-generated responses, including text compliance checks, sensitive information masking verification, semantic consistency assessment, and response integrity verification; ② Automated quality check: The model output is scanned using automated rule engines or natural language processing algorithms, including sensitive word detection, violation information identification, structural format verification, semantic rationality checks, and confidence assessment; ③ Review and feedback mechanism: The quality check results can serve as feedback signals to adjust prompt templates or optimize the secure response model training parameters, achieving closed-loop optimization and improving the security and reliability of subsequently generated responses.

[0082] If the safety response passes quality control, please refer to [link / reference]. Figure 2 Electronic devices can associate and store new risk elements, question samples, and safety answers from risk identification results into a security knowledge base. This operation allows for: a direct mapping between new risk elements and safety answers, enabling direct retrieval in subsequent risk identification or response tasks, thus improving identification and response efficiency; and the structured storage of question samples, risk elements, and safety answers facilitates systematic management, rapid retrieval, and incremental updates of the knowledge base.

[0083] Through the above process, a closed-loop mechanism can be achieved from new risk identification to safe response generation and knowledge base update, ensuring that the safe response corresponding to each new risk element complies with content security standards and reducing the risk of unauthorized output; supporting knowledge base iteration, enabling the online response system to have adaptive response capabilities when facing new risks; improving the automation and intelligence level of the online response system, while maintaining high reliability and controllability.

[0084] In some embodiments, if the risk identification model outputs a risk identification result that hits any of the multiple risk elements, the electronic device can establish a mapping relationship between the identified question sample and the hit risk element, storing it as a case of that risk element in the security knowledge base. This storage method enriches the instance library of risk elements and provides data support for subsequent risk analysis. Alternatively, the electronic device can input the question sample and its hit risk element into the security response model, generate a security response that conforms to content security specifications, establish a mapping relationship between the question sample and the generated security response and its hit risk element, storing it as supplementary content for that risk element in the security knowledge base.

[0085] The following is an example of the response process in an online response system: Please refer to Figure 3 and Figure 4 This specification provides a content security-oriented response method that enables real-time identification and secure response to both new and old risks. This method can be executed by an electronic device with an online response system deployed. The method includes:

[0086] In S300, questions awaiting answers are received.

[0087] Electronic devices receive unanswered questions submitted by users. The receiving process may include preprocessing the input text, such as removing noisy characters, standardizing expressions, segmenting text, or generating semantic vectors for use by subsequent risk identification and content generation modules.

[0088] In S302, multiple risk elements are obtained from a pre-set security knowledge base. Based on the question to be answered and the multiple risk elements, prompt words are constructed and input into a trained online risk identification model to obtain risk identification results. The risk elements included in the security knowledge base are dynamically updated based on the above-mentioned content security-oriented risk mining method.

[0089] In one possible implementation, electronic devices can retrieve all stored risk elements from a pre-built security knowledge base, thereby performing full matching and comparison when analyzing questions to be answered. This implementation is typically suitable for scenarios where the data scale is controllable or the knowledge base is small, or for risk identification scenarios that require high precision and full coverage.

[0090] In another possible implementation, the electronic device converts the question to be answered and the risk elements into high-dimensional semantic vectors, and then filters out the set of risk elements most relevant to the question by calculating similarity. Specifically, the electronic device can obtain a first vector converted from the question to be answered, and a second vector converted from each risk element in the security knowledge base; based on the similarity between the first vector and each second vector, it can obtain risk elements with similarity higher than a preset threshold or the top N risk elements in the similarity ranking results (ranked from high to low), where N > 0. This implementation can significantly reduce the amount of matching computation, improve the system response speed, and is suitable for scenarios with a large knowledge base or scenarios requiring rapid response, achieving a balance between efficiency and accuracy.

[0091] In this step, problem samples and various risk elements can be filled into a preset prompt template to generate prompts. The prompt content included in the prompt template can be found in the description above, and will not be repeated here.

[0092] Online risk identification models can be lightweight language models or models with other structures, such as classification models fine-tuned for content security or instruction-driven question-answering models. By inputting prompt words into the model, it can identify whether a question hits any risk element.

[0093] In S304, if the risk identification result includes the risk element hit by the question to be answered, the security answer associated with the hit risk element is obtained from the security knowledge base, and the final answer to the question to be answered is generated based on the security answer.

[0094] The safe responses may include one or more of the following: ① Standardized text designed for specific risk elements. This type of response is pre-designed and standardized text content used to directly address questions of specific risk types, ensuring that the output content complies with laws and regulations, platform specifications, and content security requirements. It may include risk warnings, blocking of prohibited information, or safety guidance statements to ensure that the response is safe, clear, and controllable in expression. ② Suggestive guidance content. This type of response provides guidance or recommendations to user questions, helping users obtain information within a legal and safe scope. It may use suggestive language, exemplary operation suggestions, or alternative information prompts to make the response both compliant with content security requirements and usable and readable. ③ Safe responses corresponding to question samples associated with the hit risk elements.

[0095] In one possible implementation, when there are multiple security answers associated with any risk element, at least a portion of the security answers associated with the hit risk element can be randomly obtained from the security knowledge base.

[0096] In another possible implementation, when there are multiple safe answers associated with any risk element, a first vector derived from the question to be answered and a third vector derived from each safe answer associated with the hit risk element can be obtained. Based on the similarity between the first vector and each third vector, safe answers with similarity higher than a preset threshold or the top N safe answers in the similarity ranking results (ranked from high to low), where N > 0, are selected. This embodiment ensures that the selected answers are not only relevant in topic but also highly consistent with the user's question in semantic intent through deep matching at the semantic level, effectively avoiding irrelevant answers. It fully leverages the value of multiple versions of safe answers accumulated in the security knowledge base and achieves precise allocation of answer resources through intelligent routing, ensuring content security while improving response quality and user experience.

[0097] Based on the acquired security answers, the electronic device generates a final response to the question to be answered. For example, the security answer can be directly output as the response; alternatively, the security answer can be semantically enhanced to naturally match the context of the user's question; or, the question to be answered and the security answer can be input into a security response model, which will then fine-tune the response to ensure that the language is compliant with regulations, logically clear, and free of illegal information. The final response can be presented to the user as the output of the online response system and can also be stored in a security knowledge base for subsequent risk identification and knowledge updates.

[0098] Using the methods described above, the online response system can achieve a closed-loop process from risk identification to secure response: effectively identifying content security risks in the questions to be answered and preventing the output of unauthorized information; utilizing secure responses from the security knowledge base to achieve rapid and reliable response generation; the dynamically updated knowledge base ensures the real-time and scalability of risk identification and secure response content; and the lightweight model and prompt word construction mechanism improve online response efficiency, making it suitable for high-frequency, high-concurrency online response scenarios.

[0099] In some embodiments, the risk identification process of the online response system can be implemented by combining a rule engine with an online risk identification model. After receiving a question to be answered, a pre-built rule engine can be used to identify whether the question matches any risk identification rule; wherein, each risk identification rule corresponds to a risk element in the security knowledge base; the risk identification rules included in the rule engine are dynamically updated based on the aforementioned content security-oriented risk mining method.

[0100] If the question to be answered matches any risk identification rule, it is determined that the question matches the corresponding risk element. A security answer associated with the risk element corresponding to the matched risk identification rule can be obtained from the security knowledge base. The security answer can be at least one of standardized text, suggestive guidance content, and security answers corresponding to historical question samples, ensuring that the output content complies with content security specifications. Based on the obtained security answer, the electronic device generates the final answer to the question to be answered. For example, the security answer can be fine-tuned based on the question to be answered, so that the final answer is semantically natural, logically clear, and can be directly output to the user.

[0101] If the question to be answered does not match any risk identification rules, the electronic device will execute the process S302~S304, which involves using the online risk identification model to identify risks, obtain safe answers, and generate a final response.

[0102] By combining a rule engine with an online risk identification model, the rule engine matching process involves minimal computation, enabling immediate identification and rapid response to known risks. In cases where a rule is not matched, the online risk identification model provides supplementary identification, ensuring that the system can still generate safe answers to unknown or complex risk questions.

[0103] The various technical features in the above embodiments can be combined arbitrarily, as long as there is no conflict or contradiction between the combinations of features. However, due to space limitations, they are not described one by one. Therefore, the arbitrary combination of various technical features in the above embodiments is also within the scope of this specification.

[0104] Figure 5 This is a schematic structural diagram of a device provided in an exemplary embodiment. For example... Figure 5 As shown, device 500 mainly consists of a communication interface 502, a user interface 504, a processor 506, and a data storage 508. These components are interconnected and communicate with each other via a system bus, network, or other connection mechanism 510. The communication interface 502 enables device 500 to communicate with other devices, access networks, and transmission networks via analog or digital modulation. For example, the communication interface 502 may include a chipset and antenna for wireless communication with a radio access network or access point. Furthermore, the communication interface 502 can be a wired interface such as Ethernet, Token Ring, or a USB port, or a wireless interface such as Wi-Fi, Bluetooth, Global Positioning System (GPS), or a wide-area wireless interface (e.g., WiMAX or LTE). Of course, the communication interface 502 can also support other forms of physical layer interfaces and standard or proprietary communication protocols. The communication interface 502 may also include multiple physical communication interfaces, such as Wi-Fi interfaces, Bluetooth interfaces, and wide-area wireless interfaces.

[0105] User interface 504 includes receiving user input and providing output to the user. Therefore, user interface 504 may include input components such as a keypad, keyboard, touch-sensitive or presence-sensitive panel, computer mouse, trackball, joystick, microphone, still camera, and video camera, and output components such as a display screen (which may be combined with a touch-sensitive panel), CRT, LCD, LED, display using DLP technology, printer, and other similar devices known or developed in the future. User interface 504 may also generate auditory output via speakers, speaker jacks, audio output ports, audio output devices, headphones, and other similar devices known or developed in the future. In some embodiments, user interface 504 may include software, circuitry, or other forms of logic capable of transmitting and receiving data from external user input / output devices. Additionally or alternatively, device 500 may support remote access from other devices via communication interface 502 or another physical interface (not shown). User interface 504 may be configured to receive user input, the position and movement of which may be indicated by indicators or cursors described herein. User interface 504 may also be configured as a display device for rendering or displaying text fragments.

[0106] Processor 506 may contain one or more general-purpose processors and / or special-purpose processors.

[0107] Data storage 508 may include one or more volatile and / or non-volatile storage components and may be integrated wholly or partially with processor 506. Data storage 508 may include removable and non-removable components.

[0108] Processor 506 is capable of executing program instructions 518 (e.g., compiled or uncompiled program logic and / or machine code) stored in data storage 508 to perform the various functions described herein. Data storage 508 may contain a non-transitory computer-readable medium on which program instructions are stored, which, when executed by device 500, enable device 500 to perform any methods, processes, or functions disclosed in this specification and / or the accompanying drawings. Execution of program instructions 518 by processor 506 may result in processor 506 using data 512.

[0109] For example, program instructions 518 may include an operating system 522 (e.g., an operating system kernel, device drivers, and / or other modules) installed on device 500 and one or more applications 520 (e.g., a browser, social application, or game application). Similarly, data 512 may include operating system data 516 and application data 514. Operating system data 516 is primarily accessible to the operating system 522, while application data 514 is primarily accessible to one or more applications 520. Application data 514 may reside in a file system visible or hidden from the user of device 500.

[0110] Application 520 can communicate with operating system 522 through one or more application programming interfaces (APIs). These APIs help application 520 read and / or write application data 514, transmit or receive information via communication interface 502, receive or display information on user interface 504, etc.

[0111] In some terminology, application 520 may be simply referred to as "app". Furthermore, application 520 can be downloaded to device 500 through one or more online app stores or app markets. However, applications can also be installed on device 500 in other ways, such as through a web browser or a physical interface on device 500 (e.g., a USB port).

[0112] In some embodiments, the risk mining device for content security can be applied to, for example... Figure 5 The device shown implements the technical solution described in this specification. The risk detection device for content security may include:

[0113] The acquisition module is used to acquire problem samples to be identified for content security risks from at least one data source, and to acquire multiple types of risk elements from a pre-built security knowledge base;

[0114] The risk identification module is used to construct prompt words based on problem samples and multiple risk elements, and input the prompt words into the trained risk identification model to instruct the risk identification model to perform the following identification operations: identify whether the problem sample hits any of the multiple risk elements; if not, perform content security risk analysis on the problem sample to determine whether there are new risk elements.

[0115] The online update module is used to update the risk identification process of the online response system based on the new risk elements in the risk identification results output by the risk identification model.

[0116] In one implementation, a secure response module is also included, which is used to input the question sample and new risk elements from the risk identification results into the trained secure response model, so that the secure response model can generate a secure response for the question sample that conforms to the content security specifications. The secure response model is trained based on a secure question-and-answer pair sample, which includes questions related to any risk element and responses that conform to the content security specifications. If the secure response passes the quality inspection, the new risk elements from the risk identification results, the question sample, and the secure response are associated and stored in the security knowledge base.

[0117] In one implementation, there are multiple risk identification models. The online update module is specifically used to count the number of risk identification results containing new risk elements; if the number is greater than or equal to a first preset number, the new risk elements in all the output risk identification results are clustered to classify new risk elements with semantic similarity higher than a set threshold into the same cluster; the total number of clusters is counted, and the cluster containing the most new risk elements is determined as the main cluster; if the total number of clusters is less than a second preset number, and the number of new risk elements contained in the main cluster exceeds a third preset number, the risk identification process of the online response system is updated based on the new risk elements in the main cluster.

[0118] In one implementation, the online update module is further configured to: generate multiple extended question samples with a semantic similarity higher than a set threshold based on the question sample if the risk identification model outputs a risk identification result containing a new risk element for the first time for a question sample; input the multiple extended question samples into the risk identification model to obtain the risk identification result for each extended question sample; based on the risk identification result of each extended question sample, calculate the proportion of the number of extended question samples that are judged to have hit the new risk element to the total number of extended question samples; if the proportion exceeds a preset proportion threshold, determine that the new risk element for the question sample is valid; and update the risk identification process of the online response system based on the new risk element in the risk identification result if the risk identification model outputs a risk identification result containing a new risk element and the new risk element in the risk identification result is judged to be valid.

[0119] In one implementation, the online update module is specifically used to transform new risk elements in the risk identification results into risk identification rules for online matching and add them to the rule engine of the online response system; and / or, to use the new risk elements in the risk identification results as prompt words in the online risk identification model; and / or, to use the new risk elements and question samples in the risk identification results as training samples for optimizing the online risk identification model.

[0120] In other embodiments, the content-security-oriented response method can be applied to, for example... Figure 5 The device shown implements the technical solution described in this specification. The content security-oriented response method may include:

[0121] The question receiving module is used to receive questions that need to be answered.

[0122] The risk identification module is used to obtain multiple risk elements from a pre-set security knowledge base, construct prompt words based on the questions to be answered and the multiple risk elements, and input the prompt words into a trained online risk identification model to obtain risk identification results; wherein, the risk elements included in the security knowledge base are dynamically updated based on the above-mentioned device.

[0123] The security answer module is used to retrieve security answers associated with the risk elements hit by the risk identification results, and generate the final answer to the question to be answered based on the security answers if the risk identification results include the risk elements hit by the question to be answered.

[0124] In one implementation, the risk identification module is specifically used to obtain a first vector converted from the question to be answered, and a second vector converted from each risk element in the security knowledge base; based on the similarity between the first vector and each second vector, it obtains risk elements with similarity higher than a preset threshold or risk elements ranked in the top N of the similarity ranking results, where N>0.

[0125] In one implementation, the risk identification module is further configured to use a pre-built rule engine to identify whether the question to be answered matches any risk identification rule; wherein each risk identification rule corresponds to a risk element in the security knowledge base; the risk identification rules included in the rule engine are dynamically updated based on the aforementioned device; if the question to be answered matches any risk identification rule, a safe answer associated with the risk element corresponding to the matched risk identification rule is obtained from the security knowledge base, and a step of generating a final answer to the question to be answered based on the safe answer is executed; if no risk identification rule is matched, a step of obtaining multiple risk elements from the pre-built security knowledge base is executed.

[0126] For ease of description, the above devices are described by dividing them into various modules or units based on their functions. Of course, when implementing one or more of these specifications, the functions of each module or unit can be implemented in the same or different software and / or hardware, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0127] Based on the same concept as the methods described above, this specification also provides an electronic device, including: a processor; a memory for storing processor-executable instructions; wherein the processor performs the steps of the method as described in any of the above embodiments by executing the executable instructions.

[0128] Based on the same concept as the methods described above, this specification also provides a computer-readable storage medium having computer instructions stored thereon that, when executed by a processor, implement the steps of the methods as described in any of the above embodiments.

[0129] Based on the same concept as the methods described above, this specification also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the methods as described in any of the above embodiments.

[0130] What those skilled in the art will understand is:

[0131] In this specification, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitation, the presence of additional identical or equivalent elements in a process, method, product, or apparatus that includes said elements is not excluded.

[0132] In this specification, “a,” “an,” and “the” do not specifically refer to the singular, but may also include the plural.

[0133] In this specification, ordinal numbers such as "first," "second," etc., do not necessarily indicate order; they are often used to distinguish between objects. For example, "first server" and "second server" usually refer to two servers. To differentiate between these two servers, they are described as "first server" and "second server." Of course, sometimes these two servers may be the same server.

[0134] In this specification, unless explicitly stated otherwise, "receiving and sending data" does not necessarily mean direct receiving and sending; it can also mean indirect receiving and sending. For example, A receiving data sent by B can be understood as A directly receiving the data sent by B, or it can be understood as A indirectly receiving the data sent by B through other entities such as C. Similarly, B sending data to A can be understood as B sending the data directly to A, or it can be understood as B indirectly sending the data to A through other entities such as C. Here, C can be one entity, or it can be two or more entities.

[0135] In this specification, unless explicitly stated otherwise, the relationships between structures can be direct or indirect. For example, when describing "A is connected to B," unless it is explicitly stated that A and B are directly connected, it should be understood that A can be directly connected to B or indirectly connected to B. Similarly, when describing "A is on top of B," unless it is explicitly stated that A is directly above B (AB is adjacent and A is above B), it should be understood that A can be directly above B or indirectly above B (AB is separated by other elements, and A is above B). And so on.

[0136] This specification uses specific terms to describe embodiments thereof. Terms such as "an embodiment," "one embodiment," and / or "some embodiments" refer to a particular feature, structure, or characteristic associated with at least one embodiment of this specification. Therefore, it should be emphasized and noted that references to "an embodiment," "one embodiment," or "an alternative embodiment" in different locations throughout this specification do not necessarily refer to the same embodiment. Furthermore, those skilled in the art can combine and integrate the different embodiments or examples described herein, as well as the features of those different embodiments or examples, without contradiction.

[0137] Although one or more embodiments of this specification provide method steps as described in the embodiments or flowcharts, it is understood that the order of steps listed in the embodiments or flowcharts is only one of many possible execution orders and does not represent the only execution order. Therefore, when the claims involve method steps, any changes or adjustments to the order of such steps, or the parallelism between steps, are also within the scope of protection of the claims.

Claims

1. A risk mining method for content security, characterized in that, include: Obtain problem samples for content security risk identification from at least one data source, and obtain multiple risk elements from a pre-built security knowledge base; Based on the problem sample and the multiple risk elements, a prompt word is constructed and input into the trained risk identification model to instruct the risk identification model to perform the following identification operations: identify whether the problem sample hits any of the multiple risk elements; if not, perform content security risk analysis on the problem sample to determine whether there are any new risk elements. If the risk identification model outputs a risk identification result containing new risk elements for the first time for the problem sample, it generates multiple extended problem samples with semantic similarity to the problem sample that are higher than a set threshold based on the problem sample; The multiple extended problem samples are input into the risk identification model to obtain the risk identification results for each extended problem sample. Based on the risk identification results of each extended problem sample, the proportion of the number of extended problem samples that are determined to hit the new risk element is calculated out of the total number of extended problem samples. If the ratio exceeds a preset ratio threshold, the new risk element for the problem sample is determined to be valid; If the risk identification model outputs a risk identification result containing new risk elements, and the new risk elements in the risk identification result are determined to be valid, the risk identification process of the online response system is updated based on the new risk elements in the risk identification result.

2. The method according to claim 1, characterized in that, Also includes: The question sample and the new risk element in the risk identification result are input into the trained security response model, so that the security response model generates a security response for the question sample that complies with the content security specification; wherein, the security response model is trained based on a security question-answer pair sample, the security question-answer pair sample includes a question related to any of the risk elements and an answer that complies with the content security specification; If the security answer passes the quality inspection, the new risk element in the risk identification result, the question sample, and the security answer are associated and stored in the security knowledge base.

3. The method according to claim 1, characterized in that, When there are multiple risk identification models, the method further includes: The prompt words are input into each risk identification model to instruct each risk identification model to perform the following identification operations: identify whether the problem sample hits any of the multiple risk elements; if not, perform content security risk analysis on the problem sample to determine whether there are new risk elements; obtain the risk identification results output by each risk identification model, and count the number of risk identification results with new risk elements. If the number is greater than or equal to the first preset number, the new risk elements in all the output risk identification results will be clustered to classify the new risk elements with semantic similarity higher than the set threshold into the same cluster. The total number of clusters is counted, and the cluster containing the most new risk elements is determined as the master cluster. If the total number of the clusters is less than the second preset number, and the number of new risk elements contained in the main cluster exceeds the third preset number, the risk identification process of the online response system is updated based on the new risk elements in the main cluster.

4. The method according to any one of claims 1 to 3, characterized in that, The risk identification process for updating the online response system based on new risk elements in the risk identification results includes: The new risk elements in the risk identification results are transformed into risk identification rules for online matching and added to the rule engine of the online response system; And / or, use the new risk elements in the risk identification results as part of the prompt words in the online risk identification model; And / or, the new risk elements in the risk identification results and the problem samples are used as training samples to optimize and train the online risk identification model.

5. A content-security-oriented response method, characterized in that, include: Receive questions to be answered; Multiple risk elements are obtained from a pre-set security knowledge base. Prompt words are constructed based on the question to be answered and the multiple risk elements. The prompt words are then input into a trained online risk identification model to obtain risk identification results. The risk elements included in the security knowledge base are dynamically updated based on the method described in any one of claims 1 to 4. If the risk identification result includes the risk element hit by the question to be answered, a security answer associated with the hit risk element is obtained from the security knowledge base, and a final answer to the question to be answered is generated based on the security answer.

6. The method according to claim 5, characterized in that, The process of obtaining multiple risk elements from a pre-built security knowledge base includes: Obtain a first vector derived from the question to be answered, and a second vector derived from each risk element in the security knowledge base; Based on the similarity between the first vector and each of the second vectors, risk elements with similarity higher than a preset threshold or risk elements ranked in the top N of the similarity ranking results are obtained, where N > 0.

7. The method according to claim 5, characterized in that, The method further includes: Using a pre-built rule engine, it is determined whether the question to be answered matches any risk identification rule; wherein each risk identification rule corresponds to a risk element in the security knowledge base; the risk identification rules included in the rule engine are dynamically updated based on the method described in any one of claims 1 to 4. If the question to be answered matches any risk identification rule, retrieve the security answer associated with the risk element corresponding to the matched risk identification rule from the security knowledge base, and execute the step of generating the final answer to the question to be answered based on the security answer; If no risk identification rule is matched, the step of obtaining multiple risk elements from a pre-set security knowledge base is executed.

8. An electronic device, characterized in that, include: processor; A memory for storing processor-executable instructions; wherein the processor implements the steps of the method as described in any one of claims 1-7 by executing the executable instructions.

9. A computer-readable storage medium, characterized in that, It stores computer instructions that, when executed by a processor, implement the steps of the method as described in any one of claims 1-7.

10. A computer program product, characterized in that, Includes a computer program / instructions that, when executed by a processor, implement the steps of the method as described in any one of claims 1-7.

Images