RAG and knowledge graph question-answering method and system for security classification and grading of cross-border data

Abstract

The invention discloses an RAG and knowledge graph question-answering method and system for security classification and grading of cross-border data, and belongs to the crossing field of big data security management, artificial intelligence and compliance technologies. The method comprises the following steps: step S101, receiving and preprocessing user input; step S102, performing question analysis and semantic intention recognition; step S103, intelligent scheduling control decision making; step S104, reasoning and executing the knowledge graph; step S105, performing RAG generation reasoning execution; step S106, performing intelligent fusion and decision traceability; step S107, carrying out multi-dimensional visual display; step S108, audit record and report generation; and S109, updating the dynamic knowledge. The method has the advantages of intelligent question and answer, multi-source fusion, sustainable evolution, traceability of the whole process and the like, and can be widely applied to compliance management and intelligent decision-making scenes related to data cross-border flow, such as enterprises, governments, finance, medical treatment and the like.

Description

Technical Field

[0001] This invention belongs to the interdisciplinary field of big data security management, artificial intelligence and compliance technology, and specifically relates to a RAG and knowledge graph question answering method and system for cross-border data security classification and grading. Background Technology

[0002] With the continuous improvement of global digitalization and informatization, cross-border data flows have gradually become an indispensable foundation for many industries, including enterprises, finance, healthcare, and scientific research, in their international cooperation and business expansion. However, due to the independent, complex, and constantly evolving laws, regulations, and standards for data security and personal privacy protection in different countries and regions, enterprises and institutions face prominent issues such as high data security compliance risks and significant implementation difficulties when actually carrying out cross-border data flows (see details). Figure 1 ).

[0003] Existing data security management and compliance tools typically have the following shortcomings:

[0004] First, existing technologies are mostly based on static sets of compliance rules or traditional legal text retrieval, which cannot achieve efficient, accurate, and dynamic automatic identification and response to users' diverse and personalized compliance needs. Currently, related tools generally struggle to semantically understand and intelligently analyze user compliance questions described in natural language, lack convenient and efficient human-computer interaction capabilities, and fail to meet the needs of rapid decision-making and real-time question answering in compliance scenarios.

[0005] Secondly, in existing compliance applications, the processes of data classification and grading, as well as compliance recommendations, typically rely heavily on human experience or rule-based experience scattered across document systems, lacking unified, automated, and systematic decision support mechanisms. This makes it difficult for existing tools to adapt to constantly changing regulations and policies in a timely manner, and also prevents them from achieving efficient compatibility with regulations and standards from multiple countries and scenarios, as well as the dynamic generation of compliance recommendations.

[0006] Furthermore, traditional compliance management systems are significantly lacking in the ability to structure and integrate legal knowledge, making it difficult to support complex cross-regulatory and cross-industry compliance grading and legal basis tracing. They also have significant limitations in providing evidence-based legal support and ensuring the transparency and traceability of the compliance audit process.

[0007] Furthermore, existing compliance solutions often lack the ability to efficiently and dynamically update and automatically manage regulatory knowledge, and cannot promptly collect and integrate the latest laws, regulations, policy standards, or industry norms. This makes it difficult to guarantee the timeliness and accuracy of compliance reasoning results in practical applications, thereby increasing potential risks in the process of cross-border data security compliance.

[0008] Finally, traditional systems are mostly local or single-point tools, lacking multi-terminal collaboration and expansion capabilities, making it difficult to meet the scenario-based needs of enterprises, industry regulators, and other entities for multi-dimensional, batch data and high-frequency intelligent question answering. They also have limited support capabilities for compliance management of multi-industry, multi-region, and multi-type data. Summary of the Invention

[0009] To address the shortcomings of existing technologies in cross-border data security classification and grading, as well as intelligent reasoning based on regulations, such as manual processing, rigid rules, slow response, lack of traceability of evidence, and inability to intelligently integrate multi-source knowledge, this invention proposes a RAG and knowledge graph question-answering method and system for cross-border data security classification and grading. This method can automatically parse diverse natural language compliance requirements input by users, perform dynamic intelligent reasoning and fusion decision-making by combining multiple sources of laws, regulations, and standards, output traceable graded compliance suggestions and regulatory evidence chains, and possess continuous knowledge evolution and cross-platform intelligent question-answering capabilities, effectively improving the security, compliance, and intelligent decision-making efficiency of cross-border data flows.

[0010] Technical Solution: To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0011] A RAG and knowledge graph question answering method for cross-border data security classification and grading includes the following steps:

[0012] Step S101, User Input Reception and Preprocessing: Receive natural language questions and batches of structured or unstructured data from user input to form an input dataset to be processed, and preprocess it.

[0013] Step S102, Problem Analysis and Semantic Intent Recognition: Perform entity recognition processing, rule matching processing based on the preset regulatory mapping table, and intent classification processing on the input dataset to obtain a structured analysis result containing data type, target region information, and compliance requirement information;

[0014] Step S103, Intelligent Scheduling and Control Decision: Perform process routing planning and task priority sorting for structured information. Based on the data type, applicable laws and regulations in the target region, and the complexity of compliance requirements, automatically select the knowledge graph reasoning path, RAG generation reasoning path, or a fusion reasoning path that combines both. Support multi-task concurrent scheduling and an automatic fault-tolerant flow mechanism for handling process anomalies.

[0015] Step S104, Knowledge Graph Reasoning Execution: Based on the pre-built cross-border data compliance knowledge graph, SPARQL queries are used to perform reasoning processing on the relationship between data types, regional attributes and relevant legal provisions to generate the first reasoning result;

[0016] Step S105, RAG generation and inference execution: Using a vector retrieval model or a text-related retrieval algorithm, retrieve candidate regulatory texts that match the structured parsing results from the regulatory document library, and generate a second inference result based on the candidate regulatory texts;

[0017] Step S106, Intelligent Fusion and Decision Tracing: Reasoning Fusion, performing confidence calculation on the first reasoning result and the second reasoning result, and generating fused reasoning result according to the preset weighted fusion algorithm;

[0018] Step S107, Multi-dimensional visualization: Generate structured output content based on the fusion reasoning results, and present it in the form of text, charts or flowcharts;

[0019] Step S108: Generate audit records and reports;

[0020] Step S109: Dynamic knowledge update.

[0021] Preferably, in step 101, the specific implementation details are as follows:

[0022] The system receives user input data via web, API, or mobile devices and performs the following preprocessing operations: input format validation and security filtering, generating a unique session identifier, recording the request timestamp, and passing the standardized request to the question parsing and semantic intent recognition module.

[0023] Preferably, in step S102, the specific implementation content is as follows:

[0024] First, after receiving user input, the system detects the input language type; it then determines whether the language is supported. If not, it prompts or rejects the input and asks the user to re-enter; if so, it performs word segmentation and basic NLP processing.

[0025] Then, named entity recognition technology is used to identify the data type, data category label, and data body of the data type extraction unit;

[0026] Next, the destination identification unit extracts geographic location information, including source, destination, and transmission type;

[0027] Finally, the user intent is analyzed through the compliance demand identification unit, including the primary intent, secondary intent, and expected output.

[0028] Preferably, in step S104, the calculation of the knowledge graph reasoning confidence score is based on a weighted summation of three core dimensions: direct matching degree of legal nodes, completeness of the evidence chain, and reliability of the reasoning path. The specific calculation formula is as follows:

[0029] ;

[0030] in, This represents the confidence score for knowledge graph reasoning. This indicates the score for matching the regulatory node. The score represents the completeness of the chain of evidence. Indicates the reliability score of the reasoning path; The weighting coefficients represent the matching scores of regulatory nodes; The weighting coefficients representing the score for the completeness of the chain of evidence; The weighting coefficients represent the reliability score of the reasoning path.

[0031] Preferably, in step S105, the RAG inference confidence score is calculated by comprehensively evaluating three dimensions: relevance of the retrieved document, consistency verification of the generated content, and matching degree of historical cases.

[0032] First, the average semantic similarity between the retrieved document and the query is calculated. Then, the factual consistency between the generated content and the retrieved document is verified and scored using a large language model. Finally, the matching degree of historical similar cases is combined, and a weighted sum is obtained according to preset weights to obtain the final confidence score. The specific calculation formula is as follows:

[0033] ;

[0034] ;

[0035] in, This indicates that the retrieval enhances the generation of reasoning confidence scores. This represents the average similarity of the retrieved documents. This indicates the content consistency verification score. Indicates the matching degree of historical cases; Indicates the average similarity of retrieved documents Weighting coefficients in RAG inference confidence scoring; Indicates the content consistency verification score Weighting coefficients; Indicates the matching degree of historical cases Weighting coefficients; This indicates the first document retrieved from the regulatory document repository. The number of candidate documents with the highest semantic relevance; This represents the cosine similarity between the query vector and the i-th retrieved document vector, used to measure the degree of semantic relevance between the two. This represents the semantic vector representation of the i-th retrieved document after vectorization. This represents the semantic vector representation of a user query after vectorization.

[0036] Preferably, in step S106, the specific implementation details are as follows:

[0037] Each reasoning result is scored for confidence and the evidence chain is normalized; a dynamic weighting factor is used to calculate the fusion suggestion; if there are conflicting results, the consistency criterion algorithm is executed to generate the final compliance conclusion, and the evidence chain and reasoning path that can be traced back to the relevant regulations are output.

[0038] As a preferred option, the specific details of using dynamic weighting factors to calculate the fusion recommendations are as follows:

[0039] ,

[0040] Among them, S fused S represents the confidence score of the integrated recommendation after fusion. kg S represents the confidence score produced by the knowledge graph reasoning module. rag This represents the confidence score produced by the RAG generation inference module; , This represents a weight parameter that can be adaptively adjusted.

[0041] A RAG and knowledge graph question-answering system for cross-border data security classification and grading is provided. This system implements the RAG and knowledge graph question-answering methods for cross-border data security classification and grading as described above. The system includes a multi-terminal user interface, question parsing and semantic intent recognition, intelligent scheduling and control, knowledge graph reasoning, RAG generation reasoning, intelligent fusion and decision reasoning tracing, multi-dimensional visualization, auditing and traceability / reporting, and dynamic knowledge acquisition and continuous learning modules. These modules are sequentially connected or work collaboratively to achieve natural language input parsing, data security classification and compliance reasoning output, legal evidence chain construction and tracing, intelligent visualization, and autonomous evolution of system knowledge.

[0042] As a preferred option, the user multi-terminal interface module is used to receive user question input and batch data upload from the web terminal, API terminal or mobile terminal;

[0043] The problem analysis and semantic intent recognition module is used to perform natural language processing on user input, identify and extract data types, data flow destinations and compliance requirements;

[0044] The intelligent scheduling and control module is used for process control and path analysis based on the analysis results;

[0045] The knowledge graph reasoning module is used to obtain hierarchical compliance recommendations based on structured legal standards reasoning.

[0046] The RAG generation and reasoning module is used to produce explanatory feedback and suggestions based on semantic retrieval-enhanced generative models.

[0047] The intelligent fusion and decision-making reasoning tracing module is used to fuse multi-source reasoning results;

[0048] The multi-dimensional visualization module is used to present the results in a visual format.

[0049] The audit and traceability / reporting module is used to record the entire process and decision history.

[0050] The dynamic knowledge acquisition and continuous learning module is used to automatically collect and update the latest laws, regulations, policies, industry standards, and expert knowledge feedback.

[0051] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0052] (1) This invention can support the requirements of cross-border data security classification and compliance review in natural language description, structured or batch, and intelligently identify and extract key information.

[0053] (2) This invention integrates knowledge graphs and generative reasoning, taking into account both rule compliance and scenario intelligence, and provides compliance judgment with high coverage and high explanatory power for complex, novel and dynamic regulatory environments.

[0054] (3) The entire process of compliance conclusions of this invention automatically matches traceable legal evidence chains and reasoning links, which meets the needs of audit accountability and legal compliance tracing.

[0055] (4) The system of this invention has the capabilities of multi-terminal adaptation, batch processing, and automatic knowledge upgrade and iteration, which significantly improves the level of intelligent management of data security compliance across industries, regions, and ports, and is conducive to cost reduction, efficiency improvement, and timely response to regulatory changes. This invention can be widely applied to cross-border data compliance management, risk assessment, compliance auditing, and intelligent decision support scenarios in various fields such as government, enterprises, finance, healthcare, and scientific research, and has outstanding innovation and practical value. Attached Figure Description

[0056] Figure 1 This is a diagram illustrating the problems with existing technical solutions;

[0057] Figure 2 This is a flowchart of the method of the present invention;

[0058] Figure 3 This is an architecture diagram of the user multi-terminal interface module of the present invention;

[0059] Figure 4 This is a flowchart of the problem analysis and semantic intent recognition module of the present invention;

[0060] Figure 5 This is a flowchart of the intelligent scheduling and control module of the present invention;

[0061] Figure 6 This is a flowchart of the knowledge graph reasoning module of the present invention;

[0062] Figure 7 This is a flowchart of the RAG generation and inference module of the present invention;

[0063] Figure 8 This is a flowchart of the intelligent fusion and decision-making reason tracing of the present invention;

[0064] Figure 9 This is a flowchart of the multi-dimensional visualization display module of the present invention;

[0065] Figure 10 This is a flowchart of the audit and traceability / reporting module of the present invention;

[0066] Figure 11 This is a system architecture diagram of the present invention;

[0067] Figure 12 This is a schematic diagram of the interface of the knowledge graph question-answering system of the present invention;

[0068] Figure 13 This is a schematic diagram of the compliance query interface of the system of the present invention;

[0069] Figure 14 This is a schematic diagram of the interface of the semantic parsing results of the system of the present invention;

[0070] Figure 15 This is a schematic diagram of the interface for intelligent scheduling decision-making in the system of the present invention. Detailed Implementation

[0071] The present invention will be further illustrated below with reference to specific embodiments. These embodiments are implemented based on the technical solutions of the present invention, and it should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0072] Example 1

[0073] The RAG and knowledge graph question-answering method for cross-border data security classification and grading provided in this embodiment is a novel technical solution that integrates natural language processing, knowledge graph reasoning, generative intelligent question answering, and multi-source decision fusion. It can automatically parse data type, flow direction, and compliance requirements raised by users in natural language or in batches for cross-border data compliance, classification, and flow management. Based on multi-country, multi-source data security regulations, it performs intelligent reasoning, generates compliance suggestions, and outputs traceable evidence. It is widely applicable to data compliance management, risk visualization, compliance auditing, and intelligent decision support scenarios in various industries such as government, enterprises, finance, healthcare, and scientific research. This method achieves automatic classification and grading of cross-border data security, personalized and traceable compliance suggestions, dynamic updates of regulatory knowledge, and diversified intelligent interaction, comprehensively improving the security, compliance, and management efficiency of cross-border data flow.

[0074] This embodiment illustrates a financial institution submitting the following query request through the system's web interface: "We need to transfer the transaction records of our VIP clients to our branch in country X for risk analysis. What compliance requirements must be met?" Figure 13 As shown.

[0075] like Figure 2 As shown, the specific implementation process is as follows:

[0076] Step S101: User input reception and preprocessing;

[0077] The system receives natural language questions and batches of structured or unstructured data from users via web, API, or mobile devices to form an input dataset to be processed.

[0078] like Figure 3 As shown, the multi-terminal user interface module includes a multi-terminal user access layer, a multi-terminal input adaptation layer, and a downstream processing interface; the multi-terminal user access layer includes a Web interface, an API interface, or a mobile terminal interface; the multi-terminal input adaptation layer includes a unified data acquisition module, an input validation module, and an interactive feedback module; the downstream processing interface includes a downstream problem parsing and processing module.

[0079] Upon receiving this natural language query input, perform the following preprocessing operations:

[0080] Input format validation and security filtering.

[0081] Generate a unique session identifier (Session ID: SID-20251111-001).

[0082] Record the request timestamp (Timestamp: 2025-11-11 10:30:45 UTC+8).

[0083] The standardized request is passed to the question parsing and semantic intent recognition module.

[0084] Step S102: Question analysis and semantic intent recognition;

[0085] The input dataset is processed by entity recognition, rule matching based on a pre-defined regulatory mapping table, and intent classification to obtain a structured parsing result containing data type, target region information, and compliance requirements information.

[0086] See Figure 4 The question parsing and semantic intent recognition module receives user input (text / form / batch data) and performs deep semantic analysis on it:

[0087] First, after receiving user input, the system detects the input language type; it then determines whether it is a supported language. If not, it prompts or rejects the input, requiring re-entry. If supported, it performs word segmentation and basic NLP processing, followed by named entity recognition and extraction. It then determines whether an entity is recognized; if not, it performs semantic completion or requests additional input; if recognized, it performs deep semantic analysis of the context. Next, it extracts and judges intent, determining if it is a valid intent. If valid, it outputs key compliance elements in a structured format; otherwise, it prompts invalidity or requests additional information. For example... Figure 14 As shown.

[0088] (1) The data type extraction unit identifies the following through Named Entity Recognition (NER) technology:

[0089] Data type: Transaction records.

[0090] Data category tags: {Financial data, Sensitive data, Personal information}.

[0091] Data subject: VIP customer.

[0092] This invention employs a domain-adaptive improvement on existing deep learning NER methods. The basic technology utilizes a sequence labeling architecture combining BiLSTM-CRF or a pre-trained language model with a conditional random field. The improvements include:

[0093] (1) A dedicated entity labeling system for cross-border data compliance has been established, defining dedicated entity types such as data types (e.g., financial data), data category labels (e.g., sensitive data, personal information), and data subjects (e.g., VIP customers, ordinary users);

[0094] (2) Based on the cross-border compliance corpus, domain fine-tuning is carried out to improve the accuracy of identifying professional terms in compliance scenarios;

[0095] (3) Introduce a rule constraint layer, and combine compliance domain dictionary and regular expression to perform post-processing verification on the model output to ensure that the recognition results comply with the regulatory classification specifications.

[0096] (2) The destination identification unit extracts geographic location information:

[0097] Origin: Country X (default, inferred from user company information).

[0098] Destination: Country X.

[0099] Transmission type: Cross-border data transmission.

[0100] The destination identification unit extracts geographic location information using a multi-level fusion identification method, the specific implementation of which includes:

[0101] (1) Geographic entity recognition based on NER, which directly extracts geographic entities such as countries, regions and cities from user input text;

[0102] (2) Inferring the data source and destination based on user context information, such as the user's registered business location, IP address location, and historical query records;

[0103] (3) Based on business terminology mapping, business descriptions such as branch offices in country X and subsidiaries of XX are mapped to standard geographic area codes;

[0104] (4) Geographical location standardization processing: The identified geographic information is uniformly mapped to a predefined classification system of applicable regulatory areas, so as to facilitate subsequent regulatory matching and cross-border transmission type determination.

[0105] (3) Compliance Request Identification Unit Analyzes User Intent:

[0106] Main purpose: Compliance requirements inquiry.

[0107] Secondary purpose: To confirm the classification and categorization of data.

[0108] Expected output: specific regulatory requirements and recommendations for protective measures.

[0109] The parsing results are output in structured JSON format:

[0110] {

[0111] Data type: Identify financial transaction data;

[0112] Sensitivity: Determined to be at a high sensitivity level;

[0113] Data subject: Extracted as VIP customer;

[0114] Source region: Inferred to be country X (based on user company information);

[0115] Destination region: Identified as country X;

[0116] User intent: Classified as compliance consulting;

[0117] Purpose of use: Classified as risk analysis;

[0118] }

[0119] The compliance request identification unit analyzes user intent using a combination of multi-level classification and semantic understanding. The specific process includes:

[0120] (1) Coarse classification of intent: User input is classified into predefined intent categories (such as compliance consultation, risk assessment, graded confirmation, etc.) through a text classification model.

[0121] (2) Detailed analysis of intent: Slot filling technology is used to extract key elements related to intent, such as primary intent (compliance requirement query), secondary intent (data classification confirmation), and expected output (specific regulatory requirements and protection measures suggestions).

[0122] (3) Multi-intent fusion: For complex queries, identify and fuse multiple sub-intents and sort them by priority;

[0123] (4) Intent confidence assessment: output the confidence score of each intent category. When the confidence is low, a clarifying follow-up questioning mechanism is triggered to ensure accurate understanding of intent.

[0124] Step S103: Intelligent scheduling and control decision;

[0125] The system performs process routing planning and task priority ranking on the structured information output by the problem analysis and semantic intent recognition module. Based on data type, applicable regulations for the target region, and the complexity of compliance requirements, it automatically selects a knowledge graph reasoning path, a RAG-generated reasoning path, or a fusion reasoning path combining both. It also supports multi-task concurrent scheduling and an automatic fault-tolerant workflow mechanism to handle process anomalies. The specific system intelligent scheduling decision interface is shown below. Figure 15 As shown.

[0126] See Figure 5 The intelligent scheduling and control module performs path planning based on the analysis results:

[0127] Receive structured compliance information and determine whether it meets the knowledge graph judgment conditions. If so, trigger knowledge graph reasoning; otherwise, determine whether it meets the RAG judgment conditions. If so, trigger RAG reasoning; otherwise, determine whether there is abnormal data or process. Based on the triggering of knowledge graph reasoning and triggering of RAG reasoning, determine whether the two types of reasoning need to be merged. If so, perform fusion reasoning, and record the reasoning result and process; otherwise, record the reasoning result and process. In determining whether there is abnormal data or process, if the result is yes, perform fault tolerance processing and abnormal traffic diversion; otherwise, record the reasoning result and process.

[0128] (1) Problem characteristics analysis:

[0129] Data sensitivity score: DS=0.95 (extremely high sensitivity).

[0130] Data Sensitivity Score (DS): Calculated based on data type classification and sensitivity level mapping, using the following formula:

[0131]

[0132] in, Weights for each sensitive element, The corresponding sensitivity level scores are (e.g., personal information = 0.3, financial data = 0.4, core business data = 0.25). This represents the total number of sensitive elements involved in the comprehensive sensitivity score calculation, i.e., the number of sensitivity level categories that need to be weighted and summed; in this embodiment, VIP customer transaction records contain personal information and financial data, with a comprehensive score of 0.95 (extremely sensitive).

[0133] Regulatory complexity: CR=0.78 (involving regulations of two countries).

[0134] Regulatory Complexity (CR): Calculated based on the number of regulations involved and the geographical scope, using the following formula:

[0135]

[0136] in, The number of legal provisions involved, For the number of cross-border areas, Let f() be the regulatory conflict coefficient, and let f() be the function for calculating regulatory complexity, which takes the number of regulatory clauses involved as an indicator. Number of cross-border areas Conflict coefficient with regulations As input parameters, the regulatory complexity score is calculated comprehensively. This embodiment involves the regulations of two countries, and its complexity score is 0.78.

[0137] Question Clarity: QC=0.92 (Intent is clear).

[0138] Question Clarity (QC): Calculated based on intent recognition confidence and element completeness, using the following formula:

[0139]

[0140] in, Confidence level for intent classification The slot filling completeness rate, The weighting coefficient of intent classification confidence in the calculation of problem clarity; This represents the weighting coefficient of the slot filling completeness rate in the problem clarity calculation; in this example, the user's problem intent is clear and the elements are complete, so the score is 0.92.

[0141] (2) Routing decision:

[0142] Based on the decision matrix, the system determines that parallel inference mode should be triggered:

[0143] Activate the knowledge graph reasoning layer: suitable for structured legal queries.

[0144] Parallel startup of RAG to generate inference layers: providing contextualized explanations.

[0145] Set initial fusion weights: =0.6 (knowledge graph). =0.4 (RAG). This represents the initial weighting coefficient of the knowledge graph reasoning module in the fusion computation. A value of 0.6 means that in the initial state, the system assigns a 60% trust weight to the knowledge graph reasoning results. This reflects the design concept of prioritizing trust in structured knowledge reasoning in regulatory query scenarios. This represents the initial weight coefficient of the RAG generation and reasoning module in the fusion computation. A value of 0.4 means that the RAG reasoning result accounts for 40% of the weight in the initial state, serving as a semantic supplement and explanatory enhancement for knowledge graph reasoning. Both satisfy the constraints. Furthermore, it can be dynamically adjusted based on historical accuracy during subsequent operation.

[0146] The weighting is based on the rule of thumb: for explicit legal queries, structured knowledge graph reasoning is given priority.

[0147] Step S104: Knowledge graph reasoning execution;

[0148] Knowledge graph reasoning is based on a pre-built cross-border data compliance knowledge graph. It uses SPARQL queries to perform reasoning processing on the relationships between data types, regional attributes, and relevant legal provisions to generate the first reasoning result.

[0149] See Figure 6 The knowledge graph reasoning layer performs the following reasoning process:

[0150] The system receives structured business elements, retrieves the regulatory knowledge graph, and determines whether an industry / data type node matches. If so, it locates the relevant regulatory node for the scenario and checks whether applicable regulatory clauses exist. Otherwise, it indicates no match and sends feedback to the front end. In determining whether applicable regulatory clauses exist, if the result is yes, it calls the reasoning rule engine, classification standards, and protection measures for reasoning. Otherwise, it indicates no match and sends feedback to the front end. After reasoning with classification standards and protection measures, it determines whether the reasoning can reach a classification conclusion. If yes, it outputs the classification judgment and compliance suggestions. If not, it supplements the process with manual or machine review.

[0151] Based on structured regulatory standards reasoning, the following tiered compliance recommendations are obtained:

[0152] Construct a knowledge graph with nodes based on data types, industry scenarios, countries or regions, legal provisions, grading standards, and protection measures.

[0153] Establish semantic relationships between nodes, such as belonging, applicable, requirements, and restrictions.

[0154] Automated compliance-based hierarchical reasoning operations are performed based on the SPARQL query language and knowledge ontology reasoning rules.

[0155] Output structured classification judgments and compliance recommendations.

[0156] (1) Search for the scope of applicable regulations;

[0157] The system locates relevant nodes in the legal knowledge graph:

[0158] Data type node: Financial transaction data → Related legal database.

[0159] Target region node: Country X → Related to XX Act, XX Privacy Act, etc.

[0160] Cross-border transmission node: Triggers laws and regulations of country X, such as the "XX Protection Law" and the "XX Security Law".

[0161] (2) Construct a SPARQL query;

[0162] SELECT ?regulation ?requirement ?classification ?protection;

[0163] #Search targets: regulations, requirements, classifications, and protective measures;

[0164] WHERE {

[0165] #Condition 1: The data type is financial transaction;

[0166] ?data rdf:type:FinancialTransaction;

[0167] #Condition 2: Data belongs to VIP customers;

[0168] :belongsTo :VIPCustomer;

[0169] #Condition 3: The destination of the transmission is country X;

[0170] :transferTo :USA;

[0171] #Related: Find the regulations applicable to this data;

[0172] ?regulation :appliesTo ?data;

[0173] #Related: Obtaining regulatory requirements;

[0174] :requires ?requirement;

[0175] #Retrieve: Data hierarchy level;

[0176] ?data :classificationLevel ?classification;

[0177] #Get: Recommended protection measures;

[0178] ?requirement :recommendsProtection ?protection;

[0179] }

[0180] SPARQL queries are constructed using a combination of template generation and dynamic assembly. The specific implementation steps are as follows:

[0181] Functions for constructing SPARQL queries (structured parsing results):{

[0182] #Step 1: Initialize the query template;

[0183] Query Template ← Load basic SELECT-WHERE template;

[0184] #Step 2: Add type constraints based on data type;

[0185] If the parsing result has a data type:

[0186] Add a triple (?data rdf:type:data type);

[0187] #Step 3: Add regional constraints based on geographic information;

[0188] If the parsing result and the source region exist:

[0189] Add a triple (?data :locatedIn:source region);

[0190] If the parsing result indicates that the destination region exists:

[0191] Add a triple (?data :transferTo:destination region);

[0192] #Step 4: Add query targets based on user intent;

[0193] If the intent is "Compliance Consulting":

[0194] Add a path to search for legal provisions;

[0195] Add a path to query protection measures;

[0196] If the intention is "hierarchical confirmation":

[0197] Add a query path for the hierarchical standards;

[0198] #Step 5: Assemble the complete query statement;

[0199] Complete query ← Assemble (query template, constraints, query path);

[0200] Return to the full query;

[0201] }

[0202] (3) Reasoning results;

[0203] After processing by the knowledge ontology reasoning engine, the following is obtained:

[0204] Data classification conclusion: Core data (Level 2), based on the "XXX Safety Specification".

[0205] Applicable laws and regulations:

[0206] Country X: Technical Specification for XXX (JR / T 0171-2020).

[0207] Country X: Articles 38-40 of the XX Protection Law (Regulations on Cross-border Transmission).

[0208] Country X: Safeguards Rule (GLBA) of the XX Act.

[0209] Necessary protective measures:

[0210] Transmission encryption: TLS 1.3 or above.

[0211] Access control: Role-based access control.

[0212] Audit logs: Retention period of no less than 3 years.

[0213] (4) Confidence assessment;

[0214] Knowledge graph reasoning confidence score: ,in This represents the confidence score for knowledge graph reasoning, a dynamic result obtained through a specific weighted calculation method.

[0215] Its calculation process is based on a weighted summation of three core dimensions: direct matching degree of legal nodes, completeness of the evidence chain, and reliability of the reasoning path. The specific calculation formula is as follows:

[0216]

[0217] in, Scoring based on the matching of regulatory nodes. Score the completeness of the chain of evidence. Scoring the reliability of the reasoning path; The weighting coefficients represent the matching scores of regulatory nodes; The weighting coefficients representing the score for the completeness of the chain of evidence; The weighting coefficients represent the reliability score of the reasoning path.

[0218] The confidence level is based on: direct matching of legal nodes (weight 0.5), completeness of the evidence chain (weight 0.3), and reliability of the reasoning path (weight 0.2).

[0219] The aforementioned weight values ​​are initial recommended values ​​based on expert experience and practical verification in the field of cross-border data compliance, reflecting the compliance judgment principle of prioritizing legal basis, followed by evidentiary support, and then using the reasoning path as a supplementary reference. In practical applications, these weights can be dynamically adjusted according to specific business scenarios through expert research, historical case analysis, or machine learning optimization methods. For example, in simple scenarios where regulations are clear, the weight of the chain of evidence can be appropriately reduced, while in complex cross-border scenarios, the weight of the reasoning path can be increased. The system supports users in customizing weight configurations according to industry characteristics and compliance requirements.

[0220] Step S105: RAG generation inference execution;

[0221] Semantic retrieval and augmented reasoning (RAG generative reasoning) uses vector retrieval models or text-related retrieval algorithms to retrieve candidate regulatory texts that match the structured parsing results from a regulatory document library, and generates a second reasoning result based on the candidate regulatory texts.

[0222] See Figure 7 RAG generates inference layers that execute in parallel:

[0223] The system receives structural business elements, performs a relevance search on legal documents / policies / cases, and determines whether highly relevant content is found. If not, it expands the search scope / adjusts the search conditions and continues the relevance search on legal documents / policies / cases. If relevant content is found, the system performs semantic filtering and optimization of the search results to determine whether novel / complex questions are covered. If so, it calls a large language model to generate explanations and suggestions, integrates the legal search basis with the generated content, and outputs a traceable and personalized response. Otherwise, it prompts that it cannot answer or requires manual review.

[0224] The semantic retrieval-enhanced generative model produces explanatory feedback and suggestions, including:

[0225] Based on the structured parsing results of user questions and the semantic relationships of the context, matching regulatory texts, policy content, or historical Q&A information are retrieved from the regulatory document library, external databases, and case resources.

[0226] Based on a large language model, the retrieved information is integrated to provide semantic interpretation, personalized compliance suggestions, and contextualized compliance explanations for complex compliance issues or multi-round question-and-answer sessions.

[0227] (1) Search module workflow:

[0228] Retrieve relevant clauses from the regulatory document library using vector similarity search.

[0229] Top-K recall: K=10, similarity threshold=0.75.

[0230] Documents retrieved:

[0231] Full text of the "XXX Technical Specifications" of XX Bank, Country X.

[0232] GLBA Implementation Guidelines of the XX Committee of Country X.

[0233] Five historically similar cases.

[0234] (2) Generation module processing:

[0235] Based on a large language model, construct prompt words:

[0236] Based on the following retrieved regulatory documents and cases:

[0237] [Document 1] XX Protection Technical Specifications...

[0238] [Document 2] XX Safeguards Rule...

[0239] [Case 1] A bank's compliance solution for cross-border data transfer of VIP customers...

[0240] Please provide compliance advice for the following scenarios:

[0241] Scenario: A financial institution transmits the transaction records of its VIP clients to its branch office in country X for risk analysis.

[0242] Requirements: 1. Data classification and grading; 2. Specific compliance requirements; 3. Implementation suggestions.

[0243] Output generated:

[0244] Data classification: Personal financial information, highly sensitive, falls under the category of personal privacy information.

[0245] Prerequisites for transmission: Explicit authorization from the customer is required, and the data recipient and purpose of use must be informed.

[0246] Technical requirements:

[0247] Transmission channel: SSL / TLS encryption is used, and TLS 1.3 is recommended.

[0248] Data processing: Consider implementing data anonymization or pseudonymization.

[0249] Access restrictions: Access is limited to authorized personnel, adhering to the principle of least privilege.

[0250] Compliance recommendations:

[0251] A data processing agreement was signed with the branch office in Country X.

[0252] Ensure that the recipient in Country X complies with GLBA security standards.

[0253] Establish a regular compliance audit mechanism.

[0254] (3) Confidence assessment;

[0255] RAG inference confidence score: ,in This represents the confidence score of the Retrieval Enhanced Generation (RAG) inference, which is calculated through a comprehensive evaluation of three dimensions: relevance of the retrieved document, consistency verification of the generated content, and matching degree of historical cases.

[0256] The specific calculation method is as follows: First, calculate the average semantic similarity between the retrieved document and the query (e.g., the average relevance is 0.87 in this example). Then, use a large language model to verify and score the factual consistency between the generated content and the retrieved document. Finally, combine the matching degree of historical similar cases, and sum them according to preset weights to obtain the final confidence score of 0.85. The specific calculation formula is as follows:

[0257] ;

[0258] in, This represents the confidence score of Retrieval Enhancement Generation (RAG) inference. To retrieve the average similarity of documents, The content consistency verification score is given. For historical case matching degree; Indicates the average similarity of retrieved documents Weighting coefficients in RAG inference confidence scoring; Indicates the content consistency verification score Weighting coefficients; Indicates the matching degree of historical cases The weighting coefficients.

[0259] The average document relevance score of 0.87 is an actual calculation result obtained through vector similarity calculation, not a manually set fixed value. The specific calculation process is as follows: First, the user query and the documents in the regulatory document database are converted into high-dimensional vector representations using a pre-trained semantic embedding model. Then, the cosine similarity between the query vector and each candidate document vector is calculated. The arithmetic mean of the similarity scores of the Top-K (e.g., K=10) most relevant documents is then taken.

[0260]

[0261] in, This represents the average similarity of the retrieved documents. This indicates the first document retrieved from the regulatory document repository. The system counts the number of candidate documents with the highest semantic relevance. The average semantic similarity of each document is calculated to assess retrieval quality; This represents the cosine similarity between the query vector and the i-th retrieved document vector, used to measure the degree of semantic relevance between the two. This represents the semantic vector representation of the i-th retrieved document after vectorization. This represents the semantic vector representation of a user query after vectorization.

[0262] Step S106: Intelligent integration and decision tracing;

[0263] The reasoning fusion process calculates the confidence level of the first and second reasoning results and generates a fused reasoning result according to a preset weighted fusion algorithm.

[0264] See Figure 8 Intelligent fusion and decision-making rationale tracing layer performs multi-source fusion:

[0265] The system receives knowledge graph reasoning results and RAG reasoning results, extracts and standardizes the results, assigns weights and scores credibility, and determines whether there are any results conflicts. If so, it performs consistency verification and conflict handling, and then the fusion algorithm outputs the optimal classification and compliance recommendations. Otherwise, it directly outputs the optimal classification and compliance recommendations from the fusion algorithm. After the fusion algorithm outputs the optimal classification and compliance recommendations, it generates a traceable and interpretable chain of evidence and outputs a compliance conclusion and a traceability report.

[0266] Multi-source reasoning results that integrate knowledge graph reasoning and RAG generative reasoning include:

[0267] Each reasoning result is scored for confidence and the evidence chain is normalized; a dynamic weighting factor is used to calculate the fusion suggestion; if there are conflicting results, the consistency criterion algorithm is executed to generate the final compliance conclusion, and the evidence chain and reasoning path that can be traced back to the relevant regulations are output.

[0268] (1) Standardization of results;

[0269] Map the outputs of knowledge graphs and RAGs to a unified structured format:

[0270] {

[0271] "classification": {...},

[0272] "regulations": [...],

[0273] "requirements": [...],

[0274] "recommendations": [...]

[0275] }

[0276] Standardized output structure = {

[0277] Grading conclusion: {

[0278] Classification ← Data categories for knowledge graph / RAG fusion determination;

[0279] Level ← Sensitivity level (e.g., Level 1, Level 2);

[0280] Confidence level ← Determine the confidence score;

[0281] },

[0282] Applicable regulations: [

[0283] {Regulation Name, Applicable Clauses, Effective Region, Relevance Score} ...

[0285] ],

[0286] Compliance requirements:[

[0287] {Requirements, Priorities, Legal Basis} ...

[0289] ],

[0290] Implementation suggestions:[

[0291] {Suggested content, suggestion type, reference case} ... ]

[0294] }

[0295] The implementation of standardized results processing includes three aspects: format standardization, numerical normalization, and conflict resolution.

[0296] Unified format: The knowledge graph reasoning output (structured triples) and RAG generation output (natural language text) are mapped to a unified JSON Schema format.

[0297] Numerical normalization: Min-Max normalization is performed on each score to ensure that all confidence scores are uniform in the [0,1] range, which facilitates subsequent weighted fusion.

[0298] The specific formula is as follows:

[0299]

[0300] in, This represents the confidence score after normalization. This represents the original confidence score before normalization; This represents the historical minimum value of this type of score, serving as the lower bound benchmark for normalization. This represents the historical maximum value of this type of score, serving as the upper bound benchmark for normalization.

[0301] Semantic alignment: The regulatory descriptions generated by RAG are aligned and matched with the regulatory nodes in the knowledge graph through entity linking technology to eliminate expression discrepancies.

[0302] (2) The weighted fusion calculation uses the basic fusion formula, specifically:

[0303]

[0304] in, The integrated recommendation confidence score represents the final compliance judgment confidence score output by the system. The confidence score for knowledge graph reasoning reflects the credibility of reasoning based on structured legal knowledge graphs. The confidence score represents the retrieval augmented generative reasoning (RAG) score, reflecting the credibility of semantic retrieval-based augmented reasoning. , This represents an adaptively adjustable weight parameter that satisfies the constraints. The system can adaptively adjust the weight ratio of the two components based on factors such as problem characteristics and historical accuracy to achieve the optimal fusion effect. In this embodiment, =0.6, =0.4 (initial weight).

[0305] The calculation yields: =0.6×0.92+0.4×0.85 =0.552+0.34=0.892.

[0306] (3) Dynamic Weight Adjustment (Optional) If the adaptive weight mechanism is enabled, the weight will be adjusted based on historical accuracy as follows:

[0307]

[0308] in, This is the learning rate (usually 0.1). This represents the dynamic weight value of the knowledge graph reasoning module at time step t. It is a time-varying parameter that adaptively adjusts with the system's operating state. This represents the initial weight coefficient of the knowledge graph reasoning module in the fusion computation (set to 0.6 in this system), serving as the baseline for dynamic weight adjustment. To improve the historical accuracy of the knowledge graph, this mechanism enables the system to automatically optimize the weighting of the two reasoning methods based on actual performance.

[0309] (4) Consistency judgment;

[0310] The system compares the two inference results:

[0311] Data classification: consistent (all are identified as highly sensitive core data).

[0312] Regulatory application: complementary (Knowledge Graph provides the terms, RAG provides the interpretation).

[0313] Protection measures: Highly overlapping (encryption, access control, auditing).

[0314] Judgment conclusion: No major conflict; integration strategy to be implemented.

[0315] If a conflict exists, a conflict resolution algorithm is applied, specifically:

[0316]

[0317] Among them, S conflict The final confidence score after conflict resolution is represented by the maximum value of the weighted scores of the two inference results. This represents the confidence score for knowledge graph reasoning. This indicates that the retrieval enhances the generation of reasoning confidence scores; The evidence chain confidence factor represents the reasoning result of the knowledge graph, reflecting the strength of the evidence supporting the reasoning result; The evidence chain confidence factor represents the result of RAG inference, reflecting the strength of the evidence supporting the inference result.

[0318] (5) Construction of the chain of evidence;

[0319] The system aggregates and forms a complete chain of evidence:

[0320] Total number of evidence nodes: =15.

[0321] Depth of evidence levels: =4.

[0322] Direct legal citations: 7 articles.

[0323] Supporting cases: 3.

[0324] The confidence assessment of the chain of evidence is as follows:

[0325]

[0326] in, The evidence chain confidence score measures the completeness of the evidence supporting the reasoning conclusion. This indicates the number of evidence nodes actually cited in the current reasoning path (such as the number of legal provisions, cases, etc.); The theoretical maximum number of nodes required for a complete chain of evidence is represented as a normalization benchmark. This indicates the actual depth of reasoning in the current chain of evidence; This represents the maximum inference depth defined by the system, serving as a normalization benchmark.

[0327] Step S107: Multi-dimensional visualization display;

[0328] Structured output content is generated based on the fusion reasoning results and visualized in the form of text, charts, or flowcharts.

[0329] The system visualizes the results, such as grading recommendations, compliance reasons, and legal evidence chains, using various methods including charts, flowcharts, and text. Specifically, it presents the output grading recommendations, applicable legal paths, decision-making basis, and audit information in multiple modes, such as result reports, process tracking diagrams, risk maps, and evidence chain network diagrams. Users can also customize and export the visualized content and perform interactive queries.

[0330] See Figure 9 The multi-dimensional visualization module generates and outputs the results.

[0331] The visualization results are provided and categorized according to different content types. Hierarchical suggestions and compliance suggestions are presented in text / table format, while legal basis and reasoning paths are generated as flowcharts / knowledge network diagrams. The generation of audit trail links is generated as an audit trail tracking diagram. Finally, multi-mode visualization synthesis is performed based on text / tables, flowcharts / knowledge network diagrams, or audit trail tracking diagrams (interface display module).

[0332] (1) Graded recommendation text report;

[0333] Data classification conclusions:

[0334] Category: Personal Financial Information - Transaction Data.

[0335] Level: Core Data (Level 2).

[0336] Sensitivity: High.

[0337] Overall confidence level: 94.6%.

[0338] (2) Legal evidence chain network diagram;

[0339] Generate interactive knowledge graph visualizations:

[0340] Central node: VIP customer transaction data.

[0341] First-level node: Applicable laws and regulations (7).

[0342] Second-level node: Specific clauses (15).

[0343] Level 3 nodes: Protection measures (12).

[0344] (3) Compliance Requirements Checklist;

[0345] Table 1 Compliance Requirements Checklist

[0346]

[0347] (4) Compliance flowchart;

[0348] Generate a visual guide to the cross-border transfer operation process.

[0349] Step S108: Generate audit records and reports;

[0350] See Figure 10 The audit and traceability / reporting module executes as follows:

[0351] The system receives all outputs from the entire process (data parsing, scheduling and reasoning, knowledge referencing, decision generation, and evidence tracing), records each processing step in detail, establishes audit logs and tracing archives, then determines the triggering requirements. If it is an external regulatory investigation / post-event tracing, it performs a rapid retrieval and reconstructs the entire processing chain, presenting the tracing results. If it is a routine compliance / audit requirement, it generates a standardized compliance audit report, which is then archived or submitted. Finally, it achieves a closed-loop responsibility chain with full traceability for compliance events.

[0352] (1) Complete operation record;

[0353] This JSON structure is used to record complete audit traceability information;

[0354] Audit Records = {

[0355] Session information:{

[0356] Session ID: Generates a unique identifier;

[0357] Start time: Records the time the request was received;

[0358] End Time: Records the response completion time;

[0359] Processing time: End time - Start time;

[0360] },

[0361] User information: {

[0362] User ID: Extracted from authentication information;

[0363] Original query: Save the original text entered by the user;

[0364] },

[0365] Processing procedure: {

[0366] Entity parsing results: Save NER output;

[0367] Routing decision: Save scheduler decisions;

[0368] KG reasoning results: Save the output of the knowledge graph module;

[0369] RAG inference results: Save the RAG module output;

[0370] Fusion score: Save the final confidence level;

[0371] },

[0372] Traceability information:{

[0373] Chain of evidence: Records all cited regulations and reasoning paths in sequence;

[0374] Traceability level: "Complete" (supports full-chain traceability);

[0375] }

[0376] }

[0377] (2) Automatically generate compliance reports;

[0378] The "XX Assessment Report" includes:

[0379] Execution summary.

[0380] Data classification details.

[0381] Detailed explanation of the legal basis (with original citations).

[0382] Recommendations for compliance measures.

[0383] Risk warning.

[0384] Appendix: Complete chain of evidence.

[0385] Report generation time: <50 seconds.

[0386] Report format: PDF, Word, HTML (optional).

[0387] Step S109: Dynamic knowledge update.

[0388] The dynamic knowledge acquisition and continuous learning module runs in the background:

[0389] If expert users provide feedback and corrections to the results, the system records and updates the knowledge base.

[0390] The latest laws and policies are collected regularly (weekly), and the knowledge graph is automatically parsed and updated.

[0391] Based on accumulated query-feedback data, the RAG generation model is fine-tuned.

[0392] This invention employs a multi-layered, modular architecture, integrating core modules such as multi-terminal user interfaces, problem parsing and semantic intent recognition, intelligent scheduling control, knowledge graph reasoning, RAG generation reasoning, intelligent fusion and decision tracing, multi-dimensional visualization, auditing and traceability, and dynamic knowledge acquisition and continuous learning. It can automatically identify and parse various user input needs, extracting key information such as data type, destination, and compliance requirements through natural language processing, entity extraction, and semantic understanding. The intelligent scheduling module automatically selects the optimal processing path based on problem characteristics, fully utilizing the structured regulatory reasoning capabilities of the knowledge graph and the semantic understanding and answer generation capabilities of Retrieval Enhanced Generation (RAG), providing efficient and accurate intelligent decision support for complex and ever-changing cross-border data classification and compliance issues. It enables the visualization of classification conclusions, compliance recommendations, and regulatory evidence chains, and supports full-process operational auditing and automatic generation of compliance reports. Through dynamic knowledge acquisition and expert feedback mechanisms, the system can continuously update and optimize the knowledge graph and language model, forming an intelligent compliance management system for cross-border data classification and security strategies that features intelligent question answering and self-evolution. This invention has the advantages of intelligent question answering, multi-source integration, sustainable evolution and full-process traceability, and can be widely applied to compliance management and intelligent decision-making scenarios involving cross-border data flow in enterprises, governments, finance, and healthcare.

[0393] Example 2

[0394] like Figure 11 , Figure 12 As shown, this embodiment also provides a RAG and knowledge graph question-answering system for cross-border data security classification and grading. This embodiment particularly relates to cross-border data flow, data security classification and protection, and an automated intelligent question-answering and reasoning system based on regulations and standards.

[0395] The system adopts a multi-layered, modular architecture, comprising core modules such as multi-terminal user interfaces, problem parsing and semantic intent recognition, intelligent scheduling and control, knowledge graph reasoning, RAG (Retrieval Enhanced Generation) reasoning, intelligent fusion and decision rationale tracing, multi-dimensional visualization, auditing and traceability / reporting, and dynamic knowledge acquisition and continuous learning. These modules are interconnected or work collaboratively to achieve natural language input parsing, data security classification and compliance reasoning output, legal evidence chain construction and tracing, intelligent visualization, and autonomous knowledge evolution.

[0396] The multi-terminal user interface module includes web, API, and mobile interfaces, used to receive user question input and batch data uploads from different terminals (web, API, or mobile). It supports various data input formats, including natural language text, structured forms, and batch files. This module provides unified data collection, input validation, and interactive feedback capabilities, compatible with compliance question-and-answer application requirements across multiple industries and scenarios.

[0397] The question analysis and semantic intent recognition module is used to perform natural language processing on user input, identify and extract data types, data flow destinations, and compliance requirements.

[0398] Employing natural language processing and semantic modeling technologies, this module performs word segmentation, named entity recognition, contextual semantic analysis, and deep intent extraction on user input. It automatically extracts key elements from the input, such as data type, destination, and specific compliance requirements, and represents them in a structured and standardized manner. This module is multilingual and adaptable to complex business scenarios across multiple regions, ensuring that downstream inference modules can accurately and efficiently understand users' actual compliance needs.

[0399] The intelligent scheduling and control module is used for process control and path analysis based on the analysis results.

[0400] The intelligent scheduling and control module automatically determines the optimal reasoning or generation path based on the structured compliance information output by the problem analysis module. This includes, but is not limited to, triggering knowledge graph reasoning, RAG reasoning, parallel reasoning of both, fused reasoning, and fault-tolerant handling of abnormal data. This module is responsible for process routing, priority allocation, and resource scheduling, enabling dynamic task distribution and concurrent processing to ensure the system's high efficiency and robustness.

[0401] The knowledge graph reasoning module is used to obtain hierarchical compliance recommendations based on structured legal standards reasoning.

[0402] The knowledge graph reasoning module performs compliance reasoning based on a pre-established regulatory knowledge graph. The regulatory knowledge graph uses data types, industry scenarios, countries / regions, regulatory clauses, grading standards, and protective measures as nodes, and relationships such as belonging, applicability, requirements, and restrictions as parameters. It integrates regulations from multiple countries and domains, supporting fine-grained compliance grading reasoning and regulatory suggestion retrieval based on knowledge ontology and reasoning rules (such as SPARQL and reasoning templates) for input business scenarios, outputting structured and interpretable grading judgments and compliance recommendations.

[0403] The RAG generation reasoning module is used to produce explanatory feedback and suggestions based on semantic retrieval-enhanced generative models.

[0404] The RAG reasoning module integrates a regulatory document database, a high-level regulatory retrieval engine, and a large language model. This module first performs a relevance search of regulatory documents, policy materials, and historical cases based on user needs and contextual information. Then, it combines a generative artificial intelligence model to automatically interpret semantics, provide contextualized answers, and generate personalized suggestions for novel or complex questions. This enables intelligent responses to new scenarios, adaptive regulations, and deep user needs that are difficult to cover with traditional knowledge graph reasoning.

[0405] The intelligent fusion and decision reasoning tracing module is used to fuse multi-source reasoning results.

[0406] The intelligent fusion and decision-making reasoning tracing module weights, verifies, determines conflict and consistency, and measures credibility of multi-source reasoning results from the knowledge graph reasoning module and the RAG reasoning module. Finally, the fusion algorithm outputs the optimal grading result and compliance recommendations, automatically aggregating relevant legal provisions, evidence nodes, and reasoning chains to form a complete legal evidence chain. This ensures that all compliance recommendations and grading conclusions are traceable, explainable, and easy to audit throughout the entire process.

[0407] This module can employ weighted voting algorithms, rule consistency decision algorithms, and credibility measurement algorithms, and includes the following steps:

[0408] First, feature extraction and standardization are performed on the knowledge graph reasoning results and the RAG reasoning results respectively;

[0409] For the same compliance issue, a preset weighting coefficient is used, and the weighted score is dynamically adjusted based on dimensions such as the historical performance of each module, the confidence level of the reasoning, and the richness of the related evidence chain. .

[0410] in, The integrated recommendation confidence score represents the final compliance judgment confidence score output by the system. The confidence score for knowledge graph reasoning reflects the credibility of reasoning based on structured legal knowledge graphs. The confidence score represents the retrieval augmented generative reasoning (RAG) score, reflecting the credibility of semantic retrieval-based augmented reasoning. , This represents an adaptively adjustable weight parameter that satisfies the constraints. The system can adaptively adjust the weight ratio of the two based on factors such as problem characteristics and historical accuracy to achieve the optimal fusion effect.

[0411] If the two inference results conflict, the consistency decision algorithm is triggered, which resolves the conflict by taking into account factors such as the number of nodes in the evidence chain, the scope of applicable laws and regulations, and the credibility of the result.

[0412] The final output includes a graded result and compliance recommendations with the highest confidence level, traceable to specific legal evidence chains and reasoning paths.

[0413] The multi-dimensional visualization module is used to present the results in a visual format.

[0414] The multi-dimensional visualization module can visually present outputs such as hierarchical recommendations, regulatory basis, reasoning paths, risk distribution, and audit links in various formats, including text, tables, flowcharts, and knowledge network diagrams. This module supports user-defined report exports, meeting the compliance transparency and operational convenience needs of different roles, including enterprises and regulators.

[0415] The audit and traceability reporting module is used to record the entire process and decision history.

[0416] The audit and traceability / reporting module can record in detail all aspects of the system's entire process, including data analysis, scheduling reasoning, knowledge reference, decision generation, and evidence tracing. It supports the generation of standardized compliance audit reports on demand and can respond to external regulatory investigations, achieving a complete closed loop of the responsibility chain and post-event traceability of compliance incidents.

[0417] The dynamic knowledge acquisition and continuous learning module is used to automatically collect and update the latest laws, regulations, policies, industry standards, and expert knowledge feedback.

[0418] The dynamic knowledge acquisition and continuous learning module has the capabilities of automatic collection of laws and policies, structured parsing, expert feedback and error correction mechanisms, automatic iterative updates of knowledge graphs, and fine-tuning of generation models. It enables dynamic supplementation of the latest international and domestic laws, compliance standards, and expert knowledge, as well as the evolution of the knowledge system, and improves the system's adaptability to new business scenarios and regulatory changes.

[0419] In this embodiment, the automated collection and updating of the latest regulations, policies, industry standards, and expert knowledge feedback includes: automatic collection and structured extraction of regulations and policies; establishment of expert feedback and error correction mechanisms; automatic iterative updates of the knowledge graph and fine-tuning of the large language model; and real-time tracking and self-optimization of the system in accordance with compliance standards, data regulations, and emerging laws and policies.

[0420] The method and system of this invention support multi-terminal high-concurrency question and answer, batch data processing, and API integration with third-party services. They can be widely applied to high-security and compliance management scenarios for cross-border data flows, such as enterprise, financial, and medical applications, and are also suitable for data security decision support in multiple industries and regions.

[0421] Existing data compliance question answering methods mainly fall into two categories: one is structured reasoning methods based on knowledge graphs, and the other is semantic retrieval and generation methods based on RAG. While single knowledge graph methods can provide accurate matching of regulatory clauses, they struggle to handle novel scenarios and complex semantic understanding; while single RAG methods possess good semantic understanding capabilities, they lack structured reasoning support and are prone to the problem of factual illusion.

[0422] The dual-channel fusion reasoning mechanism proposed in this invention effectively overcomes the inherent defects of the above two types of methods by executing knowledge graph reasoning and RAG generation reasoning in parallel and integrating the results of the two paths using a dynamic weighted fusion algorithm. Compared with existing methods, this invention has the following advantages: (1) It integrates structured legal knowledge and semantic understanding capabilities, significantly improving the reasoning accuracy; (2) The confidence assessment and evidence chain tracing mechanism ensures that the conclusions are interpretable and traceable; (3) The dynamic weight adaptive adjustment mechanism can automatically optimize the reasoning path selection according to the problem characteristics, improving the robustness of the system.

[0423] The technical solution of this invention has broad practical application value and can effectively serve the urgent need for cross-border data compliance management. There is a significant demand for convenient cross-border data flow in fields such as finance, intelligent connected vehicles, high-end shipping, and international trade.

[0424] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A RAG and knowledge graph question answering method for cross-border data security classification and grading, characterized in that: Includes the following steps: Step S101, User Input Reception and Preprocessing: Receive natural language questions and batches of structured or unstructured data from user input to form an input dataset to be processed, and preprocess it. Step S102, Problem Analysis and Semantic Intent Recognition: Perform entity recognition processing, rule matching processing based on the preset regulatory mapping table, and intent classification processing on the input dataset to obtain a structured analysis result containing data type, target region information, and compliance requirement information; Step S103, Intelligent Scheduling and Control Decision: Perform process routing planning and task priority sorting for structured information. Based on the data type, applicable laws and regulations in the target region, and the complexity of compliance requirements, automatically select the knowledge graph reasoning path, RAG generation reasoning path, or a fusion reasoning path that combines both. Support multi-task concurrent scheduling and an automatic fault-tolerant flow mechanism for handling process anomalies. Step S104, Knowledge Graph Reasoning Execution: Based on the pre-built cross-border data compliance knowledge graph, SPARQL queries are used to perform reasoning processing on the relationship between data types, regional attributes and relevant legal provisions to generate the first reasoning result; Step S105, RAG generation and inference execution: Using a vector retrieval model or a text-related retrieval algorithm, retrieve candidate regulatory texts that match the structured parsing results from the regulatory document library, and generate a second inference result based on the candidate regulatory texts; Step S106, Intelligent Fusion and Decision Tracing: Reasoning Fusion, performing confidence calculation on the first reasoning result and the second reasoning result, and generating fused reasoning result according to the preset weighted fusion algorithm; Step S107, Multi-dimensional visualization: Generate structured output content based on the fusion reasoning results, and present it in the form of text, charts or flowcharts; Step S108: Generate audit records and reports; Step S109: Dynamic knowledge update.

2. The RAG and knowledge graph question answering method for cross-border data security classification and grading as described in claim 1, characterized in that: In step S101, the specific implementation details are as follows: The system receives user input data via web, API, or mobile devices and performs the following preprocessing operations: input format validation and security filtering, generating a unique session identifier, recording the request timestamp, and passing the standardized request to the question parsing and semantic intent recognition module.

3. The RAG and knowledge graph question answering method for cross-border data security classification and grading as described in claim 1, characterized in that: In step S102, the specific implementation details are as follows: First, after receiving user input, the system detects the input language type; it then determines whether the language is supported. If not, it prompts or rejects the input and asks the user to re-enter; if so, it performs word segmentation and basic NLP processing. Then, named entity recognition technology is used to identify the data type, data category label, and data body of the data type extraction unit; Next, the destination identification unit extracts geographic location information, including source, destination, and transmission type; Finally, the user intent is analyzed through the compliance demand identification unit, including the primary intent, secondary intent, and expected output.

4. The RAG and knowledge graph question answering method for cross-border data security classification and grading as described in claim 1, characterized in that: In step S104, the calculation of the knowledge graph reasoning confidence score is based on a weighted sum of three core dimensions: direct matching degree of legal nodes, completeness of the evidence chain, and reliability of the reasoning path. The specific calculation formula is as follows: ； in, This represents the confidence score for knowledge graph reasoning. This indicates the score for matching the regulatory node. The score represents the completeness of the chain of evidence. Indicates the reliability score of the reasoning path; The weighting coefficients represent the matching scores of regulatory nodes; The weighting coefficients representing the score for the completeness of the chain of evidence; The weighting coefficients represent the reliability score of the reasoning path.

5. The RAG and knowledge graph question answering method for cross-border data security classification and grading as described in claim 1, characterized in that: In step S105, the RAG inference confidence score is calculated by comprehensively evaluating three dimensions: relevance of the retrieved document, consistency verification of the generated content, and matching degree of historical cases. First, the average semantic similarity between the retrieved document and the query is calculated. Then, the factual consistency between the generated content and the retrieved document is verified and scored using a large language model. Finally, the matching degree of historical similar cases is combined, and a weighted sum is obtained according to preset weights to obtain the final confidence score. The specific calculation formula is as follows: ； ； in, This indicates that the retrieval enhances the generation of reasoning confidence scores. This represents the average similarity of the retrieved documents. This indicates the content consistency verification score. Indicates the matching degree of historical cases; Indicates the average similarity of retrieved documents Weighting coefficients in RAG inference confidence scoring; Indicates the content consistency verification score Weighting coefficients; Indicates the matching degree of historical cases Weighting coefficients; This indicates the first document retrieved from the regulatory document repository. The number of candidate documents with the highest semantic relevance; This represents the cosine similarity between the query vector and the i-th retrieved document vector, used to measure the degree of semantic relevance between the two. This represents the semantic vector representation of the i-th retrieved document after vectorization. This represents the semantic vector representation of a user query after vectorization.

6. The RAG and knowledge graph question answering method for cross-border data security classification and grading as described in claim 1, characterized in that: In step S106, the specific implementation details are as follows: Each reasoning result is scored for confidence and the evidence chain is normalized; a dynamic weighting factor is used to calculate the fusion suggestion; if there are conflicting results, the consistency criterion algorithm is executed to generate the final compliance conclusion, and the evidence chain and reasoning path that can be traced back to the relevant regulations are output.

7. The RAG and knowledge graph question answering method for cross-border data security classification and grading as described in claim 6, characterized in that: The specific details of using dynamic weighting factors to calculate fusion recommendations are as follows: ， Among them, S fused S represents the confidence score of the integrated recommendation after fusion. kg S represents the confidence score produced by the knowledge graph reasoning module. rag This represents the confidence score produced by the RAG generation inference module; , This represents a weight parameter that can be adaptively adjusted.

8. A RAG and knowledge graph question-answering system for cross-border data security classification and grading, implementing the RAG and knowledge graph question-answering method for cross-border data security classification and grading as described in any one of claims 1 to 7, characterized in that: The system includes multi-terminal user interfaces, problem parsing and semantic intent recognition, intelligent scheduling and control, knowledge graph reasoning, RAG generation reasoning, intelligent fusion and decision reasoning tracing, multi-dimensional visualization, auditing and traceability / reporting, and dynamic knowledge acquisition and continuous learning modules; The modules are connected or work together in sequence to realize the parsing of natural language input, data security classification and compliance reasoning output, construction and tracing of legal evidence chains, intelligent visualization display and autonomous evolution of system knowledge.

9. The RAG and knowledge graph question-answering system for cross-border data security classification and grading as described in claim 8, characterized in that: The multi-terminal interface module is used to receive user question input and batch data upload from the web, API or mobile terminals. The problem analysis and semantic intent recognition module is used to perform natural language processing on user input, identify and extract data types, data flow destinations and compliance requirements; The intelligent scheduling and control module is used for process control and path analysis based on the analysis results; The knowledge graph reasoning module is used to obtain hierarchical compliance recommendations based on structured legal standards reasoning. The RAG generation and reasoning module is used to produce explanatory feedback and suggestions based on semantic retrieval-enhanced generative models. The intelligent fusion and decision-making reasoning tracing module is used to fuse multi-source reasoning results; The multi-dimensional visualization module is used to present the results in a visual format. The audit and traceability / reporting module is used to record the entire process and decision history. The dynamic knowledge acquisition and continuous learning module is used to automatically collect and update the latest laws, regulations, policies, industry standards, and expert knowledge feedback.

Images