Security auditing and resource scheduling method and system for generative visualization code

Abstract

This application relates to a security auditing and resource scheduling method and system for generative visualization code. The method includes: receiving structured raw data for visualization processing and generative visualization code output from a large language model; parsing the generative visualization code and converting it into an abstract syntax tree (AST); traversing the syntax nodes of the AST; performing static auditing according to security auditing matching rules; if no serious security risks are determined, inputting the metadata of the structured raw data into a lightweight isolation environment; simulating the execution of the generative visualization code; generating a rendering resource fingerprint based on captured drawing intent instructions and data scale parameters; extracting rendering features from the rendering resource fingerprint, assigning weights, and summing them to obtain a rendering cost score; and making rendering resource scheduling decisions based on the relationship between the rendering cost score and the browser's tolerance threshold and the server's tolerance threshold. This method can achieve secure, stable, and efficient visualization rendering.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a method and system for security auditing and resource scheduling of generative visual code. Background Technology

[0002] With the continuous iteration of Large Language Models (LLM) in natural language understanding and code generation capabilities, their application in data visualization is becoming increasingly widespread. The core application model involves receiving user visualization requests through natural language interaction, directly generating executable code compatible with mainstream plotting libraries, and then rendering the target chart on a server or browser. This technological approach significantly lowers the technical barrier to data visualization, eliminating the need for users to possess professional programming skills. It allows for the rapid transformation of complex datasets into intuitive visualizations, and is widely used in various scenarios such as business intelligence analysis, scientific data visualization, and enterprise business monitoring, thereby improving the efficiency of data insight acquisition.

[0003] Currently, various implementation paths have emerged for technologies that generate visualization code based on large language models. A classic approach is to directly generate code for mainstream plotting libraries using a general-purpose large language model. This approach involves inputting a clear description of the visualization requirements into the large language model, which then directly outputs complete code conforming to the syntax specifications of mainstream plotting libraries such as Matplotlib and ECharts. No additional model fine-tuning or module expansion is required; after simple verification and adjustments, rendering is executed, making it suitable for common basic visualization scenarios. Subsequently, researchers proposed a method for fine-tuning large language models based on a dedicated dataset to improve the reliability of visualization code generation. This approach constructs a dedicated dataset containing a massive amount of verified plotting code, natural language instructions, and corresponding rendering results. This dataset is used to fine-tune the basic code model, strengthening its ability to match data structures with visualization semantics. Simultaneously, a multi-round feedback mechanism is introduced to correct code errors, significantly improving the executability and visual accuracy of the generated code. Some researchers have also proposed a method for generating visualization code using a multi-agent collaborative framework. This approach breaks down visualization into multiple sub-tasks, such as query understanding, data processing, visualization mapping, code generation, and debugging verification, and assigns them to specialized agents with different functions. Through collaborative interaction and iterative reflection among agents, it can handle complex datasets and diverse visualization needs, reducing the task burden of a single model.

[0004] While existing visualization code generation solutions based on large language models each have their advantages, most still suffer from common technical pain points in practical industrial applications, hindering the large-scale deployment and stable operation of the systems. These include: 1. Uncontrollable security: The generated visualization code may contain malicious logic such as file system access or unauthorized network connections, or logical vulnerabilities such as infinite loops caused by model illusions, directly threatening the operational security of servers and terminal devices; 2. Rendering performance collapse: The model-generated code lacks awareness of adapting to data scale and fails to consider performance optimization for large-scale data scenarios. Generating code for one-time rendering of millions or more of data can easily lead to memory overflows, causing browser or server rendering crashes; 3. Resource waste: Existing systems generally adopt a fixed resource allocation model, failing to dynamically adjust computing resources according to the complexity of the visualization task and the differences in data scale. Allocating redundant resources to simple charts results in waste, while complex charts may experience execution timeouts due to insufficient resources. The lack of a dynamic resource scheduling mechanism based on task requirements further exacerbates the problem of inefficient resource utilization. Summary of the Invention

[0005] Therefore, it is necessary to provide a security auditing and resource scheduling method and system for generative visual code to address the above-mentioned technical problems.

[0006] A security auditing and resource scheduling method for generative visual code, the method comprising:

[0007] Receive structured raw data for visualization processing, and output generative visualization code based on the visualization requirements of the structured raw data using a large language model;

[0008] The generative visualization code is parsed and converted into an abstract syntax tree. The syntax nodes of the abstract syntax tree are traversed, and static auditing is performed according to preset security audit matching rules to obtain a static audit report.

[0009] If the static audit report determines that there is no serious security risk, the metadata of the structured raw data is input into a lightweight isolation environment for restricting resource access permissions, and the generative visualization code is simulated to generate a rendering resource fingerprint based on the captured drawing intent instructions and data scale parameters.

[0010] The rendering features are extracted from the rendering resource fingerprint, and differential weights are assigned and summed to obtain the rendering cost score. The rendering cost score is then used to make a rendering resource scheduling decision based on the relationship between the rendering cost score and the preset browser tolerance threshold and server tolerance threshold. The corresponding rendering resources are then scheduled to implement rendering based on the decision result.

[0011] A security auditing and resource scheduling system for generative visual code, the system comprising:

[0012] The data acquisition module is used to receive structured raw data for visualization processing, and output generative visualization code based on the visualization requirements of the structured raw data through a large language model.

[0013] The static audit module is used to parse the generative visual code and convert it into an abstract syntax tree, traverse the syntax nodes of the abstract syntax tree, perform static auditing according to preset security auditing matching rules, and obtain a static audit report.

[0014] The resource fingerprint acquisition module is used to input the metadata of the structured raw data into a lightweight isolation environment for restricting resource access permissions if the static audit report determines that there is no serious security risk, simulate the execution of the generative visualization code, and generate a rendering resource fingerprint based on the captured drawing intent instructions and data scale parameters.

[0015] The resource scheduling module is used to extract rendering features from the rendering resource fingerprint, assign differentiated weights, and then sum them to obtain a rendering cost score. Based on the relationship between the rendering cost score and the preset browser tolerance threshold and server tolerance threshold, the module makes a rendering resource scheduling decision and schedules the corresponding rendering resources to achieve rendering based on the decision result.

[0016] The aforementioned security auditing and resource scheduling method and system for generative visualization code, by parsing the generative visualization code into an abstract syntax tree, traversing syntax nodes, and performing static auditing according to preset security audit matching rules, can accurately identify high-risk operations that are not necessary for drawing, blocking security risks at the source and ensuring the operational security of servers and terminal devices. By simulating code execution in a lightweight isolated environment, it captures drawing intent instructions and data scale parameters to generate rendering resource fingerprints, and combines differentiated weights to obtain a rendering cost score, which can accurately quantify rendering complexity. By comparing the rendering cost score with preset browser and server tolerance thresholds, it makes resource scheduling decisions, dynamically adapts the optimal rendering path, effectively avoids rendering collapse caused by large-scale data, and realizes on-demand allocation of computing resources, reducing redundancy and waste, and balancing visualization interactivity and system operational stability. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating a security auditing and resource scheduling method for generative visual code in one embodiment;

[0018] Figure 2 This is a flowchart illustrating a security auditing and resource scheduling method for generative visual code in a specific embodiment.

[0019] Figure 3 This is a schematic diagram of the sandbox structure in one embodiment. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0021] In one embodiment, such as Figure 1 As shown, a method for security auditing and resource scheduling of generative visual code is provided, including the following steps:

[0022] Step 102: Receive the structured raw data for visualization processing, and output generative visualization code based on the visualization requirements of the structured raw data using a large language model.

[0023] Structured raw data refers to visual data sources with a fixed format that can be parsed and processed. Generative visualization code is code generated by a large language model based on the visualization needs of structured raw data, and adapted to mainstream plotting libraries.

[0024] Step 104: Parse the generative visualization code and convert it into an abstract syntax tree. Traverse the syntax nodes of the abstract syntax tree and perform static auditing according to the preset security audit matching rules to obtain a static audit report.

[0025] Abstract Syntax Tree (AST) is a structured collection of syntax nodes generated by code parsing tools, transforming generative and visual code. It clearly presents the syntactic structure and logical relationships of the code. Pre-defined security audit matching rules are a pre-set system of rules used to verify code security and performance risks, covering core aspects such as system operation blacklist matching, performance risk syntax identification, and sensitive data processing verification. Static audit reports are files that record the code audit results, containing key information such as the location of high-risk nodes and the type of risk (security risk / performance risk).

[0026] It is understandable that step 104 can perform comprehensive security and performance pre-verification before code execution, identify high-risk system calls that are not necessary for drawing, performance risk syntax such as multi-level nested loops, and sensitive data that has not been desensitized in advance, significantly improve the security of generative visualization code, and reduce the probability of security incidents or performance abnormalities during subsequent execution.

[0027] Step 106: If the static audit report determines that there is no serious security risk, the metadata of the structured raw data is input into a lightweight isolation environment for restricting resource access permissions, and generative visualization code is simulated to generate rendering resource fingerprints based on the captured drawing intent instructions and data scale parameters.

[0028] Metadata is descriptive information about structured raw data. A lightweight isolated environment is an independent running container with restricted resource access permissions, capable of isolating code from the host system and providing only the runtime dependencies necessary for code execution. Rendering resource fingerprints are a set of structured features captured during simulation execution, containing information related to drawing intent instructions and data scale parameters. Drawing intent instructions are the core requirements that the code needs to implement, such as chart types and interactive functions, while data scale parameters are quantitative indicators supporting visualization, including the number of data points to be rendered and the number of chart nesting levels.

[0029] It is understandable that step 106 isolates code execution in a sandbox environment, injects only metadata to avoid the leakage of all sensitive data, and skips actual pixel rendering to save computing resources. It accurately captures key rendering features and provides a reliable basis for subsequent resource scheduling, which helps to improve the security of data transmission and execution processes and reduce unnecessary resource consumption.

[0030] Step 108: Extract rendering features from the rendering resource fingerprint, assign differentiated weights, and sum them to obtain the rendering cost score. Make a rendering resource scheduling decision based on the relationship between the rendering cost score and the preset browser tolerance threshold and server tolerance threshold. Schedule the corresponding rendering resources to implement rendering based on the decision result.

[0031] The rendering cost score is a quantitative indicator derived from rendering features in the rendering resource fingerprint. It is obtained by assigning differentiated weights and weighted summation, and is used to reflect the resource consumption and execution complexity required for visualization rendering. The browser tolerance threshold is the upper limit of the maximum rendering cost score that the browser can stably complete rendering, and the server tolerance threshold is the upper limit of the maximum rendering cost score that the server can stably process. The rendering resource scheduling decision is a judgment process that selects the corresponding rendering method based on the relationship between the rendering cost score and the above two thresholds.

[0032] It is understandable that step 108 can accurately assess the rendering difficulty through quantitative indicators, dynamically match the optimal rendering resources and execution path, avoid browser and server rendering crashes due to excessive data volume or high complexity, effectively improve system operation stability, and realize on-demand allocation of computing resources, reduce redundant resource waste, and take into account the optimal balance between visualization interactivity and execution efficiency.

[0033] The aforementioned security auditing and resource scheduling method for generative visualization code uses abstract syntax tree parsing to traverse syntax nodes and perform static auditing based on preset security auditing matching rules. This accurately identifies high-risk operations that are not necessary for drawing, blocking security risks at the source and ensuring the security of server and terminal devices. By simulating code execution in a lightweight isolated environment, it captures drawing intent instructions and data scale parameters to generate rendering resource fingerprints. Combining differentiated weights to sum the rendering cost score, it can accurately quantify rendering complexity. By comparing the rendering cost score with preset browser and server tolerance thresholds, it makes resource scheduling decisions, dynamically adapts to the optimal rendering path, effectively avoids rendering collapse caused by large-scale data, and realizes on-demand allocation of computing resources, reducing redundancy and waste, while balancing visualization interactivity and system stability.

[0034] In one embodiment, the method further includes: if the static audit report determines that there is a serious security risk, then blocking the subsequent process.

[0035] In this embodiment, serious security risks specifically refer to code matching a pre-defined serious security blacklist, including malicious system calls not necessary for drawing (such as file system accesses like os.system, open(...,'w'), and unauthorized network connections), or high-risk logic containing sensitive data that has not been anonymized. By directly blocking the subsequent execution of such risky code during the static audit phase, without needing to enter the sandbox simulation or rendering stage, malicious code can be completely prevented from escaping to the production environment at the source, avoiding security attacks on servers and terminal devices, and significantly improving the security and stability of system operation.

[0036] In one embodiment, static auditing is performed according to preset security audit matching rules to obtain a static audit report, which includes: matching each abstract tree syntax node with a preset system operation blacklist, checking for the existence of system call operations that are not necessary for drawing, and obtaining matching results; identifying performance risk syntax patterns and obtaining identification results; checking for the existence of sensitive fields in the structured raw data and obtaining inspection results; and generating a static audit report that marks the location and risk type of high-risk nodes based on the matching results, identification results, and inspection results.

[0037] In this embodiment, the system operation blacklist covers all high-risk system interaction behaviors unrelated to visualization rendering. Performance-risk syntax patterns include logic that may cause execution efficiency issues, such as multi-level nested loops, iterations without termination conditions, and full traversal of extremely large datasets. Sensitive fields include privacy-sensitive data such as mobile phone numbers, ID card numbers, and bank card numbers that need to be anonymized. This process achieves deep traversal verification of the code through abstract syntax tree parsing, comprehensively covering both security and performance risks. The generated audit report accurately marks the location and type of risks, providing a clear basis for subsequent process judgments and enabling early avoidance of security risks and performance anomalies during code execution.

[0038] In one embodiment, a lightweight isolated environment includes a Docker or WASM sandbox.

[0039] In this embodiment, both sandboxes possess the core capabilities of resource limitation and environment isolation: Docker creates independent containers through operating system-level virtualization, sharing the host kernel but isolating the file system and network; the WASM sandbox runs in a cross-platform binary instruction format, resulting in faster startup and lower resource consumption. Both sandboxes limit CPU and memory usage, block network connections, and only mount runtime dependencies necessary for generative visual code execution (such as custom mocking libraries), without loading redundant components. By building a lightweight isolated environment, the code to be executed can be effectively isolated from the host system, preventing malicious code from stealing all original data or damaging host resources. Furthermore, by injecting only metadata rather than the full data, the risk of sensitive data leakage is further reduced, ensuring the security of the code simulation execution process.

[0040] In one embodiment, simulating the execution of generative visualization code and generating a rendering resource fingerprint based on captured drawing intent instructions and data scale parameters includes: replacing the standard drawing library with a custom simulated drawing library during the simulation execution process; not performing actual pixel rendering when the code calls pixel rendering-related functions; capturing the drawing intent instructions and related data scale parameters of the code to generate a structured rendering resource fingerprint.

[0041] In this embodiment, the structured raw data metadata (such as the number of rows and column types) is first injected into the sandbox. Then, the generative visualization code is loaded. A custom mock drawing library tricks the code into executing normally but skipping actual pixel rendering steps such as canvas.draw. Instead, it records key features such as the type of chart to be rendered, interactive function requirements, number of data points, chart nesting levels, and style calculation complexity. This avoids unnecessary resource consumption caused by actual rendering, enables rapid code behavior prediction, and the generated structured rendering resource fingerprint can comprehensively reflect the core features required for rendering, providing accurate and reliable data support for subsequent rendering cost calculation.

[0042] In one embodiment, extracting rendering features from the rendering resource fingerprint, assigning differentiated weights, and then summing them to obtain a rendering cost score includes: extracting rendering features from the rendering resource fingerprint; rendering features include the number of data points, chart type, and interaction complexity; assigning preset differentiated weights to each rendering feature, and calculating the rendering cost score by weighted summation.

[0043] In this embodiment, the allocation of differentiated weights can be set according to the rendering difficulty. The weight relationship of chart types is 3D surface chart > 2D bar chart > plain text card. The weights of the number of data points and interaction complexity are dynamically adjusted according to the actual application scenario. By transforming abstract rendering requirements into quantifiable numerical indicators, the resource consumption and execution complexity of different visualization tasks can be accurately assessed, avoiding resource allocation imbalances caused by relying solely on experience. This provides a scientific and objective decision-making basis for subsequent dynamic resource scheduling.

[0044] In one embodiment, the rendering resource scheduling decision based on the relationship between the rendering cost score and the preset browser tolerance threshold and server tolerance threshold includes: if the rendering cost score is lower than the browser tolerance threshold, the front end renders directly; if the rendering cost score is between the browser tolerance threshold and the server tolerance threshold, the data is downsampled and then rendered by the front end; if the rendering cost score is higher than the server tolerance threshold, the server renders it as a static image and returns it.

[0045] In this embodiment, data downsampling employs random sampling or stratified sampling algorithms to reduce the dimensionality of millions or more data points to a preset number of visual feature points, preserving the core distribution patterns of the data. Server-side rendering is executed through a headless browser on a high-performance cluster, directly generating static image files for the user. This scheduling logic achieves intelligent adaptation of the visualization execution path: low-complexity tasks are rendered directly by the front-end to ensure interactivity; medium-complexity tasks balance performance and user experience through downsampling; and high-complexity tasks are statically rendered on the server side to avoid rendering crashes. This completely eliminates browser or server crashes caused by full rendering of large amounts of data, while also enabling on-demand allocation of computing resources, reducing redundancy and waste, and achieving an optimal balance between performance and interactivity.

[0046] In one specific embodiment, such as Figure 2 The diagram illustrates a process flow for a security auditing and resource scheduling method for generative visual code, including the following steps:

[0047] First, input the raw data and the visualization code generated by the large language model;

[0048] S1. Parse the code AST (Abstract Syntax Tree) and perform blacklist, graylist and sensitive data operation verification;

[0049] S2. Load data and simulate code execution in a sandbox (isolated container), but do not perform actual pixel rendering; only capture resource fingerprints.

[0050] S3. Calculate the "Rendering Cost Score" based on fingerprints;

[0051] S4. Determine the execution path based on the score (directly allow passage / allow passage after data sampling / return after server-side image rendering).

[0052] Furthermore, the specific steps of S1 include:

[0053] S10. Call the code parsing tool for the corresponding language to convert the code into an abstract syntax tree and break it down into analyzable syntax nodes;

[0054] S11. Traverse the abstract syntax tree nodes, match the preset system operation blacklist, and check for the existence of non-drawing system calls such as os.system, subprocess, open(..., 'w');

[0055] S12. Identify syntax patterns that may pose performance risks, such as multi-level nested loops, iterations without termination conditions, and logic for traversing the entire dataset of a very large dataset.

[0056] S13. Check if there is any sensitive field in the code that is sensitive to the original data, such as mobile phone number, ID card number, etc., or if the data is not anonymized.

[0057] S14. Generate a static audit report, marking the location of high-risk nodes and the risk type (security risk / performance risk). If a serious security blacklist is matched, the process is directly terminated.

[0058] Furthermore, the specific steps of S2 include:

[0059] S20. Create a lightweight, isolated container Docker or WASM environment (sandbox) to limit the container's system resources, block the network, and mount only the necessary runtime dependencies to ensure that data is not leaked.

[0060] S21. Injecting the metadata (such as the number of rows and column types) of the real data, rather than the full data, into the sandbox and loading the visualization code can reduce the risk of leakage of classified data.

[0061] S22. Replace the standard plotting library with a custom Mock object. When the code calls pixel rendering-related functions, it does not perform actual pixel drawing, but instead records characteristics such as the type of chart to be rendered, the number of data points, the number of chart nesting levels, and the complexity of style calculations.

[0062] S23. After execution, destroy the sandbox environment to prevent the leakage of classified information and output structured resource fingerprints.

[0063] Furthermore, in S3, the mathematical expression for the Rendering Cost Score is:

[0064] ;

[0065] in, The differential weighting coefficients are dynamically adjustable. Represents the number of data points. It is the weight of chart type. The difference in rendering cost of different charts is quantified as a weight value (e.g.: 3D surface chart weight > 2D bar chart > plain text card). This refers to interaction complexity. It's important to note that the chart nesting levels and style computational complexity mentioned earlier are incorporated into existing parameters through reasonable feature integration design: multi-level nested charts directly increase the complexity of the chart type, which is reflected in… In weight assignment, complex style calculations (such as dynamic gradients and multi-layer overlays) can directly increase the rendering complexity during interaction. This can be addressed by... Fully covering the impact of these features can completely cover the impact of all core rendering features, avoiding parameter redundancy.

[0066] Furthermore, the specific steps of step S4 include:

[0067] S40. Based on the score S and the preset threshold (T) browser Browser limits, T server Decisions are made based on the server's capacity limits.

[0068] S41, Situation A ( ): Securely allow access. Send the code and data to the front end for direct rendering by the browser;

[0069] S42, Situation B ( ): Automatic downsampling / sampling. The system automatically modifies the code to inject a data downsampling algorithm, reducing 1 million points to 1000 visual feature points before sending them to the front end.

[0070] S43, Situation C ( Server-side static rendering. If the data volume is too large, the front-end will inevitably crash. The system uses a headless browser on a high-performance server cluster to render static images, directly returning the images to the user instead of code.

[0071] like Figure 3The diagram illustrates a sandbox architecture used to securely simulate the execution of AI-generated visualization code. The process is as follows: The input integration module receives the AI-generated visualization code (e.g., Python + Matplotlib format) and the metadata of the original data (including descriptive information such as row count, data type, and field count). After integrating these, it is input into a restricted Docker or WASM isolation environment. This environment limits CPU and memory resources and blocks network connections, isolating the code to be executed from the host system at the underlying level, preventing malicious code escape or resource abuse. When executing code within the sandbox, if the code calls a plotting API (e.g., plt.scatter()), the system automatically replaces the real plotting library (e.g., Matplotlib, ECharts) with a custom mock plotting library. The mock object receives the code calls without returning errors, thus deceiving the code into executing normally. The mock plotting library intercepts the call parameters, extracting core rendering features such as chart type, number of data points, and number of layers. It also skips actual pixel rendering steps (e.g., canvas.draw(), renderToDOM), avoiding unnecessary computational resource consumption. Based on the intercepted parameters and the execution results of pixel-free rendering, the sandbox generates a resource fingerprint (RenderingCost fingerprint) containing rendering complexity information, and records the sandbox execution log (such as execution time and memory usage). Finally, the resource fingerprint and execution log are used as outputs to provide accurate quantitative basis for subsequent rendering cost calculation and resource scheduling decisions.

[0072] It should be understood that, although Figure 1 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 1 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0073] In one embodiment, a security auditing and resource scheduling system for generative visual code is provided, comprising:

[0074] The data acquisition module receives structured raw data for visualization processing and outputs generative visualization code based on the visualization requirements of the structured raw data using a large language model.

[0075] The static audit module is used to parse generative visual code and convert it into an abstract syntax tree. It traverses the syntax nodes of the abstract syntax tree, performs static auditing according to preset security auditing matching rules, and obtains a static audit report.

[0076] The resource fingerprint acquisition module is used to input the metadata of the structured raw data into a lightweight isolated environment for restricting resource access permissions if the static audit report determines that there is no serious security risk. It simulates the execution of generative visualization code and generates a rendering resource fingerprint based on the captured drawing intent instructions and data scale parameters.

[0077] The resource scheduling module is used to extract rendering features from the rendering resource fingerprint, assign differentiated weights, and then sum them to obtain a rendering cost score. Based on the relationship between the rendering cost score and the preset browser tolerance threshold and server tolerance threshold, the module makes rendering resource scheduling decisions and schedules the corresponding rendering resources to achieve rendering based on the decision results.

[0078] Specific limitations regarding the security auditing and resource scheduling system for generative visual code can be found in the limitations of the security auditing and resource scheduling method for generative visual code described above, and will not be repeated here. Each module in the aforementioned security auditing and resource scheduling system for generative visual code can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0079] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0080] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for security auditing and resource scheduling oriented to generative visualization code, characterized in that, The method includes: Receive structured raw data for visualization processing, and output generative visualization code based on the visualization requirements of the structured raw data using a large language model; The generative visualization code is parsed and converted into an abstract syntax tree. The syntax nodes of the abstract syntax tree are traversed, and static auditing is performed according to preset security audit matching rules to obtain a static audit report. If the static audit report determines that there is no serious security risk, the metadata of the structured raw data is input into a lightweight isolation environment for restricting resource access permissions, and the generative visualization code is simulated to generate a rendering resource fingerprint based on the captured drawing intent instructions and data scale parameters. The rendering features are extracted from the rendering resource fingerprint, and differential weights are assigned and then summed to obtain the rendering cost score. The rendering cost score is used to make a rendering resource scheduling decision based on the relationship between the rendering cost score and the preset browser tolerance threshold and server tolerance threshold. The corresponding rendering resources are scheduled to realize rendering based on the decision result. Simulating the execution of the generative visualization code, and generating a rendering resource fingerprint based on the captured drawing intent instructions and data scale parameters, includes: During the simulation process, the standard drawing library is replaced with a custom simulation drawing library, and when the code calls pixel rendering-related functions, actual pixel rendering is not performed; Capture the drawing intent instructions and related data scale parameters in the code to generate a structured rendering resource fingerprint.

2. The method of claim 1, wherein, The step of making rendering resource scheduling decisions based on the relationship between the rendering cost score and preset browser and server capacity thresholds includes: If the rendering cost score is lower than the browser's tolerance threshold, the front-end will render it directly. If the rendering cost score is between the browser's tolerance threshold and the server's tolerance threshold, the data will be downsampled and rendered by the front end. If the rendering cost score exceeds the server's tolerance threshold, the server will render it as a static image and return it.

3. The method of claim 1, wherein, The method further includes: If the static audit report determines that there is a serious security risk, then the subsequent process will be blocked.

4. The method according to claim 1, characterized in that, Static auditing is performed according to preset security audit matching rules, and the resulting static audit report includes: For each abstract tree syntax node, match it against a preset system operation blacklist to check for any non-drawing system call operations and obtain the matching results; Identify grammatical patterns that pose performance risks and obtain the identification results; Check the original structured data for sensitive fields and obtain the results. Based on the matching results, the identification results, and the inspection results, a static audit report is generated that marks the location and risk type of high-risk nodes.

5. The method according to claim 1, characterized in that, Extracting rendering features from the rendering resource fingerprint, assigning differentiated weights, and then summing them to obtain the rendering cost score includes: Rendering features are extracted from the rendering resource fingerprint; the rendering features include the number of data points, chart type, and interaction complexity. Each rendering feature is assigned a preset differential weight, and the rendering cost score is obtained by weighted summation.

6. The method according to claim 1, characterized in that, The lightweight isolation environment includes Docker or WASM sandboxes.

7. A security auditing and resource scheduling system for generative visual code applied to the method described in any one of claims 1-6, characterized in that, The system includes: The data acquisition module is used to receive structured raw data for visualization processing, and output generative visualization code based on the visualization requirements of the structured raw data through a large language model. The static audit module is used to parse the generative visual code and convert it into an abstract syntax tree, traverse the syntax nodes of the abstract syntax tree, perform static auditing according to preset security auditing matching rules, and obtain a static audit report. The resource fingerprint acquisition module is used to input the metadata of the structured raw data into a lightweight isolation environment for restricting resource access permissions if the static audit report determines that there is no serious security risk, simulate the execution of the generative visualization code, and generate a rendering resource fingerprint based on the captured drawing intent instructions and data scale parameters. The resource scheduling module is used to extract rendering features from the rendering resource fingerprint, assign differentiated weights, and sum them to obtain a rendering cost score. Based on the relationship between the rendering cost score and the preset browser tolerance threshold and server tolerance threshold, the module makes a rendering resource scheduling decision and schedules the corresponding rendering resources to achieve rendering based on the decision result.

Images