Named entity identification method and device

Abstract

The invention provides a named entity identification method and device for a network security system file of a power monitoring system. The method comprises the following steps: acquiring a system text to be identified in the field of network security of the power monitoring system; and providing the to-be-recognized system text to a named entity recognition model obtained by training through fusing text sequence features, domain dictionary confidence features and text format marking features in advance for analysis, and obtaining a corresponding named entity recognition result.

Description

Technical Field

[0001] This application relates to the field of power monitoring, and more particularly to a named entity recognition method and apparatus. Background Technology

[0002] Named entity recognition (NER), a core foundational task in Natural Language Processing (NLP), aims to identify and classify entities with specific meanings from unstructured text. Currently, mainstream NER techniques primarily include rule-based templates, traditional machine learning, and deep learning methods. Among these, deep learning models based on pre-trained models (such as BERT and RoBERTa) combined with Bidirectional Long Short-Term Memory (BiLSTM) networks and Conditional Random Fields (CRF) have become the mainstream solution for general-purpose NER due to their powerful ability to capture contextual semantics.

[0003] However, in the specific area of ​​highly specialized cybersecurity policy documents for power monitoring systems, the aforementioned general NER model faces significant challenges:

[0004] Poor domain adaptability: The training corpora of general models are mostly derived from news, encyclopedias, etc., which do not adequately cover the numerous professional entities (such as "Security Zone I", "Vertical Encryption Authentication Device", "GB / T 36572—2018", etc.) present in regulatory documents, resulting in low recognition accuracy and recall. Insufficient feature extraction: Existing models mainly rely on the contextual semantic features of text sequences and fail to effectively incorporate prior domain knowledge. For entities with ambiguous boundaries (such as entities with long names) and complex formats (such as document numbers, standard codes), there is a lack of targeted feature guidance, which can easily lead to entity fragmentation or missed recognition. Imbalanced samples and difficulty in updating and maintaining: Regulatory documents in the field of power monitoring are updated frequently, and new professional terms and entities are constantly emerging. General models are difficult to dynamically adapt to this change, and the cost of re-labeling data and retraining models is high, making it difficult to continuously maintain and optimize existing solutions.

[0005] Therefore, there is an urgent need for a dedicated named entity recognition method that can deeply integrate domain knowledge and accurately identify entities unique to cybersecurity policy documents of power monitoring systems. Summary of the Invention

[0006] The purpose of this application is to provide a named entity recognition method and apparatus to solve the problems of low recognition accuracy, blurred entity boundaries, weak ability to recognize complex format entities, and difficulty in dynamically adapting to domain knowledge updates in the general NER model in this professional field.

[0007] To achieve the above objectives, the named entity recognition method for network security policy documents of power monitoring systems provided in this application includes: obtaining the policy text to be identified in the field of network security of power monitoring systems; providing the policy text to be identified to a named entity recognition model that has been trained in advance by fusing text sequence features, domain dictionary confidence features and text format markup features, and obtaining the corresponding named entity recognition result.

[0008] In one embodiment of this application, optionally, the domain dictionary includes at least name, subject, document number, date, terminology, system device, and standard code entity categories; the dictionary confidence feature is obtained by calculating the confidence of each character in the training text belonging to the entity's starting label and internal label under each entity category.

[0009] In one embodiment of this application, optionally, the construction of the power monitoring system network security domain dictionary includes: storing entity entries according to the entity category using a trie structure; and labeling the characters in the entries with tags indicating the start of an entity, inside an entity, or a non-entity based on their position in the entry.

[0010] In one embodiment of this application, optionally, the confidence level of each character is calculated based on the ratio of the number of times the character appears as a B / I tag of a specific category in the domain dictionary to the total number of B / I tags under the specific category.

[0011] In one embodiment of this application, optionally, the text format markup features include one or more of the following: symbol markup, used to identify technical symbols in the text; prefix markup, used to identify the first character of an entity prefix; and number markup, used to identify numeric characters.

[0012] In one embodiment of this application, optionally, the named entity recognition model obtained by training by fusing text sequence features, domain dictionary confidence features, and text format markup features includes: weighting and concatenating the text sequence features, projected dictionary confidence features, and projected text format markup features to generate a fused embedding vector; and training the named entity recognition model using a neural network algorithm based on the fused embedding vector.

[0013] In one embodiment of this application, optionally, the training process of the named entity recognition model further includes a dictionary model co-optimization step: mining entities not covered in the domain dictionary based on the prediction results of the model, updating the domain dictionary through the uncovered entities; regenerating dictionary confidence features using the updated domain dictionary, and fine-tuning the model.

[0014] In one embodiment of this application, optionally, the named entity recognition model includes, in sequence: a feature fusion layer, used to fuse the text sequence features, domain dictionary confidence features and text format marker features; an encoding layer, which uses a BERT-WWM-based pre-trained language model to encode the fused features; and a sequence labeling layer, which uses a BiLSTM-CRF model to perform sequence labeling on the encoded features and outputs the named entity recognition result.

[0015] This application also provides a named entity recognition device for network security policy documents of power monitoring systems, comprising: a data acquisition module for acquiring policy text to be identified in the field of network security of power monitoring systems; and an analysis module for providing the policy text to be identified to a named entity recognition model pre-trained by fusing text sequence features, domain dictionary confidence features and text format mark features to obtain the corresponding named entity recognition result.

[0016] This application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-described method.

[0017] This application also provides a computer-readable storage medium storing a computer program that performs the above-described methods.

[0018] This application also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the above-described method.

[0019] This invention constructs and trains a named entity recognition model by integrating text sequence features, domain dictionary confidence features, and text format marker features, and introduces a dictionary model collaborative optimization mechanism, thereby bringing comprehensive and significant benefits: First, the model significantly improves the accuracy and recall rate of professional entity recognition in network security policy documents of power monitoring systems, especially for complex format entities such as "standard codes" and "document numbers," achieving complete and fragment-free accurate extraction; Second, thanks to the strong guidance of dictionary confidence and format markers, the model's determination of entity boundaries is more accurate, effectively solving the problems of long entity nesting and boundary ambiguity; Finally, the collaborative optimization mechanism enables the model to have continuous self-evolution capabilities, dynamically adapting to domain knowledge updates with low manual costs, greatly improving the long-term applicability and maintainability of the system in professional fields. Attached Figure Description

[0020] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, do not constitute a limitation thereof. In the drawings:

[0021] Figure 1 A flowchart illustrating a named entity recognition method for network security policy documents in a power monitoring system, provided as an embodiment of this application;

[0022] Figure 2 This is a flowchart illustrating a named entity recognition model trained by fusing text sequence features, domain dictionary confidence features, and text format markup features, as provided in an embodiment of this application.

[0023] Figure 3 This is a schematic diagram of the model optimization process provided in an embodiment of this application;

[0024] Figure 4 This is a schematic diagram of dictionary-model collaborative optimization provided in an embodiment of this application;

[0025] Figure 5 A schematic diagram of a named entity recognition device for network security policy documents of a power monitoring system, provided in an embodiment of this application;

[0026] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0027] The following will describe in detail the implementation methods of this application with reference to the accompanying drawings and embodiments, so as to fully understand how this application uses technical means to solve technical problems and achieve technical effects, and to implement it accordingly. It should be noted that, as long as there is no conflict, the various embodiments and features in each embodiment of this application can be combined with each other, and the resulting technical solutions are all within the protection scope of this application.

[0028] Furthermore, the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0029] To address the current lack of research in the field of dedicated named entity recognition models for power monitoring system network security, this application provides a dedicated named entity recognition model for the power monitoring system network security field. This model accurately extracts entities categorized as "regulation name," "subject," "system equipment," and "standard code" from regulatory documents in this field. The model balances entity coverage and recognition accuracy, supports dynamic expansion, adapts to the characteristics of power monitoring system network security regulatory documents, and can support downstream applications such as domain knowledge graph construction, compliance checks, intelligent question answering, and reading comprehension. For details, please refer to... Figure 1 As shown, the named entity recognition method for network security policy documents of power monitoring systems provided in this application includes:

[0030] S101 Obtain the policy text to be identified in the field of cybersecurity for power monitoring systems;

[0031] This embodiment involves obtaining raw text data from network security-related documents of the power monitoring system. These documents include national laws and regulations, general administrative regulations, power industry regulations, company documents, national standards, power industry standards, and enterprise standards. After obtaining the text, a customized data cleaning strategy needs to be executed to achieve format standardization and ensure the quality of the corpus. Specific cleaning rules include:

[0032] 1. Based on the preset stop word list, a custom stop word list for network security of the power monitoring system is constructed to retain time descriptions, numbers, and unit symbols (such as "〔〕" and "---" in book titles and document numbers, and "year / month / day" in dates) that may appear in the system documents, so as to avoid the destruction of entity integrity.

[0033] 2. Remove redundant formatting characters (such as table separators, meaningless placeholders, and merge multiple spaces / line breaks into one space or line break), but retain Chinese punctuation marks (e.g., ,。;:).

[0034] 3. Delete headers and footers, footnotes, page numbers (such as "- 3 -", "Page 5 of 20"), table of contents, appendices, and figure / table titles.

[0035] 4. Identify and delete non-entity-related annotation markers (such as "Note:", "Remarks", "Explanation"), but retain the annotation content itself (such as retaining "This regulation shall be implemented from January 1, 2025" which contains the Date entity).

[0036] 5. Establish a mapping between "error symbols and correct symbols" (e.g., "7" is uniformly changed to "Tiaowangan

[2022] No. 7").

[0037] 6. Divide the text into paragraphs and sentences:

[0038] Paragraph division: Use chapter titles (such as "Chapter 1 General Provisions") as separators, with each chapter as an independent paragraph; structured text converted from tables is treated as a separate paragraph; for excessively long chapters, split them into sub-paragraphs according to a certain number of clauses (such as 10 clauses) to avoid excessively long paragraphs.

[0039] Sentence segmentation: Prioritize using ".", ";", and line breaks as clause punctuation; avoid splitting complete semantic units containing multiple entities (e.g., do not split complete sentences containing Name, Subject, Date); entities within parentheses (e.g., "(Regulations No. 760)") are bound to the main clause and not separated into separate clauses.

[0040] S102 provides the text of the system to be identified to a named entity recognition model that has been trained by integrating text sequence features, domain dictionary confidence features and text format markup features, and obtains the corresponding named entity recognition result.

[0041] In this step, the trained Named Entity Recognition (NER) model is used to analyze the cleaned text. The model employs a five-layer structure: "Input Layer → Feature Fusion Layer → BERT-WWM Encoding Layer → BiLSTM Local Feature Layer → CRF Output Layer," achieving high-precision entity recognition by fusing multimodal features. The model output is a sequence of BIO tags (such as "B-NAME", "I-NAME", "B-SUB", etc.), corresponding to seven entity types: Name, Subject, Number, Date, Terms, Equipment, and Code. Model training is based on a labeled dataset, using specific training parameters and optimization strategies. The recognition results can be directly used for downstream applications such as knowledge graph construction, compliance checks, and intelligent retrieval, and can achieve structured associations such as "law / regulation name - issuing entity - document number - implementation date."

[0042] In one embodiment of this application, the domain dictionary includes at least name, subject, document number, date, terminology, system device, and standard code entity categories; the dictionary confidence feature is obtained by calculating the confidence of each character in the training text belonging to the entity's starting label and internal label under each entity category.

[0043] Specifically, in practice, the domain dictionary is built based on the network security policy documents of the power monitoring system, covering 7 types of entities:

[0044] Name: The full name of laws, regulations, and standard documents (including quotation marks), such as "Regulations on Security Protection of Power Monitoring Systems".

[0045] Subject: The state organ or enterprise that issues the document; the responsible party or the object of implementation of the system document, such as the National Energy Administration or grid-connected power plants.

[0046] Document Number: The unique identifier of an institutional document, such as XXX No. 760 or YYY

[2022] No. 7.

[0047] Date: The date the policy document was issued and the date it took effect, such as July 1, 2023.

[0048] Terms: Names of network security protection technologies / measures; terms related to security incidents / accidents; other proper nouns such as network security level protection, security zone, and security zone I.

[0049] System Equipment: Names of facilities, systems, and equipment related to power monitoring systems, such as critical information infrastructure, distribution automation systems, vertical encryption authentication devices, SCADA, and EMS.

[0050] Standard Code: The code for technical standards such as national standards, power industry standards, and enterprise standards, such as DL / T1455---2015 and GB / T 36572---2018, to ensure complete identification and avoid physical fragmentation.

[0051] In one embodiment of this application, the construction of a network security dictionary for a power monitoring system includes: storing entity entries according to the entity category using a trie structure; and labeling characters in the entries with tags indicating the start of an entity, the interior of an entity, or a non-entity based on their position in the entry.

[0052] Specifically, the construction scheme for the domain dictionary is as follows:

[0053] The main dictionary uses a trie structure to store entity text and categories. Under the root node, first-level branches are created for seven entity categories: Name, Subject, Number, Date, Terms, Equipment, and Code. Each branch stores all entity entries for its corresponding category. This structure accelerates matching and prioritizes matching the longest entries to correct for entity nesting issues.

[0054] BIO Tag Mapping: Considering that single-word entities and ending information do not need to be highlighted in the annotation of institutional documents, the BIO tag system is used for data annotation. A total of 15 tags are designed: "B-NAME" and "I-NAME" (representing the full name of laws and regulations), "B-SUB" and "I-SUB" (representing relevant entities), "B-NUM" and "I-NUM" (representing document numbers), "B-DATE" and "I-DATE" (representing dates), "B-TERM" and "I-TERM" (representing terms), "B-SYS" and "I-SYS" (representing systems and equipment), "B-CODE" and "I-CODE" (representing standard codes), and "O" (representing non-entity parts). For example, "National Energy Administration" (Subject class), starting from the Subject branch, stores "National," "Energy," "Source," and "Administration" sequentially, with "National" labeled as "B-SUB," and subsequent "National," "Energy," "Source," and "Administration" all labeled as "I-SUB."

[0055] Special format entries are handled as follows:

[0056] Name class (format features are "< + text + 》"): such as "Regulations on Security Protection of Power Monitoring System", stored in the order of "<", "electricity", "power"... "fixed" and "》", "<" is marked as "B-NAME", the middle character is "I-NAME", and "》" is "I-NAME".

[0057] Number type (format features are "prefix (Guoneng Anquan, etc.) + [+ year + ] + serial number + number"): For example, in "Tiaowang An

[2022] No. 7", "Tiao" is "B-NUM" and the rest of the characters are "I-NUM".

[0058] Date class (format characteristics are "YYYY Year MM Month DD Day"): such as "July 1, 2023", "2" is marked as "B-DATE", and "0", "2", "3", "Year", "7", "Month", "1", "Day" are "I-DATE".

[0059] Code type (format characteristics are "prefix (GB / T / DL / T / Q / GDW) + space + number + — + year"): such as "DL / T 1455—2015", "D" indicates "B-CODE", and the following "L" " / " "T" ... "5" are "I-CODE".

[0060] The input text is traversed character by character, starting from the root node of the trie. The longest term is matched first (to avoid truncating long terms with short terms and to correct entity nesting issues, such as "National Development and Reform Commission No. 27" should belong to the Number category as a whole, not the Subject category). When a match is successful, it is labeled with BIO according to the above rules; otherwise, it is labeled with "O".

[0061] In addition, data augmentation strategies are adopted during the construction process, taking into account synonym mapping (for example, in the Subject, "control center" and "dispatch agency" are synonyms; in the Terms, "level protection" is synonymous with "level protection" and "network security level protection"; in the Equipment, "energy management system" and "EMS" are synonyms) to improve dictionary coverage.

[0062] In one embodiment of this application, the confidence level of each character is calculated based on the ratio of the number of times the character appears as a B / I tag of a specific category in the domain dictionary to the total number of B / I tags under the specific category.

[0063] In this embodiment, the dictionary confidence features are represented by a three-dimensional feature matrix F∈R n×7×2 This is represented by the expression, where n is the length of the text sequence, 7 represents the number of entity categories, and 2 represents the two types of labels, B and I. This feature quantifies the reliability of a character belonging to a certain entity category (B or I label).

[0064] The specific calculation formula is as follows:

[0065] ;

[0066] in: For entity categories, c∈{Name, Subject, Number, Date, Terms, Equipment, Code};

[0067] For BIO tag collection ;

[0068] The i-th character in the text sequence Character exist In class entities as The number of times the tag appears, express In class entities Total number of characters in the tag.

[0069] Example: When it is for the "country", , The confidence levels of the remaining categories are 0.

[0070] In one embodiment of the present application, the text format marking features include one or more of the following: symbol markings, used to identify professional symbols in the text; prefix markings, used to identify the first characters of entity prefixes; and digital markings, used to identify numerical characters.

[0071] Specifically, the text format marking features are represented by a two-dimensional feature matrix G ∈ R n×3 and are used to locate the starting position of the B label:

[0072] : symbol marking ( if it is a professional symbol such as "《", "〔", "—", etc., it is 1, otherwise it is 0);

[0073] : prefix marking ( if it is the first character of an entity prefix such as "GB / T", "调网安", etc., it is 1, otherwise it is 0);

[0074] : digital marking ( if it is a number, it is 1, otherwise it is 0).

[0075] Example: When it is " " (the first character of the national standard number prefix), ; When it is "2" (the first character of the Date year), .

[0076] Please refer to Figure 2 As shown, in one embodiment of the present application, the named entity recognition model obtained by training through the fusion of text sequence features, domain dictionary confidence features, and text format marking features includes:

[0077] S201 performs weighted splicing on the text sequence features, the projected dictionary confidence features, and the projected text format marking features to generate a fusion embedding vector;

[0078] S202 obtains the named entity recognition model through neural network algorithms based on the fusion embedding vector.

[0079] Specifically, in actual work, the specific design and training process of the model are as follows:

[0080] 1. Input layer and multi-modal feature construction: The input is a combination of three types of features, namely ;

[0081] Text sequence features: Assume that the length of the cleaned text is n, and it is input in characters.

[0082] Custom dictionary confidence feature: that is, the aforementioned three-dimensional matrix F.

[0083] Format marking feature: that is, the aforementioned two-dimensional matrix G.

[0084] 2. Dictionary feature fusion layer: Cross-modal feature alignment:

[0085] Map the dictionary feature and the format feature G to the embedding dimension of BERT, and fuse them with the character embedding. The steps are as follows:

[0086] BERT character embedding: Use the pre-trained Chinese whole-word masking model (chinese-bert-wwm) to convert to character embedding , where (the hidden layer dimension of the BERT base model);

[0087] Dictionary and format feature mapping: Map , to dimensions to obtain and . The linear layer formula is:

[0088] , ;

[0089] where , are weight matrices, is the bias term, which can be optimized through training.

[0090] Fusion embedding calculation: Adopt the "weighted splicing" method to fuse features, taking into account the information of each modality. The formula is:

[0091] ;

[0092] where is the fusion weight, satisfying (learned during training), and finally .

[0093] 3. BERT-WWM encoding layer: Context semantic capture:

[0094] Input into the BERT-WWM model to capture the B / I semantic dependencies of entities in long texts (such as the semantic association between "country" (B) and "home" (I) in "National Development and Reform Commission"), steps:

[0095] Layer normalization: For Normalization, to avoid gradient vanishing, formula:

[0096] ;

[0097] where is the mean value of is the variance, is a small value to prevent the denominator from being 0;

[0098] Transformer encoding: Output context semantic embeddings through 12-layer Transformer encoder (BERT base model) , formula:

[0099] ;

[0100] Contains the long context information of such as when "adjust network security" is followed by "〔",

[0101] 4. BiLSTM local layer: Entity boundary refinement:

[0102] To address the problem that BERT is insufficient in capturing local dependencies of short entities (such as the association between "2024" (B-Date) and "year" (I-Date) in "November 25, 2024"), add a BiLSTM layer:

[0103] Bidirectional LSTM calculation: Input into BiLSTM, capture local dependencies from left to right (forward-LSTM) and from right to left (backward-LSTM) respectively, and the output is:

[0104] ;

[0105] ;

[0106] where , is the forward state of the previous character, is the backward state of the next character.

[0107] Local feature concatenation: Concatenate the bidirectional outputs to obtain locally semantically enhanced embeddings : .

[0108] 5. CRF output layer: BIO tag sequence prediction:

[0109] CRF modeling is used to determine the transition rules of BIO tags (e.g., B can only be followed by I / O, encouraging B→I, I can only be followed by I / O, and O can only be followed by B / O), improving the rationality of the tag sequence and thus outputting the optimal BIO tag sequence:

[0110] Tag space definition: A total of 15 tags (7 categories × 2 tags (B / I) + 1 non-entity tag O), where O is a general non-entity tag), denoted as... ;

[0111] Linear layer mapping: Mapping to the label space yields the log-probability of the label for each character. : in , For training parameters;

[0112] CRF transition matrix and score calculation:

[0113] Transition matrix : Indicates from the label Transferred to The score is based on BIO rule initialization. For example... (Encourage B→I) (B→B is prohibited).

[0114] Sequence score: Let the label sequence be... Then the sequence score formula is:

[0115] ;

[0116] in The starting label (fixed to " <start>(”);

[0117] ① Conditional probability and loss function:

[0118] Conditional probability: Given input X, the probability of label sequence y is:

[0119] ;

[0120] in Y is the normalization factor (Y is the set of all possible BIO tag sequences);

[0121] Loss function: Negative log-likelihood loss is used to minimize the negative probability of the true label sequence.

[0122] ;

[0123] Where N is the batch size. , The input text and the sequence of real BIO tags for the k-th cleaned sample.

[0124] The training parameters and metrics can be set as follows:

[0125] Optimizer: AdamW (weight decay 0.01, learning rate 5e-5, linear decay);

[0126] Batch Size: 32;

[0127] Epoch: 15 (Early stopping strategy, validation set F1 stops descending after 3 consecutive rounds);

[0128] Initial transition matrix A: Initialized according to the BIO rule (B→I: 2.0, B→O: 1.0, I→I: 1.5, I→O: 1.0, O→B: 2.0, the rest: -5.0);

[0129] BiLSTM layer: 1;

[0130] BiLSTM dim: 128;

[0131] max seq length: 512;

[0132] Dropout rate: 0.1;

[0133] To comprehensively consider model performance, precision, recall, and F1 score are used as evaluation metrics. The formulas for precision (P), recall (R), and F1 score are as follows:

[0134] ;

[0135] ;

[0136] ;

[0137] in, This refers to correctly identifying the number of tags for entities in a cybersecurity policy document. This refers to the number of tags that were incorrectly identified as entities in cybersecurity policy documents. This refers to the number of tags for entities in cybersecurity policy documents that have not been identified. It is the probability that a sample predicted as positive is actually positive. It is the probability of being predicted as a positive sample among all actually correct samples. let and At the same time, they reach their highest point and ultimately achieve equilibrium.

[0138] Please refer to Figure 3 As shown, in one embodiment of this application, the training process of the named entity recognition model further includes a dictionary model collaborative optimization step:

[0139] S301 mines entities not covered in the domain dictionary based on the prediction results of the model, and updates the domain dictionary with the uncovered entities;

[0140] S302 regenerates dictionary confidence features using the updated domain dictionary and fine-tunes the model.

[0141] Specifically, dictionary model collaborative optimization is an iterative process aimed at achieving rapid adaptation to newly added entities:

[0142] Dynamic dictionary updates: Based on the model's predictions on unlabeled data or newly added files, entity candidates not covered in the domain dictionary are identified. After manual review and confirmation, these new entities are added to the domain dictionary in a trie structure, and the relevant dictionary confidence parameters are reset.

[0143] Iterative model optimization: Using the updated domain dictionary, regenerate dictionary confidence features (matrix F) for the training data. Then, use the new features combined with the original data to adjust the model's fusion weights (W). F W G The model (isolinear layer parameters) and the transition matrix A of the CRF layer are fine-tuned to improve the accuracy of BIO annotation. This process can be repeated cyclically, allowing the model and dictionary to evolve together.

[0144] Overall, it can be used as a reference. Figure 4 As shown, the cybersecurity policy documents of the power monitoring system are used to generate a cybersecurity dictionary for the power monitoring system. The model is fine-tuned by using a dynamic dictionary update strategy, and the model prediction results are submitted for manual verification. The verification results are then used to update the cybersecurity dictionary for the power monitoring system.

[0145] In one embodiment of this application, the named entity recognition model sequentially includes: a feature fusion layer, used to fuse the text sequence features, domain dictionary confidence features, and text format marker features; an encoding layer, which uses a BERT-WWM-based pre-trained language model to encode the fused features; and a sequence labeling layer, which uses a BiLSTM-CRF model to perform sequence labeling on the encoded features and outputs the named entity recognition result.

[0146] Specifically, in practical applications, the named entity recognition model provided in this application adopts a five-level structure, with each level having a clear and collaborative function:

[0147] Input layer and feature fusion layer: Responsible for receiving and integrating three types of inputs: text sequence (character level), dictionary confidence features (character level "category-BIO tag" confidence), and format markup features (symbol / prefix / number markup), to form a fused embedding vector that takes into account both fine-grained features and domain knowledge.

[0148] Encoding layer (BERT-WWM): Based on the Transformer architecture, it captures long-distance contextual semantics and improves the deep semantic understanding of network security terminology in power monitoring systems.

[0149] Sequence Labeling Layer (BiLSTM-CRF): The BiLSTM component is used to strengthen the local dependencies of entity boundaries (such as "safe" followed by "partition" to form the term "safe partition"); the CRF component constrains the rationality of the output sequence through preset label transfer rules (such as B can only be followed by I or O), together solving the problem of ambiguous entity boundaries and outputting the optimal BIO label sequence.

[0150] Please refer to Figure 5 As shown, this application also provides a named entity recognition device for network security policy documents of power monitoring systems, including: a data acquisition module for acquiring policy text to be identified in the field of network security of power monitoring systems; and an analysis module for providing the policy text to be identified to a named entity recognition model pre-trained by fusing text sequence features, domain dictionary confidence features and text format mark features to obtain the corresponding named entity recognition result.

[0151] Since the specific implementation process of each component in the named entity recognition device of this application has been described in detail in the foregoing method embodiments, it will not be described in detail here.

[0152] This invention constructs and trains a named entity recognition model by integrating text sequence features, domain dictionary confidence features, and text format marker features, and introduces a dictionary model collaborative optimization mechanism, thereby bringing comprehensive and significant benefits: First, the model significantly improves the accuracy and recall rate of professional entity recognition in network security policy documents of power monitoring systems, especially for complex format entities such as "standard codes" and "document numbers," achieving complete and fragment-free accurate extraction; Second, thanks to the strong guidance of dictionary confidence and format markers, the model's determination of entity boundaries is more accurate, effectively solving the problems of long entity nesting and boundary ambiguity; Finally, the collaborative optimization mechanism enables the model to have continuous self-evolution capabilities, dynamically adapting to domain knowledge updates with low manual costs, greatly improving the long-term applicability and maintainability of the system in professional fields.

[0153] This application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-described method.

[0154] This application also provides a computer-readable storage medium storing a computer program that performs the above-described methods.

[0155] This application also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the above-described method.

[0156] like Figure 6 As shown, the electronic device 600 may also include: a communication module 110, an input unit 120, an audio processor 130, a display 160, and a power supply 170. It is worth noting that the electronic device 600 does not necessarily need to include these components. Figure 6 All components shown; in addition, the electronic device 600 may also include Figure 6 For components not shown, please refer to existing technologies.

[0157] like Figure 6 As shown, the central processing unit 100, sometimes also referred to as a controller or operating control, may include a microprocessor or other processor device and / or logic device. The central processing unit 100 receives inputs and controls the operation of various components of the electronic device 600.

[0158] The memory 140 may be, for example, one or more of a cache, flash memory, hard drive, removable media, volatile memory, non-volatile memory, or other suitable devices. It may store the aforementioned failure-related information, and also store a program for executing that information. The central processing unit 100 may execute the program stored in the memory 140 to perform information storage or processing, etc.

[0159] Input unit 120 provides input to central processing unit 100. Input unit 120 may be, for example, a keypad or touch input device. Power supply 170 provides power to electronic device 600. Display 160 displays images and text. Display may be, for example, an LCD display, but is not limited thereto.

[0160] The memory 140 can be a solid-state memory, such as a read-only memory (ROM), random access memory (RAM), a SIM card, etc. It can also be a memory that retains information even when power is off, can be selectively erased, and contains more data; examples of this type of memory are sometimes referred to as EPROMs. The memory 140 can also be some other type of device. The memory 140 includes a buffer memory 141 (sometimes referred to as a buffer). The memory 140 may include an application / function storage unit 142 for storing application programs and function programs or processes for executing the operation of the electronic device 600 via the central processing unit 100.

[0161] The memory 140 may also include a data storage unit (data 143) for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit (driver 144) of the memory 140 may include various drivers for the electronic device's communication functions and / or for performing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0162] The communication module 110 is a transmitter / receiver 110 that transmits and receives signals via antenna 111. The communication module (transmitter / receiver) 110 is coupled to the central processing unit 100 to provide input signals and receive output signals, which can be the same as in a conventional mobile communication terminal.

[0163] Based on different communication technologies, multiple communication modules 110 can be configured in the same electronic device, such as cellular network modules, Bluetooth modules, and / or wireless LAN modules. The communication module (transmitter / receiver) 110 is also coupled to a speaker 131 and a microphone 132 via an audio processor 130 to provide audio output via the speaker 131 and receive audio input from the microphone 132, thereby enabling typical telecommunications functions. The audio processor 130 may include any suitable buffer, decoder, amplifier, etc. Additionally, the audio processor 130 is coupled to a central processing unit 100, enabling on-device recording via the microphone 132 and on-device playback of stored audio via the speaker 131.

[0164] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0165] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0166] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0167] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0168] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of this application. It should be understood that the above descriptions are merely specific embodiments of this application and are not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.< / start>

Claims

1. A method for named entity recognition in network security policy documents for power monitoring systems, characterized in that, The method comprises: acquiring a to-be-recognized regulation text in the power monitoring system network security field; providing the to-be-recognized regulation text to a named entity recognition model pre-trained by fusing text sequence features, field dictionary confidence features and text format marking features for analysis to obtain corresponding named entity recognition results.

2. The method of claim 1, wherein, The field dictionary at least contains name, subject, document number, date, term, system device and standard code entity categories; the dictionary confidence features are obtained by calculating the confidence of each character in the training text belonging to the entity start label and the entity internal label under each entity category.

3. The method of claim 2, wherein, The power monitoring system network security field dictionary comprises: adopting a dictionary tree structure to store entity entries according to the entity categories; and marking the labels of the characters in the entries according to their positions in the entries to indicate the entity start, entity internal or non-entity.

4. The method of claim 2, wherein, The confidence of each character is calculated based on the ratio of the number of times the character appears as a B / I label of a specific category in the field dictionary to the total number of characters of the B / I label under the specific category.

5. The method of claim 1, wherein, The text format marking features include one or more of the following: symbol marking, used to identify professional symbols in the text; prefix marking, used to identify the first character of the entity prefix; number marking, used to identify number characters.

6. The method of claim 1, wherein, The named entity recognition model trained by fusing the text sequence features, field dictionary confidence features and text format marking features comprises: generating a fusion embedding vector by weighting and splicing the text sequence features, projected dictionary confidence features and projected text format marking features; training the named entity recognition model according to the fusion embedding vector through a neural network algorithm.

7. The method of claim 1, wherein, The training process of the named entity recognition model further comprises a dictionary model collaborative optimization step: mining uncovered entities in the field dictionary based on the prediction results of the model, updating the field dictionary with the uncovered entities; regenerating the dictionary confidence features with the updated field dictionary and fine-tuning the model.

8. The method of claim 1, wherein, The named entity recognition model comprises in sequence: a feature fusion layer for fusing the text sequence features, field dictionary confidence features and text format marking features; an encoding layer for encoding the fused features using a pre-trained language model based on BERT-WWM; a sequence labeling layer for sequence labeling the encoded features using a BiLSTM-CRF model to output the named entity recognition results. 9.A named entity recognition device for a power monitoring system cyber-security policy document, characterized in that, The method comprises: an acquisition module for acquiring a to-be-recognized regulation text in the power monitoring system network security field; an analysis module for providing the to-be-recognized regulation text to a named entity recognition model pre-trained by fusing text sequence features, field dictionary confidence features and text format marking features for analysis to obtain corresponding named entity recognition results.

10. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the method of any one of claims 1 to 8 when executing the computer program.

11. A computer readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the method of any one of claims 1 to 8.

12. A computer program product comprising computer programs / instructions, characterized in that, The computer program / instructions, when executed by the processor, implement the steps of the method of any one of claims 1 to 8.

Images