Network security evaluation report review method and system based on semantic alignment of double encoders

Abstract

The invention discloses a network security evaluation report review method and system based on double-encoder semantic alignment, and aims to solve the problems that a traditional single encoder is insufficient in representation on a term domain and an evidence domain and is weak in cross-domain semantic alignment capability. According to the method, evaluation terms and evidence texts are respectively processed through double encoders with unshared parameters, the evaluation terms and the evidence texts are mapped to a public semantic space through a projection layer, discriminative features are constructed for conformity grade classification, and automatic evaluation of a network security evaluation report is realized in combination with a periodic evaluation mechanism and structured output. The defect that a traditional single encoder structure is insufficient in representation learning on cross-domain text pairs is overcome, and the accuracy of middle level judgment is remarkably improved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of artificial intelligence and network security evaluation, and particularly relates to a network security evaluation report review method and system based on double-encoder semantic alignment. BACKGROUND

[0003] In the field of natural language processing, the development of semantic text matching technology has always been an important research direction, and the core challenge lies in how to accurately measure the semantic relevance between two text segments. In the automatic review scene of network security evaluation reports, this technology is used to judge the compliance level between "evaluation clauses" and "report evidence".

[0004] At present, the widely used semantic text matching method is based on a single-encoder architecture with shared weights to realize sentence vector learning. This method inputs the clause text and evidence text into a single Transformer encoder with shared parameters for encoding processing, and then extracts sentence vector representations through [CLS] or average pooling operations. In the supervised classification paradigm, combined features such as concatenation and absolute difference are constructed from the obtained sentence vectors, and finally the linear layer and Softmax function output the compliance level classification results. In the contrast learning paradigm, the cosine similarity of the sentence vectors is directly optimized using the contrast loss, reducing the dependence on explicit classification heads.

[0005] The training process of this method usually uses the AdamW optimizer combined with learning rate warm-up and linear or cosine decay scheduling strategies; evaluation is mostly based on the correlation coefficient of the semantic text similarity task or the overall accuracy of the classification as the core indicator. This method has achieved certain results in general semantic matching tasks, but it has the following defects in the specific scene of network security evaluation report review: (1) Insufficient learning of clause domain features: Since the single encoder uses shared weights, it is difficult to adapt to the normative and abstract language features of "evaluation clauses" and the descriptive and specific language features of "report evidence", resulting in insufficient representation learning of the clause domain and affecting the accurate capture of clause semantics.

[0006] (2) Semantic understanding bias of evidence domain: When processing evidence domain text, the shared weight encoder is influenced by the training data of the clause domain, which easily produces semantic understanding bias, especially for the identification of key semantic elements such as negative expressions, limiting conditions, and degree modifiers, thereby affecting objective semantic representation.

[0007] (3) Weak cross-domain semantic alignment capability: The single-encoder structure cannot learn different language styles, terminology systems, and expression habits between the clause domain and the evidence domain, resulting in weak cross-domain semantic alignment capability, which is manifested as low accuracy in intermediate level compliance determination.

[0008] (4) Poor domain adaptability: the shared weight structure lacks independent representation learning ability between the clause domain and the evidence domain, and it is difficult to adapt to the language characteristics and semantic rules of different domains, affecting the generalization performance of the model.

[0009] Affected by the above problems, the accuracy and practicability of the semantic matching model based on a single encoder in the network security evaluation report review scene are limited. SUMMARY

[0010] In view of the problems existing in the prior art, the present application provides a network security evaluation report review method and system based on double encoder semantic alignment, which uses two Transformer encoders that do not share parameters to perform targeted representation on clause text and evidence text, thereby effectively improving the precision of cross-domain semantic alignment.

[0011] To achieve the above-mentioned application purposes, the technical solutions adopted by the present application are as follows: A network security evaluation report review method based on double encoder semantic alignment, comprising the following steps: Step S1. Data acquisition and mapping: acquire training set D_nli and evaluation set D_sts, and construct conformity level label mapping; wherein each sample in the training set D_nli and the evaluation set D_sts includes evaluation index text, result record text and conformity degree; Step S2. Label verification: according to the conformity level label mapping, each sample in the training set D_nli and the evaluation set D_sts is subjected to label verification; Step S3. Double encoder and alignment: S3-1. The evaluation index text and the result record text are respectively input into the first Transformer encoder E1 and the second Transformer encoder E2 for encoding and pooling processing, to obtain the first initial vector u0 and the second initial vector v0; S3-2. The first initial vector u0 is mapped through the first projection layer P1 to obtain the first alignment vector u; the second initial vector v0 is mapped through the second projection layer P2 to obtain the second alignment vector v; Step S4. Feature construction and training: S4-1. According to the first alignment vector u and the second alignment vector v, a feature vector x is constructed; S4-2. The feature vector x is input into a classifier, and a loss function is used for training to obtain a model outputting conformity level classification results; Step S5. Periodic evaluation: based on the preset evaluation step number, the performance of the model is evaluated on the evaluation set D_sts; Step S6. Persistency with manifest: save the weights of the model, and export parameter names, tensor shapes, label mapping table, term alignment manifest, and hyperparameters.

[0012] The present application effectively solves the limitations of traditional single encoder in cross-domain semantic understanding by adopting parameter-independent dual-encoder architecture to process the clause text and evidence text in network security evaluation respectively. Through the construction of data set and the combination of projection alignment, feature construction and periodic evaluation mechanism, a complete sentence vector training and evaluation process is established, which significantly improves the accuracy and efficiency of compliance determination. Finally, through model weight saving and structured manifest output, a reliable solution is provided for network security evaluation report review.

[0013] Further, in the step S3-1, the pooling adopts mean pooling, and the specific calculation formula is: u0 = (1 / n) *sum_{i=1 to n} hi; Wherein, n is the sequence length of the evaluation index text, hi is the i-th final hidden state output by the last layer of the first Transformer encoder E1; v0 = (1 / m) *sum_{j=1 to m} hj; Wherein, m is the sequence length of the result record text, hj is the j-th final hidden state output by the last layer of the second Transformer encoder E2.

[0014] By using the mean pooling method, the global semantic information of the text is effectively preserved by equally averaging the hidden states at all positions in the sequence, and the influence of the length difference of the input sequence on the subsequent processing is eliminated, providing a stable and unified vector input for the semantic alignment of the projection layer.

[0015] Further, in the step S3-2, the first projection layer P1 and the second projection layer P2 are independent linear layers combined with nonlinear activation functions.

[0016] By combining linear layers with nonlinear activation functions, the difference in feature conversion of different domain text representations is realized, ensuring the domain-specific feature extraction capability of each dual-encoder, while enhancing the representation capability of the model.

[0017] Further, in the step S3-2, the mapping specifically includes: the first projection layer P1 maps the first initial vector u0 to a common space with a dimension d of 128 to 1024; the second projection layer P2 maps the second initial vector v0 to a common space with a dimension d of 128 to 1024.

[0018] By limiting the public space dimension d in the preferred range of 128 to 1024, both sufficient preservation of semantic information and avoidance of computational redundancy caused by excessively high dimension are achieved, realizing the best balance between model performance and computational efficiency.

[0019] Further, in the step S4-1, the feature vector x is constructed, specifically including: constructing an absolute difference feature |u-v| according to the first alignment vector u and the second alignment vector v to form the feature vector x.

[0020] By constructing the absolute difference feature |u-v|, the model's discrimination ability for the intermediate level of "partial compliance" is effectively enhanced, thereby significantly improving the accuracy of compliance determination.

[0021] Further, in the step S4-2, the loss function used is a multi-class cross-entropy loss function.

[0022] By introducing the multi-class cross-entropy loss function, the difference between the predicted probability distribution and the true label can be effectively measured, and the model's parameter adjustment can be guided through the gradient backpropagation mechanism to improve the model's classification performance.

[0023] Further, in the step S1, the compliance level label is mapped by the compliance degree according to the relationship between the evaluation indicator text and the result record text as follows: 0 corresponds to "not applicable", 1 corresponds to "partial compliance", 2 corresponds to "compliance", and 3 corresponds to "incompliance".

[0024] By establishing the mapping relationship of the four compliance level labels, the text semantic relationship is converted into standardized numerical labels, the evaluation standard is unified, the subjective bias of manual judgment is eliminated, and the consistency of training data quality and model learning goal is ensured.

[0025] Further, in the step S2, the label verification specifically includes: performing parsability detection and out-of-boundary verification, and removing samples that do not belong to the four types of mapping of the compliance level label according to the compliance level label, which are recorded as invalid samples.

[0026] By implementing parsability detection and out-of-boundary verification, abnormal samples that do not conform to the preset four compliance level label mapping relationships are identified and removed, effectively avoiding the negative impact of noise data on model performance.

[0027] Further, in the step S5, the performance of the model is evaluated, including calculating the overall accuracy of the model, and the calculation formula of the overall accuracy is as follows: Accuracy_total = TP_total / N_eval × 100%. wherein, Accuracy_total is the total accuracy, TP_total is the total number of correctly predicted samples, and N_eval is the total number of samples in the evaluation set.

[0028] By introducing the calculation formula of the total accuracy, the overall discrimination ability of the model on the evaluation set is accurately reflected, and a mathematical basis is provided for model parameter optimization and architecture selection.

[0029] A network security evaluation report review system based on double-encoder semantic alignment is applied to a network security evaluation report review method based on double-encoder semantic alignment.

[0030] The beneficial effects of the present application are: (1) The present application adopts a double-Transformer encoder architecture without parameter sharing, independently encodes the evaluation clauses and report evidence respectively, overcomes the deficiency of insufficient representation learning of traditional single-encoder structure on cross-domain text pairs, maps the vectors output by different encoders to a common semantic space through a projection layer, effectively improves the semantic alignment ability of the clause domain and the evidence domain, and significantly improves the determination accuracy of the intermediate level of "partially consistent".

[0031] (2) The present application constructs a unified training-evaluation path, stabilizes the evaluation index, reduces the fluctuation in the later training period, avoids the measurement deviation problem caused by the inconsistency between the training target and the evaluation index in the traditional method, and improves the comparability and reliability of the evaluation results. BRIEF DESCRIPTION OF DRAWINGS

[0032] Figure 1 A flowchart of a network security evaluation report review method based on double-encoder semantic alignment provided by the present application. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical scheme and advantages of the present application clearer, the present application will be further described in detail below in combination with specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of the present application. EMBODIMENT

[0034] The present embodiment provides a network security evaluation report review method and system based on double-encoder semantic alignment, which processes the evaluation clauses and evidence texts by double-encoders without sharing parameters, solving the problem of insufficient representation of traditional single-encoder on the clause domain and evidence domain and weak cross-domain semantic alignment ability.

[0035] As Figure 1As shown, the network security evaluation report review method based on double-encoder semantic alignment includes the following steps: Step S1. Data acquisition and mapping: acquire training set D_nli and evaluation set D_sts, and construct compliance level label mapping; wherein the training set D_nli and the evaluation set D_sts are acquired from past manually reviewed reports, and each sample in the training set D_nli and the evaluation set D_sts includes evaluation index text, result record text and compliance degree.

[0036] Step S2. Label verification: according to the compliance level label mapping, each sample in the training set D_nli and the evaluation set D_sts is verified; Step S3. Double encoder and alignment: S3-1. Input the report to be evaluated, and after the evaluation index text and the result record text of the report to be evaluated are segmented, the first token sequence t1: [w1, w2,..., wn] and the second token sequence t2: [v1, v2,..., vm] are obtained, wherein n is the sequence length of the first token sequence t1, m is the sequence length of the second token sequence t2, wi is each token in the first token sequence t1, and vj is each token in the second token sequence t2.

[0037] Input representation construction is performed on the first token sequence t1, and each token wi is represented as e_i = E_word(wi) + E_pos(i) + E_seg(0), wherein e_i is the comprehensive embedding vector of the i-th token, E_word is a word embedding matrix, E_pos is a position embedding matrix, and E_seg is a segmentation embedding matrix. Then, the first new sequence [e1, e2,..., en] is input to the first Transformer encoder E1 for encoding processing. The calculation of each layer of Transformer is as follows: H^0 = [e1, e2,..., en], wherein H^0 is the first initial hidden layer state; For the l-th layer, wherein l is from 1 to L, and L is the number of Transformer layers: Q = H^{l-1} W_Q^l, K = H^{l-1} W_K^l, V = H^{l-1} W_V^l; wherein Q, K, V are query, key, value matrix respectively, H^{l-1} is the output hidden state of the (l-1)-th layer, W_Q^l, W_K^l, W_V^l ∈ R^{d_model × d_k} are the attention weight matrix of the l-th layer, d_model is the model dimension, and d_k is the attention head dimension. Then, self-attention calculation is performed: Attention(Q, K, V) = softmax( (Q K^T) / sqrt(d_k) ) V; wherein Attention is a self-attention function, and softmax is a normalized exponential function. Then, residual connection and layer normalization are performed: H_{attn}^l = LayerNorm( H^{l-1} + Attention(Q, K, V) ); wherein H_{attn}^l is the normalized attention input of the l-th layer, LayerNorm is a layer normalization function, and H^l is the final output of the l-th Transformer after the self-attention mechanism, residual connection and layer normalization. H^l = LayerNorm( H_{attn}^l + FFN(H_{attn}^l) ); wherein FFN can be a two-layer fully connected network, the first layer activation function is ReLU, and the second layer is linear.

[0038] After L layers of calculation, the output of the last layer H^L = [h1, h2,..., hn] is obtained, wherein hi is the final hidden state of the i-th token.

[0039] Finally, mean pooling is used for pooling processing to obtain the first initial vector u0: u0 = (1 / n) *sum_{i=1 to n} hi.

[0040] For input representation construction of the second token sequence t2, each token vj is represented as e_j’ = E_word’(vj) + E_pos’(j) + E_seg’(0), wherein e_j’ is the comprehensive embedding vector of the j-th token, E_word’ is a word embedding matrix, E_pos’ is a position embedding matrix, and E_seg’ is a segmentation embedding matrix. Then, the second new sequence [e1’, e2’,..., em’] is input to the second Transformer encoder E2 for encoding processing. The calculation of each layer of Transformer is as follows: H^0’ = [e1’, e2’,..., em’], wherein H^0’ is the second initial hidden layer state; For the l-th layer, wherein l is from 1 to L, L is the number of Transformer layers: Q’ = H^{l-1}’ W_Q^l’, K’ = H^{l-1}’ W_K^l’, V’ = H^{l-1}’ W_V^l’; wherein Q’, K’, V’ are query, key, value matrices respectively; H^{l-1}’ is the input of the l-th layer Transformer, W_Q^l’, W_K^l’, W_V^l’ ∈ R^{d_model × d_k} are the attention weight matrices of the l-th layer; d_model is the model dimension, d_k is the attention head dimension. Then self-attention calculation is performed: Attention(Q’, K’, V’) = softmax( (Q’K’^T) / sqrt(d_k) ) V’; wherein Attention is the self-attention function, and softmax is the normalization exponential function. Then residual connection and layer normalization are performed: H_{attn}^l’ = LayerNorm( H^{l-1}’ + Attention(Q’, K’, V’) ) ; wherein H_{attn}^l’ is the intermediate hidden state of the l-th layer after self-attention mechanism, residual connection and layer normalization, and LayerNorm is the layer normalization function. Then, the final output H^l’ of the l-th layer Transformer is obtained through the feedforward network FFN: H^l’ = LayerNorm( H_{attn}^l’ + FFN(H_{attn}^l’) ) ; wherein FFN can be a two-layer fully connected network, the first layer activation function is ReLU, and the second layer is linear.

[0041] After L layers of calculation, the output of the last layer H^L’ = [h1’, h2’,..., hm’] is obtained, wherein hj is the final hidden state of the j-th token.

[0042] Finally, mean pooling is used for pooling processing to obtain the first initial vector v0: v0 = (1 / n) *sum_{j=1 to m} hj.

[0043] S3-2. Map the first initial vector u0 through the first projection layer P1 to d-dimensional space to obtain a first aligned vector u: u = P1(u0) = ReLU(W1 * u0 + b1); Wherein, the first projection layer P1 is a combination of a linear layer and an activation function ReLU, W1 ∈ R^{d×d_model} and b1 ∈ R^d are learnable parameters.

[0044] Map the second initial vector v0 through the second projection layer P2 to d-dimensional space to obtain a second aligned vector v: v = P2(v0) = ReLU(W2 * v0 + b2); Wherein, the first projection layer P2 is a combination of a linear layer and an activation function ReLU, W2 ∈ R^{d×d_model} and b2 ∈ R^d are learnable parameters.

[0045] Step S4. Feature construction and training: S4-1. Construct a feature vector x according to the first aligned vector u and the second aligned vector v; S4-2. Input the feature vector x into a fully connected layer to obtain a fully connected layer output z: z = W_c * x + b_c; Wherein, z ∈ R^C, C is the number of categories, and C is 4 in this embodiment; W_c ∈ R^{C×(k·d)} and b_c ∈ R^C are learnable parameters of the classifier.

[0046] Then, a Softmax function is used to obtain the probability of each category: p_i = exp(z_i) / sum_{j=1}^{C} exp(z_j) (for i = 1,..., C); Wherein, p_i is the predicted probability of the sample belonging to category i, z_i is the i-th element of the fully connected layer output, and z_j is the j-th element of the fully connected layer output.

[0047] Then, a multi-class cross-entropy loss function is used to calculate the loss function value.

[0048] During training, the AdamW optimizer is used, and a learning rate schedule with warm-up is used. Wherein, warm-up means that during the initial training, the learning rate is linearly increased from 0 to the initial learning rate, and then the learning rate is decreased according to the cosine decay strategy, and the calculation formula of the warm-up step number W_steps is: W_steps = ceil(N_train × E × R); where, N_train is the number of training set samples, E is the number of training rounds, and R is the Warmup ratio, for example, R = 0.1.

[0049] The specific learning rate scheduling process is as follows: First, set the initial learning rate as lr0, the current step number as step, and the total training step number T_total as: T_total = N_train * E / batch_size; where, N_train is the number of training set samples, E is the number of training rounds, and batch_size is the number of samples used in each training iteration.

[0050] The learning rate scheduling is divided into two stages: If step<= W_steps, the learning rate scheduling is in the Warmup stage, and the learning rate is: learning rate = lr0 * (step / W_steps); where, lr0 is the initial learning rate, step is the current step number, and W_steps is the Warmup step number.

[0051] If step> W_steps, the learning rate scheduling is in the decay stage, and the learning rate is cosine decayed: learning rate = lr0 * 0.5 * (1 + cos(pi * (step - W_steps) / (T_total - W_steps))); where, lr0 is the initial learning rate, step is the current step number, W_steps is the Warmup step number, and T_total is the total training step number.

[0052] In the training stage, each batch of the training dataset is sequentially traversed in each training round epoch, and the model is updated and iterated according to the following steps: Forward propagation: input the current batch of data into the model to calculate the predicted output and loss function value; Back propagation: calculate the gradient based on the loss function value; Parameter update: update the parameters using the AdamW optimizer and adjust the learning rate.

[0053] Step S5. Periodic evaluation: evaluate the performance of the model on the evaluation set D_sts based on the preset evaluation step number evaluation_steps; Step S6. Persistency with inventory: save the model weights, and export parameter names, tensor shapes, label mapping table, term alignment inventory, and hyperparameters. The model weights include, but are not limited to: A. Encoder part weights: Word embedding matrix: E_word ∈ R^{V×d_model}, where V is the vocabulary size, and d_model is the model hidden layer dimension; Position embedding matrix: E_pos ∈ R^{L_max×d_model}, where L_max is the maximum length of input sequence, and d_model is the model hidden layer dimension; B. Transformer layer parameters: Self-attention projection matrices: W_Q, W_K, W_V ∈ R^{d_model×d_k}, where d_model is the model dimension, and d_k is the attention head dimension; Self-attention projection matrices: W_Q, W_K, W_V ∈ R^{d_model×d_k}, where d_model is the model dimension, and d_k is the attention head dimension; Self-attention output matrix: W_O ∈ R^{h•d_k×d_model}, where d_model is the model dimension, d_k is the attention head dimension, and h is the number of attention heads; Feedforward network weights: W_ff1 ∈ R^{d_model×d_ff}, W_ff2 ∈ R^{d_ff×d_model}, where d_ff is the feedforward network hidden layer dimension, and d_model is the model dimension; C. Projection layer weights: Projection matrix P1: W_P1 ∈ R^{d_model×d}, b_P1 ∈ R^d, where d is the projection dimension, and R^d is a d-dimensional array; Projection matrix P2: W_P2 ∈ R^{d_model×d}, b_P2 ∈ R^d, where d is the projection dimension, and R^d is a d-dimensional array; D. Classification layer weights: W_c ∈ R^{C×(k•d)}, b_c ∈ R^C, where C is the number of classes, k is the feature combination coefficient, d is the projection dimension, and R^C is a C-dimensional array.

[0054] The present application effectively solves the limitations of traditional single encoders in cross-domain semantic understanding by adopting a parameter-independent double-encoder architecture to process the clause text and evidence text in network security evaluation, and through the construction of a data set and the combination of projection alignment, feature construction and periodic evaluation mechanism, a complete sentence vector training and evaluation process is established, which significantly improves the accuracy and efficiency of compliance determination, and finally ensures the reproducibility of the model through model weight saving and structured list output, providing a reliable solution for network security evaluation report review.

[0055] In the step S3-1, the pooling adopts mean pooling, and the specific calculation formula is: u0 = (1 / n) *sum_{i=1 to n} hi; Where n is the sequence length of the evaluation index text, and hi is the i-th final hidden state output by the last layer of the first Transformer encoder E1. v0 = (1 / m) *sum_{j=1 to m} hj; Where m is the sequence length of the result record text, and hj is the j-th final hidden state output by the last layer of the second Transformer encoder E2.

[0056] By using the mean pooling method, the hidden states of all positions in the sequence are equally averaged, effectively retaining the global semantic information of the text, and eliminating the influence of the length difference of the input sequence on the subsequent processing, providing a stable and unified vector input for the semantic alignment of the projection layer.

[0057] In the step S3-2, the first projection layer P1 and the second projection layer P2 are independent linear layers combined with non-linear activation functions, and in the present embodiment, the non-linear activation function is preferably ReLU.

[0058] By combining linear layers with non-linear activation functions, the difference in feature conversion of different domain text representations is realized, ensuring the domain-specific feature extraction capability of each double encoder, while enhancing the representation capability of the model.

[0059] In the step S3-2, the mapping specifically includes: the first projection layer P1 maps the first initial vector u0 to the common space R^{d}; the second projection layer P2 maps the second initial vector v0 to the common space R^{d}, where d is the projection dimension, preferably 128-1024.

[0060] By setting the public space dimension preferably in the range of 128 to 1024, sufficient semantic information is ensured to be retained, while avoiding computational redundancy caused by excessively high dimension, achieving a balance between model performance and computational efficiency.

[0061] In the step S4-1, the feature vector x is constructed, specifically, an absolute difference feature |u-v| is constructed according to the first alignment vector u and the second alignment vector v, and the feature vector x is formed, wherein the first alignment vector u, the second alignment vector v and the absolute difference feature all belong to R^d, and R^d represents a d-dimensional array, and in the embodiment, d is 4.

[0062] By constructing the absolute difference feature |u-v|, the model's ability to distinguish intermediate levels of "partial compliance" is effectively enhanced, thereby significantly improving the accuracy of compliance determination.

[0063] In the step S4-2, the loss function used is a multi-class cross-entropy loss function.

[0064] By introducing the multi-class cross-entropy loss function, the difference between the predicted probability distribution and the true label can be effectively measured, and the model's parameters can be adjusted through the gradient backpropagation mechanism to improve the model's classification performance.

[0065] In the step S1, a compliance level label mapping {0, 1, 2, 3} is constructed, and the compliance level label is mapped by the compliance degree according to the relationship between the evaluation indicator text and the result record text as follows: 0 corresponds to "not applicable", 1 corresponds to "partial compliance", 2 corresponds to "compliance", and 3 corresponds to "incompliance".

[0066] By establishing four kinds of compliance level label mapping relationships, the text semantic relationship is converted into a standardized numerical label, the review standard is unified, the subjective bias of manual judgment is eliminated, and the consistency of training data quality and model learning goal is ensured.

[0067] In the step S2, the label verification specifically includes performing parsability detection and out-of-bound checking, removing samples that do not belong to the four types of mapping of the compliance level label according to the compliance level label, recording as invalid samples, and recording the statistical type and sample ID.

[0068] Through parsability detection and out-of-bound checking, abnormal samples that do not conform to the preset four kinds of compliance level label mapping relationships are identified and removed, ensuring the quality and consistency of the training data, and effectively avoiding the negative impact of noise data on the model performance.

[0069] In the embodiment, in the step S5, the evaluating the performance of the model comprises calculating an overall accuracy of the model, and the calculation formula of the overall accuracy is as follows: Accuracy_total = TP_total / N_eval * 100%; Wherein, Accuracy_total is the overall accuracy, TP_total is the total number of correctly predicted samples, and N_eval is the total number of evaluation set samples.

[0070] By introducing the calculation formula of the overall accuracy, the overall discrimination ability of the model on the evaluation set is accurately reflected, and a mathematical basis is provided for model parameter optimization and architecture selection.

[0071] In the embodiment, a network security evaluation report review system based on double-encoder semantic alignment is constructed, and a network security evaluation report review method based on double-encoder semantic alignment is applied. The complete and automatic process of network security evaluation report review sentence vector training and evaluation is realized.

[0072] The working principle of the application is as follows: first, two parameter-independent first Transformer encoder E1 and second Transformer encoder E2 are used to perform deep feature learning on the evaluation index text and result record text respectively, so as to adapt to the significant differences between them in language style, terminology system and semantic abstraction degree; then, the first projection layer P1 and the second projection layer P2 are used to nonlinearly map the encoded high-level vectors to a common low-dimensional semantic space, to obtain the first alignment vector u and the second alignment vector v; subsequently, the absolute difference feature |u-v| is constructed and input to the classifier; finally, the classifier performs hierarchical judgment on the shared path.

[0073] According to the disclosure and teaching of the above description, those skilled in the art of the present application can also make changes and modifications to the above embodiments. Therefore, the present application is not limited to the specific embodiments disclosed and described above, and some modifications and changes of the application should also fall within the protection scope of the claims of the present application. In addition, although some specific terms are used in the specification, these terms are only for convenience of explanation and do not constitute any limitation on the application.

Claims

1. A method for reviewing cybersecurity assessment reports based on dual-encoder semantic alignment, characterized in that, Includes the following steps: Step S1. Data Acquisition and Mapping: Acquire the training set D_nli and the evaluation set D_sts, and construct a conformity level label mapping; wherein, each sample in the training set D_nli and the evaluation set D_sts includes the evaluation index text, the result record text, and the degree of conformity; Step S2. Label verification: According to the conformity level label mapping, perform label verification on each sample in the training set D_nli and the evaluation set D_sts; Step S3. Dual encoders and alignment: S3-1. Input the evaluation index text and the result record text into the first Transformer encoder E1 and the second Transformer encoder E2 respectively for encoding and pooling processing to obtain the first initial vector u0 and the second initial vector v0; S3-2. Map the first initial vector u0 through the first projection layer P1 to obtain the first alignment vector u; map the second initial vector v0 through the second projection layer P2 to obtain the second alignment vector v; Step S4. Feature Construction and Training: S4-1. Construct a feature vector x based on the first alignment vector u and the second alignment vector v; S4-2. Input the feature vector x into the classifier, train it using a loss function, and obtain a model that outputs the conformity level classification result; Step S5. Periodic evaluation: Evaluate the performance of the model on the evaluation set D_sts based on a preset number of evaluation steps; Step S6. Persistence and Inventory: Save the weights of the model and export the parameter names, tensor shapes, label mapping table, term alignment list and hyperparameters.

2. The network security assessment report review method based on dual encoder semantic alignment according to claim 1, characterized in that, In step S3-1, the pooling method used is average pooling, and the specific calculation formula is as follows: u0 = (1 / n) *sum_{i=1 to n} hi; Where n is the sequence length of the evaluation index text, and hi is the i-th final hidden state output by the last layer of the first Transformer encoder E1; v0 = (1 / m) *sum_{j=1 to m} hj; Where m is the sequence length of the result recorded text, and hj is the j-th final hidden state output by the last layer of the second Transformer encoder E2.

3. The network security assessment report review method based on dual encoder semantic alignment according to claim 1, characterized in that, In step S3-2, the first projection layer P1 and the second projection layer P2 are independent linear layers combined with nonlinear activation functions.

4. The network security assessment report review method based on dual encoder semantic alignment according to claim 1, characterized in that, In step S3-2, the mapping specifically includes: the first projection layer P1 maps the first initial vector u0 to a common space with dimensions d from 128 to 1024; the second projection layer P2 maps the second initial vector v0 to a common space with dimensions d from 128 to 1024.

5. The network security assessment report review method based on dual encoder semantic alignment according to claim 1, characterized in that, In step S4-1, constructing the feature vector x specifically includes: constructing the absolute difference feature |uv| based on the first alignment vector u and the second alignment vector v, thus forming the feature vector x.

6. The network security assessment report review method based on dual encoder semantic alignment according to claim 1, characterized in that, In step S4-2, the loss function used is the multi-class cross-entropy loss function.

7. The network security assessment report review method based on dual encoder semantic alignment according to claim 1, characterized in that, In step S1, the compliance level label is mapped by the degree of compliance according to the relationship between the evaluation index text and the result record text as follows: 0 corresponds to "not applicable", 1 corresponds to "partially compliant", 2 corresponds to "compliant", and 3 corresponds to "non-compliant".

8. The network security assessment report review method based on dual encoder semantic alignment according to claim 1, characterized in that, In step S2, the label verification specifically includes: performing resolvability detection and out-of-bounds verification, and removing samples that do not belong to the four mapping types of the conformity level label according to the conformity level label, and recording them as invalid samples.

9. The network security assessment report review method based on dual encoder semantic alignment according to claim 1, characterized in that, In step S5, evaluating the performance of the model includes calculating the overall accuracy of the model, and the formula for calculating the overall accuracy is as follows: Accuracy_total = TP_total / N_eval × 100%; Where Accuracy_total is the overall accuracy, TP_total is the total number of correctly predicted samples, and N_eval is the total number of samples in the evaluation set.

10. A network security assessment report review system based on dual encoder semantic alignment, characterized in that, The method for training and evaluating the sentence vectors of network security assessment reports based on Transformer dual encoders as described in any one of claims 1 to 9 is applied.

Images