Enterprise security risk intelligent identification method based on large model and related device

Abstract

The invention discloses an enterprise security risk intelligent identification method based on a large model and a related device. The method comprises the steps of obtaining enterprise security risk data and performing data aggregation and fusion, calculating an enterprise security risk index of each enterprise, constructing an enterprise security risk intelligent analysis engine, and according to a natural language problem related to enterprise security proposed by a user, establishing an enterprise security risk intelligent analysis engine; and calling an interface corresponding to the security risk intelligent analysis engine to perform analysis query, and identifying the enterprise security risk based on a generated query result. According to the method, the enterprise security risk can be identified through multi-source data aggregation and fusion, multi-dimensional risk index calculation, a large-model intelligent analysis engine of domain knowledge enhancement and natural language interaction application, so that the data analysis threshold is reduced, second-level response is realized, and the risk identification accuracy is improved.

Description

Technical Field

[0001] This application relates to the field of enterprise security risk identification technology, specifically to the fields of multi-source data fusion, domain knowledge and large models, and particularly to an intelligent identification method and related device for enterprise security risks based on a large model. Background Technology

[0002] To implement national work safety plans, emergency management departments have established a multi-level regulatory information system, aggregating various data from hazardous chemical and industrial enterprises, covering aspects such as hazardous chemical information, dust explosion risks, risk and hazard records, and historical safety management records. However, in actual regulatory work, the large number and wide distribution of these enterprises, coupled with their fragmented, disorganized, and complex industry characteristics, present a series of challenges to work safety supervision. (1) The enterprises are scattered: the regulatory targets are numerous and widespread, and the number of regulatory personnel is limited, making it difficult to achieve comprehensive and timely coverage. The dynamic information on some enterprises is not adequately grasped. (2) The management foundation is “chaotic”: Some enterprises have irregular safety management and unclear risk and hidden danger information, resulting in frequent occurrences of “failure to report” and “omission or concealment”; (3) The types of risks are “diverse”: they involve various risk forms such as hazardous chemicals, dust, and special operations, which are difficult to identify and control, and place higher demands on the professional capabilities of regulatory personnel.

[0003] Currently, a combination of traditional BI platforms, data warehouses, and human services can help frontline regulators accurately identify safety risks under limited resources. However, existing data application models still have the following significant drawbacks: traditional BI tools have high technical barriers, preventing regulators from exploring them independently and hindering the full release of data value; they cannot cover the high-frequency and diverse temporary needs in regulatory scenarios, resulting in severe response delays; and they lack intelligent reasoning capabilities in the field of safety production.

[0004] Therefore, there is an urgent need for an intelligent enterprise security risk identification solution that can understand natural language and deeply integrate multi-source data and domain knowledge to solve the above-mentioned core pain points. Summary of the Invention

[0005] This application provides a method and related device for intelligent identification of enterprise security risks based on a large model, in order to solve the problems that traditional BI tools have high technical thresholds, which prevent regulators from exploring them directly and independently, making it difficult to fully release the value of data; they cannot cover the high-frequency and diverse temporary needs in regulatory scenarios, resulting in serious delays in response; and they lack intelligent reasoning capabilities in the field of safety production.

[0006] The technical solution is as follows: Firstly, a method for intelligent identification of enterprise security risks based on a large model is provided, including: The system acquires enterprise security risk data from multiple enterprises, processes the enterprise security risk data into a wide table for a thematic library, and integrates the data by associating it with relevant dictionary tables of the enterprises. Based on the preset enterprise dimension indicators and the corresponding calculation logic of each enterprise dimension indicator, the enterprise security risk index of each enterprise is calculated from the preset types of enterprise dimensions. Based on the results of data fusion and the enterprise security risk index of multiple enterprises, an enterprise security domain knowledge base is constructed. Then, through intelligent orchestration tools, a workflow for question-and-answer tasks is arranged on the enterprise security domain knowledge base and the preset large language model to construct an intelligent analysis engine for enterprise security risks. Based on the natural language questions raised by the user that are related to enterprise security, the corresponding interface of the security risk intelligent analysis engine is invoked to perform analysis and query, and enterprise security risks are identified based on the generated query results.

[0007] In one possible implementation, the enterprise security risk data includes: basic data characterizing inherent enterprise information and dynamic data characterizing enterprise regulatory data; The enterprise security risk data is processed into a wide table for a thematic library, and then fused with the data by associating it with relevant dictionary tables of the enterprise. Specifically, this includes: The basic data is processed into a basic data wide table, and the dynamic data is processed into a dynamic data wide table. The enterprise credit code is used as the associated field. Based on the enterprise-related dictionary table, the basic data wide table and the dynamic data wide table are associated, cleaned, integrated and transformed to obtain a readable subject library wide table.

[0008] In one possible implementation, an enterprise security knowledge base is constructed based on the results of data fusion and the enterprise security risk indices of multiple enterprises, specifically including: By vectorizing domain terminology, the results of data fusion and domain knowledge from enterprise security risk indices of multiple enterprises are semantically vectorized to obtain a semantic knowledge base. The results of data fusion and the schema information in the enterprise security risk index of multiple enterprises are processed into table structure knowledge vectorization to obtain a table structure knowledge base. The data fusion results and the business rule information in the enterprise security risk index of multiple enterprises are processed into a business rule knowledge base by vectorizing the business rule knowledge. A knowledge base for enterprise security is constructed based on a semantic knowledge base, a table structure knowledge base, and a business rule knowledge base.

[0009] In one possible implementation, an intelligent orchestration tool is used to orchestrate the workflow of question-and-answer tasks on the enterprise security domain knowledge base and a preset large language model, thereby constructing an intelligent analysis engine for enterprise security risks. Specifically, this includes: Intent parsing: Design natural language commands, utilize a pre-defined large language model to perform intent parsing and domain terminology alignment from the enterprise security domain knowledge base, and convert them into query elements; Task planning: Based on the query elements, task planning is performed, and an executable SQL question-and-answer task is generated through an intelligent orchestration tool; Task execution: Execute the SQL question-and-answer task within a secure execution environment. Tasks are orchestrated according to the workflow of intent parsing, task planning, and task execution to build an intelligent analysis engine for enterprise security risks.

[0010] In one possible implementation, the enterprise security domain knowledge base includes: a semantic knowledge layer, a structural knowledge layer, and a business rules layer.

[0011] In one possible implementation, based on a natural language question raised by the user related to enterprise security, the corresponding interface of the security risk intelligent analysis engine is invoked to perform analysis and query, and enterprise security risks are identified based on the generated query results, specifically including: Receiving natural language questions related to enterprise security through a user interface; Call the interface corresponding to the security risk intelligent analysis engine to analyze and query the natural language question, and generate query results; The data and charts in the query results are visualized using the echarts component; The results of the visualization are returned to the large language model for text extraction to generate an enterprise security risk identification report.

[0012] In one possible implementation, the interfaces corresponding to the security risk intelligent analysis engine include at least: a chat dialogue interface, a page turning and download interface, a historical dialogue list interface, a historical dialogue deletion interface, a parameter configuration acquisition interface, and a historical message details acquisition interface.

[0013] In one possible implementation, the basic data includes: a basic enterprise information table, an enterprise business address table, an enterprise national economic classification table, an enterprise safety management information table, an enterprise industry regulatory information table, an enterprise label table, an inspection / self-inspection plan table, and a dictionary table; The dynamic data includes: enterprise reporting information form, enterprise risk list form, QR code inspection / self-inspection record form, and QR code inspection / self-inspection potential hazard form.

[0014] In one possible implementation, the enterprise dimensions of the preset type include at least: personnel dimension, material and environment dimension, management dimension, environment and risk dimension, regulatory dimension, and safety performance dimension; Each dimension contains multiple enterprise-specific indicators and is assigned corresponding weights, which are used to calculate the enterprise security risk index for each enterprise through weighted average.

[0015] Secondly, a large-scale model-based intelligent identification device for enterprise security risks is provided, including: The acquisition module is used to acquire enterprise security risk data from multiple enterprises, process the enterprise security risk data into a wide table of thematic library, and perform data fusion by associating it with relevant dictionary tables of the enterprises; The calculation module is used to calculate the enterprise security risk index of each enterprise from the preset enterprise dimension based on the preset enterprise dimension indicators and the calculation logic corresponding to each enterprise dimension indicator. The orchestration module is used to build an enterprise security domain knowledge base based on the results of data fusion and the enterprise security risk index of multiple enterprises. It also uses an intelligent orchestration tool to orchestrate the workflow of question-and-answer tasks on the enterprise security domain knowledge base and a preset large language model to build an intelligent analysis engine for enterprise security risks. The identification module is used to call the corresponding interface of the security risk intelligent analysis engine to perform analysis and query based on the natural language questions raised by the user that are related to enterprise security, and to identify enterprise security risks based on the generated query results.

[0016] Thirdly, an electronic device is provided, comprising: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the methods described above and any possible implementations.

[0017] Fourthly, a computer-readable storage medium is provided, wherein at least one instruction is stored therein, the at least one instruction being loaded and executed by a processor to implement the aspects described above and any possible implementation thereof.

[0018] Fifthly, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the aspects and any possible implementations described above.

[0019] The beneficial effects of the technical solution provided in this application include at least the following: As can be seen from the above technical solution, the embodiments of this application can acquire and aggregate enterprise security risk data, calculate the enterprise security risk index for each enterprise, construct an intelligent analysis engine for enterprise security risks, and, based on natural language questions raised by users related to enterprise security, call the corresponding interface of the intelligent analysis engine for analysis and query, and identify enterprise security risks based on the generated query results. This application can achieve the identification of enterprise security risks through multi-source data aggregation and fusion, multi-dimensional risk index calculation, domain knowledge-enhanced intelligent analysis engine, and natural language interactive applications, thereby lowering the data analysis threshold, achieving second-level response, and improving the accuracy of risk identification.

[0020] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent from the following description. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a schematic diagram of the steps of the intelligent identification method for enterprise security risks based on a large model provided in the embodiments of this application.

[0023] Figure 2 This is a schematic diagram of the intelligent identification process for enterprise security risks based on a large model, provided in an embodiment of this application.

[0024] Figure 3 This is a schematic diagram of the visualization recognition results of a combination of a data list and histogram of all furnace-related enterprises in the province, provided in one embodiment of this application.

[0025] Figure 4 This is a structural block diagram of an enterprise security risk intelligent identification device based on a large model, provided in another embodiment of this application.

[0026] Figure 5 This is a block diagram of the electronic device provided in the embodiments of this application. Detailed Implementation

[0027] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of this application, including various details to aid understanding. These embodiments should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this application. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0028] Obviously, the described embodiments are only some, not all, of the embodiments in this application. All other embodiments obtained by those skilled in the art based on the embodiments in this application without inventive effort are within the scope of protection of this application.

[0029] It should be noted that the terminal devices involved in the embodiments of this application may include, but are not limited to, smart devices such as mobile phones, personal digital assistants (PDAs), wireless handheld devices, and tablet computers; the display devices may include, but are not limited to, personal computers, televisions, and other devices with display functions.

[0030] Furthermore, the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0031] In view of the technical problems existing in the prior art, this application constructs an intelligent risk identification solution that is "thinking, able to communicate, and understands business." Its main inventive concept lies in: acquiring and aggregating enterprise security risk data, calculating the enterprise security risk index for each enterprise, constructing an intelligent enterprise security risk analysis engine, and calling the corresponding interface of the intelligent security risk analysis engine to perform analysis and query based on the user's natural language questions related to enterprise security, and identifying enterprise security risks based on the generated query results. This application can identify enterprise security risks through multi-source data aggregation and fusion, multi-dimensional risk index calculation, domain knowledge-enhanced intelligent analysis engine, and natural language interactive applications, thereby lowering the data analysis threshold, achieving millisecond-level response, and improving the accuracy of risk identification.

[0032] Reference Figure 1 The diagram shown illustrates the steps of the intelligent identification method for enterprise security risks based on a large model provided in this application embodiment. Figure 1 As shown, the method may include the following steps: Step 102: Obtain enterprise security risk data from multiple enterprises, process the enterprise security risk data into a wide table of thematic library, and perform data fusion by associating it with relevant dictionary tables of the enterprises.

[0033] In this application's solution, enterprise security risk data can be obtained from multiple channels, specifically through database access, file access, interface access, streaming access, etc., to uniformly access and obtain enterprise security-related data such as internal emergency data, external department data, social and internet data, and perception data. It should be noted that this application does not limit the access method or access point.

[0034] Optionally, the enterprise security risk data includes: basic data representing inherent enterprise information and dynamic data representing enterprise supervision. Accordingly, when processing the enterprise security risk data into a broad table of thematic libraries and performing data fusion by associating it with enterprise-related dictionary tables, the basic data can be processed into a broad table of basic data, and the dynamic data can be processed into a broad table of dynamic data. Using the enterprise credit code as the associated field, the broad tables of basic data and dynamic data are associated, cleaned, integrated, and transformed based on enterprise-related dictionary tables to obtain a readable broad table of thematic libraries.

[0035] The basic data includes: enterprise basic information table, enterprise business address table, enterprise national economic classification table, enterprise safety management information table, enterprise industry regulatory information table, enterprise label table, inspection / self-inspection plan table, and dictionary table; the dynamic data includes: enterprise reported information table, enterprise risk list table, barcode inspection / self-inspection record table, and barcode inspection / self-inspection hidden danger table.

[0036] Specifically, for the basic data, it can be processed into a large broad table of enterprise basic data. Specifically, using the enterprise credit code as the main linking field, the enterprise basic information table, enterprise business address table, enterprise national economic classification table, enterprise safety management information table, enterprise industry regulatory information table, enterprise label table, and inspection / self-inspection plan table are processed into a large broad table of enterprise basic data subject library. Simultaneously, it is linked with a dictionary table, converting the dictionary codes of related data such as business dictionaries involved in the basic data into specific dictionary values.

[0037] For dynamic data, it can be processed into a wide table of enterprise dynamic data. Specifically, with the enterprise credit code as the main associated field, the enterprise reported information table, enterprise risk list table, barcode inspection / self-inspection record table, and barcode inspection / self-inspection hidden danger table are processed into a wide table of enterprise dynamic data subject library, and associated with the dictionary table, converting the dictionary codes of business dictionaries and other related data involved in the dynamic data into specific dictionary values.

[0038] In practice, data governance technologies such as ETL and data modeling can be used to deeply integrate and correlate security risk data tables to build a subject-oriented, unified data view.

[0039] For example, a unified data view ultimately forms a thematic library with "enterprise-risk-inspection-potential" as the core relationship, ensuring that all other related data can be quickly retrieved from the business entity.

[0040] Core table integration: The main report table serves as the backbone, and is linked with tables such as enterprise information, risk list, inspection records, and hazard records through key fields such as ID and historical snapshot ID.

[0041] Dictionary table association and integration: The business table is associated with general dictionaries, risk directories and other dictionary tables, and the code values ​​are transformed into understandable standard business terms to support natural language understanding.

[0042] Step 104: Based on the preset enterprise dimension indicators and the calculation logic corresponding to each enterprise dimension indicator, calculate the enterprise security risk index of each enterprise from the preset type of enterprise dimension.

[0043] Optionally, the preset enterprise dimensions include at least: personnel dimension, material and environment dimension, management dimension, environment and risk dimension, regulatory dimension, and safety performance dimension; wherein each dimension contains multiple enterprise dimension indicators and is assigned corresponding weights, so as to obtain the enterprise safety risk index of each enterprise through weighted calculation.

[0044] The Enterprise Safety Risk Index is calculated as follows: Personnel Dimension Weight Value * (Sum of all personnel dimension indicators) + Materials and Environment Dimension Weight Value * (Sum of all materials and environment dimension indicators) + Management Dimension Weight Value * (Sum of all management dimension indicators) + Environment and Risk Dimension Weight Value * (Sum of all environment and risk dimension indicators) + Regulatory Dimension Weight Value * (Sum of all regulatory dimension indicators) + Safety Performance Dimension Weight Value * (Sum of all safety performance dimension indicators). This application's calculated Enterprise Safety Risk Index can more accurately reflect an enterprise's overall risk situation.

[0045] Referring to Table 1, the preset types of enterprise dimensions, enterprise dimension indicators, and weights are shown. This is just an example, and the dimension types, dimension indicators, and weights in this table can be adjusted according to different enterprises or evaluation needs.

[0046] Table 1 Step 106: Based on the data fusion results and the enterprise security risk indices of multiple enterprises, construct an enterprise security domain knowledge base, and use an intelligent orchestration tool to orchestrate the workflow of question-and-answer tasks on the enterprise security domain knowledge base and the preset large language model to construct an intelligent analysis engine for enterprise security risks.

[0047] In this application, the core of the enterprise safety risk intelligent analysis engine lies in constructing an intelligent data system centered on an intelligent agent enhanced with knowledge in the enterprise's safety production domain. This system uses an intelligent agent orchestration tool to orchestrate the workflow of LLM, domain knowledge base, and specialized tools, achieving end-to-end automated processing of user natural language commands.

[0048] Optionally, when constructing an enterprise security knowledge base based on the results of data fusion and the enterprise security risk indices of multiple enterprises, the following can be specifically considered: (1) By vectorizing the domain terminology, the results of data fusion and domain knowledge in the enterprise security risk index of multiple enterprises are processed into semantic knowledge vectorization to obtain a semantic knowledge base.

[0049] Specifically, by vectorizing domain terminology, discrete "vocabularies" can be transformed into points in a continuous semantic space, enabling large models to deeply understand the true meanings of "professional domain business terms, synonyms, abbreviations, and full names." By employing optimized embedding models (such as text-embedding-v4), knowledge from business terminology, data pattern descriptions, and complex business rules can be transformed into a unified high-dimensional vector representation, effectively improving the accuracy of semantic understanding.

[0050] (2) The results of the data fusion and the schema information in the enterprise security risk index of multiple enterprises are processed into table structure knowledge vectorization to obtain a table structure knowledge base.

[0051] Specifically, database schema information, including table structure, field meanings, and inter-table relationships, can be constructed into a vector library. By using specific prompt word templates to convert the "table-field-relationship" related table structure information into natural language descriptions, and then embedding these into vectors, the system can better understand user intent and more accurately locate the required data table.

[0052] (3) The business rule knowledge base is obtained by vectorizing the results of data fusion and business rule information in the enterprise security risk index of multiple enterprises.

[0053] Specifically, embodiments of this application can encapsulate judgment rules for complex business logic. Each business rule (including its judgment conditions, logical operators, and output results) is transformed into structured natural language description text and then vectorized. This allows large models to retrieve and understand business rules as if they were searching for documents when generating queries or performing analyses, thereby ensuring the accuracy of the analysis logic.

[0054] For example, the above rule on failure to report should have been reported can be translated into text as follows: "Rule 1: Determine whether an enterprise has failed to report. The conditions are: the enterprise's report status is 'not submitted', and the current time has exceeded the prescribed reporting deadline. If both conditions are met, it is determined as 'yes'." For example, the risk index level definition rule is: IF (overall risk index >= threshold 1) THEN the level is 'A' ELSE (overall risk index >= threshold 2 and overall risk index <= threshold 3), the level is 'B', and so on.

[0055] (4) Construct an enterprise security domain knowledge base based on semantic knowledge base, table structure knowledge base and business rule knowledge base.

[0056] Specifically, the high-performance, high-recall vector database Weaviate can be used to store and efficiently retrieve the vector data transformed from the above three knowledge types. Based on the user's question, the system first quickly and initially retrieves a large number of potentially relevant documents or paragraphs from multiple knowledge bases. Then, the gte-rerank-v2 model is used to perform a fine-grained secondary sorting of the retrieved knowledge results, identifying the top N most relevant and relevant results. Through a cross-encoder, gte-rerank-v2 enables deeper semantic understanding and context matching, accurately identifying complex logic in business rules (such as "unreported but should have been reported"), ensuring the return of the most relevant and accurate knowledge fragments.

[0057] The enterprise security knowledge base comprises a semantic knowledge layer, a structural knowledge layer, and a business rule layer. The semantic knowledge layer includes business terminology, dictionaries, synonyms, abbreviations, and full names. The structural knowledge layer contains the database schema information, including table structure, field meanings, and inter-table relationships. The business rule layer encapsulates judgment rules for complex business logic. For example, the business logic for "unreported but not yet reported" is defined as: checking if an enterprise's report status is "not submitted" within a specific defined time period and the stipulated reporting deadline has passed.

[0058] Optionally, when constructing an intelligent enterprise security risk analysis engine by orchestrating the workflow of question-and-answer tasks using intelligent orchestration tools on the enterprise security domain knowledge base and the preset large language model, the specific steps may include: Step 1, Intent Resolution: Design natural language instructions, use a preset large language model to perform intent resolution and domain terminology alignment from the enterprise security domain knowledge base, and convert them into query elements.

[0059] In this application, the professional brain of the large-scale intelligent model can intelligently retrieve enterprise security knowledge bases based on user natural language questions, combined with RAG technology, and transmit the knowledge retrieved from the professional domain to the large-scale model, thereby improving the large-scale model's business understanding capabilities. Users can input commands through a natural language interface, such as "query a list of all furnace-related enterprises in Nanjing and count the number by district".

[0060] Intent understanding: The agent calls the Large Language Model (LLM) to perform deep semantic parsing of user commands, and identifies core intents (e.g., query, statistics), entities (e.g., Nanjing City, furnace-related enterprises), and operations (statistics by district).

[0061] Domain terminology alignment: The agent, in conjunction with an enterprise security domain knowledge base, precisely aligns users' colloquial and vague expressions to structured concepts that the model can understand. For example, it aligns "furnace-related enterprises" to the record in the enterprise_industry_category table of the database where the furnace_enterprise_flag field is '1', ensuring that user intent is translated unambiguously into precise query elements.

[0062] Step 2, Task Planning: Based on the query elements, perform task planning and generate executable SQL question-and-answer tasks using intelligent orchestration tools.

[0063] Based on the parsed intent, task planning is performed, and the NL2SQL tool is invoked autonomously.

[0064] Task planning: Break down complex instructions into subtasks a, b, and c, such as: a) Filter Nanjing enterprises from the enterprise table; b) Link industry tables to filter furnace-related enterprises; c) Group and count by region field.

[0065] SQL generation and optimization: The NL2SQL module utilizes the code generation capabilities of LLM and deeply integrates relevant schema information and business rules retrieved in real time from the domain knowledge base to generate SQL statements.

[0066] SQL automated validation: First, it performs a syntax validity check to ensure the statement can be correctly parsed by the database; second, it intercepts any illegal statements containing write operations such as UPDATE and DELETE to prevent injection risks. Only statements that pass all validations are allowed to enter the execution phase, building a solid security defense from the source.

[0067] Step 3, Task Execution: Execute the SQL question-and-answer task in a secure execution environment.

[0068] Secure execution: The generated SQL statements are executed in a secure SQL execution environment to query the relevant database and obtain the result set.

[0069] Result Assembly: The intelligent agent automatically invokes data visualization tools based on implicit or explicit visualization requirements (such as statistics) in user instructions. These tools intelligently select the most suitable chart type (such as bar charts or pie charts) based on the data characteristics (categorical data, numerical data) and business scenario of the result set, and automatically generate the configuration data required for front-end rendering.

[0070] Step 4: Organize tasks according to the workflow of intent parsing, task planning, and task execution to build an intelligent analysis engine for enterprise security risks.

[0071] This can be achieved using various agent orchestration tools, such as dify and fastgpt.

[0072] Step 108: Based on the natural language questions related to enterprise security raised by the user, call the corresponding interface of the security risk intelligent analysis engine to perform analysis and query, and identify enterprise security risks based on the generated query results.

[0073] Optionally, when calling the interface corresponding to the security risk intelligent analysis engine to perform analysis and query based on the natural language questions raised by the user related to enterprise security, and identifying enterprise security risks based on the generated query results, the specific steps may include: The first step is to receive natural language questions related to enterprise security through the user interface.

[0074] The second step is to call the interface corresponding to the security risk intelligent analysis engine to analyze and query the natural language problem and generate query results.

[0075] The interfaces corresponding to the security risk intelligent analysis engine include at least: chat dialogue interface, page turning and download interface, historical dialogue list interface, delete historical dialogue interface, get parameter configuration interface, and get historical message details interface.

[0076] The third step is to use the echarts component to visualize the data and charts in the query results.

[0077] The fourth step is to return the visualization results to the large language model for text extraction and generate an enterprise security risk identification report.

[0078] Reference Figure 2The diagram shown is a schematic of the intelligent identification process for enterprise security risks based on a large model provided in an embodiment of this application.

[0079] Step 202: Obtain enterprise security risk data and perform data aggregation and fusion.

[0080] Step 204: Calculate the enterprise security risk index for each enterprise.

[0081] Step 206: Build an intelligent analysis engine for enterprise security risks.

[0082] Step 208: The user asks a question in natural language.

[0083] Specifically, the user's natural language questioning feature supports entry points for previous, new, and historical conversations, as well as text input and speech-to-text input for natural language-related questions. For example, a user could ask, "Help me find companies with high risk indices and analyze which of them should have reported but failed to do so." These companies can then be identified as key targets for supervision, allowing for on-site enforcement and other methods to monitor their rectification efforts, thus lowering the barrier to data analysis for law enforcement personnel.

[0084] Step 210: Call the relevant interfaces of the enterprise security risk intelligent analysis engine.

[0085] By calling the relevant interfaces provided by the enterprise security risk intelligent analysis engine, a conversational enterprise security risk intelligent discovery application function is realized. Specific interfaces include: chat dialogue interface, page turning and download interface, historical dialogue list interface, delete historical dialogue interface, get parameter configuration interface, and get historical message details interface, etc.

[0086] Step 212: Result generation and visualization.

[0087] Specifically, the acquired raw data can be processed. If the user's instruction includes visualization requirements (such as "display with a bar chart"), the agent will invoke the data visualization module. This module automatically generates configuration code based on data characteristics and instruction requirements, and encapsulates the data into a format suitable for front-end chart rendering. The system then uses the ECharts component to visualize the data based on the data characteristics and chart type (such as bar chart or pie chart) of the result set. For example, refer to... Figure 3 The diagram shows a visualization of the identification results of a combination of a data list and histograms of furnace-related enterprises in a certain province.

[0088] Step 214: Intelligent analysis generates a summary report.

[0089] Specifically, the returned results can leverage the natural language generation capabilities of LLM to comprehensively analyze the query results data and visualization charts, generating concise and easy-to-understand text summaries, and extracting key content to form a summary report. It also supports paginated queries, data download and export to Excel, viewing and managing historical conversations, and creating new conversations.

[0090] This application embodiment integrates and calculates enterprise security risk indices by fusing multi-source data such as basic enterprise information, risk lists, and dynamic inspection / hazard records. It applies RAG technology to the NL2SQL process, retrieving and injecting relevant knowledge base content in real-time during SQL generation, thus improving the accuracy and reliability of SQL statement generation in complex business scenarios. Simultaneously, it seamlessly integrates enterprise security risk intelligent analysis engine capabilities, enhancing the level of intelligent identification of enterprise security risks.

[0091] In addition, this application may also have the following technical effects: To address the challenges of regulatory coverage arising from the dispersed nature of enterprises, this application establishes a unified enterprise safety risk index calculation model. It constructs a unified risk metric covering all enterprises, and by calculating the enterprise safety risk index across the entire region, it achieves a unified perception and precise ranking of the risk levels of all enterprises, providing a core basis for differentiated regulation. To address the issues of disorganized enterprise management and unclear risk profiles, this application achieves a breakthrough by enabling real-time queries of complex business data using natural language, completely freeing non-technical personnel from complex database query syntax. This allows regulatory personnel to analyze enterprise data reporting through natural language, promptly identify enterprises that have failed to report required information or have omitted or concealed information, and take timely regulatory measures to improve enterprise security. Addressing the challenges of diverse risk types and the excessive reliance on specialized capabilities in traditional regulatory methods, this application, based on integrated enterprise foundational and dynamic data and risk index data, and deeply integrating large-scale model intelligent analysis capabilities, constructs a subsystem for "Intelligent Discovery Application of Enterprise Security Risks" (i.e., the implementation of step 108, or the implementation of steps 208-214, echoing the following...). Figure 4 The system, with its identification module 404, can automatically understand, associate, and analyze various complex risk patterns such as hazardous chemicals, dust, and special operations, effectively reducing over-reliance on personal experience and improving the intelligence level of the regulatory system.

[0092] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0093] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0094] Figure 4 This invention provides a structural block diagram of an enterprise security risk intelligent identification device based on a large model, as shown in one embodiment of the present application. Figure 4 As shown. The enterprise security risk intelligent identification device 400 based on a large model in this embodiment may include an acquisition module 401, a calculation module 402, an arrangement module 403, and an identification module 404. The acquisition module 401 is used to acquire enterprise security risk data from multiple enterprises, process the enterprise security risk data into a large-scale table of a topic library, and perform data fusion by associating it with enterprise-related dictionary tables. The calculation module 402 is used to calculate the enterprise security risk index for each enterprise from preset enterprise dimension indicators and the calculation logic corresponding to each enterprise dimension indicator. The arrangement module 403 is used to construct an enterprise security domain knowledge base based on the data fusion results and the enterprise security risk indices of multiple enterprises, and to arrange the workflow of question-and-answer tasks on the enterprise security domain knowledge base and the preset large-scale language model using an intelligent arrangement tool to construct an enterprise security risk intelligent analysis engine. The identification module 404 is used to call the interface corresponding to the security risk intelligent analysis engine to perform analysis and query based on the natural language questions related to enterprise security raised by the user, and identify enterprise security risks based on the generated query results.

[0095] Optionally, in one possible implementation of this embodiment, the enterprise security risk data includes: basic data representing inherent enterprise information and dynamic data representing enterprise supervision; when the acquisition module 401 processes the enterprise security risk data into a wide table of thematic libraries and performs data fusion by associating it with enterprise-related dictionary tables, it is specifically used to process the basic data into a wide table of basic data and the dynamic data into a wide table of dynamic data, using the enterprise credit code as the associated field, and to associate, clean, integrate, and transform the wide table of basic data and the wide table of dynamic data based on the enterprise-related dictionary tables to obtain a readable wide table of thematic libraries.

[0096] Optionally, in one possible implementation of this embodiment, the orchestration module 403, when constructing an enterprise security domain knowledge base based on the results of data fusion and the enterprise security risk indices of multiple enterprises, is specifically used to extract semantic knowledge from the results of data fusion and the enterprise security risk indices of multiple enterprises; and to construct a structured enterprise security domain knowledge base based on the semantic knowledge combined with the business logic related to enterprise security.

[0097] Optionally, in one possible implementation of this embodiment, when the orchestration module 403 orchestrates the workflow of question-and-answer tasks using the enterprise security domain knowledge base and the preset large language model through an intelligent orchestration tool to build an intelligent analysis engine for enterprise security risks, it specifically performs the following: intent parsing: designing natural language instructions, using the preset large language model to perform intent parsing and domain terminology alignment from the enterprise security domain knowledge base, and converting them into query elements; task planning: performing task planning based on the query elements, and generating executable SQL question-and-answer tasks through the intelligent orchestration tool; task execution: executing the SQL question-and-answer tasks in a secure execution environment; and orchestrating tasks according to the workflow of intent parsing, task planning, and task execution to build an intelligent analysis engine for enterprise security risks.

[0098] Optionally, in one possible implementation of this embodiment, the enterprise security domain knowledge base includes: a semantic knowledge layer, a structural knowledge layer, and a business rules layer.

[0099] Optionally, in one possible implementation of this embodiment, when the identification module 404 calls the interface corresponding to the security risk intelligent analysis engine to perform analysis and query based on the natural language questions related to enterprise security raised by the user, and identifies enterprise security risks based on the generated query results, it is specifically used to receive natural language questions related to enterprise security based on the user interface; call the interface corresponding to the security risk intelligent analysis engine to analyze and query the natural language questions, and generate query results; visualize the data and icons in the query results through the ECharts component; and return the visualized results to the large language model for text extraction to generate an enterprise security risk identification report.

[0100] Optionally, in one possible implementation of this embodiment, the interfaces corresponding to the security risk intelligent analysis engine include at least: a chat dialogue interface, a page turning and download interface, a historical dialogue list interface, a historical dialogue deletion interface, a parameter configuration acquisition interface, and a historical message details acquisition interface.

[0101] Optionally, in one possible implementation of this embodiment, the basic data includes: a basic enterprise information table, an enterprise business address table, an enterprise national economic classification table, an enterprise safety management information table, an enterprise industry regulatory information table, an enterprise label table, an inspection / self-inspection plan table, and a dictionary table; the dynamic data includes: an enterprise reporting information table, an enterprise risk list table, a barcode inspection / self-inspection record table, and a barcode inspection / self-inspection hazard table.

[0102] Optionally, in one possible implementation of this embodiment, the preset type of enterprise dimensions includes at least: personnel dimension, material and environment dimension, management dimension, environment and risk dimension, regulatory dimension and safety performance dimension; wherein, each dimension contains multiple enterprise dimension indicators and is assigned corresponding weights, so as to obtain the enterprise safety risk index of each enterprise through weighted calculation.

[0103] In this embodiment, enterprise security risk data can be acquired and aggregated to calculate the enterprise security risk index for each enterprise, constructing an intelligent enterprise security risk analysis engine. Based on natural language questions related to enterprise security raised by users, the corresponding interface of the intelligent security risk analysis engine is invoked for analysis and querying, and enterprise security risks are identified based on the generated query results. This application can achieve enterprise security risk identification through multi-source data aggregation and fusion, multi-dimensional risk index calculation, domain knowledge-enhanced intelligent analysis engine, and natural language interactive applications, lowering the data analysis threshold, achieving second-level response, and improving the accuracy of risk identification.

[0104] One embodiment of this application provides a computer-readable storage medium storing at least one instruction, which is loaded and executed by a processor to implement the enterprise security risk intelligent identification method based on a large model as described above.

[0105] One embodiment of this application provides an electronic device, which includes a processor and a memory. The memory stores at least one instruction, which is loaded and executed by the processor to implement the enterprise security risk intelligent identification method based on a large model as described above.

[0106] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solution of this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0107] Figure 5A schematic block diagram of an example electronic device 500 that can be used to implement embodiments of this application is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the application described and / or claimed herein.

[0108] like Figure 5 As shown, the electronic device 500 includes a computing unit 501, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 502 or a computer program loaded from a storage unit 508 into a random access memory (RAM) 503. The RAM 503 may also store various programs and data required for the operation of the electronic device 500. The computing unit 501, ROM 502, and RAM 503 are interconnected via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0109] Multiple components in electronic device 500 are connected to I / O interface 505, including: input unit 506, such as keyboard, mouse, etc.; output unit 507, such as various types of monitors, speakers, etc.; storage unit 508, such as disk, optical disk, etc.; and communication unit 509, such as network card, modem, wireless transceiver, etc. Communication unit 509 allows electronic device 500 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0110] The computing unit 501 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 501 performs the various methods and processes described above, such as the large-model-based intelligent identification method for enterprise security risks. For example, in some embodiments, the large-model-based intelligent identification method for enterprise security risks can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 508. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 500 via ROM 502 and / or communication unit 509. When the computer program is loaded into RAM 503 and executed by the computing unit 501, one or more steps of the large-model-based intelligent identification method for enterprise security risks described above can be performed. Alternatively, in other embodiments, computing unit 501 may be configured by any other suitable means (e.g., by means of firmware) to perform a large-model-based intelligent identification method for enterprise security risks.

[0111] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include: implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transferring data and instructions to the storage system, at least one input device, and at least one output device.

[0112] The program code used to implement the methods of this application may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0113] In the context of this application, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0114] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0115] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0116] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0117] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this application can be achieved, and this is not limited herein.

[0118] The specific embodiments described above do not constitute a limitation on the scope of protection of this application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for intelligent identification of enterprise security risks based on a large model, characterized in that, include: The system acquires enterprise security risk data from multiple enterprises, processes the enterprise security risk data into a wide table for a thematic library, and integrates the data by associating it with relevant dictionary tables of the enterprises. Based on the preset enterprise dimension indicators and the corresponding calculation logic of each enterprise dimension indicator, the enterprise security risk index of each enterprise is calculated from the preset types of enterprise dimensions. Based on the results of data fusion and the enterprise security risk index of multiple enterprises, an enterprise security domain knowledge base is constructed. Then, through intelligent orchestration tools, a workflow for question-and-answer tasks is arranged on the enterprise security domain knowledge base and the preset large language model to construct an intelligent analysis engine for enterprise security risks. Based on the natural language questions raised by the user that are related to enterprise security, the corresponding interface of the security risk intelligent analysis engine is invoked to perform analysis and query, and enterprise security risks are identified based on the generated query results.

2. The method as described in claim 1, characterized in that, The enterprise security risk data includes: basic data characterizing the inherent information of the enterprise and dynamic data characterizing the enterprise's regulatory activities; The enterprise security risk data is processed into a wide table for a thematic library, and then fused with the data by associating it with relevant dictionary tables of the enterprise. Specifically, this includes: The basic data is processed into a basic data wide table, and the dynamic data is processed into a dynamic data wide table. The enterprise credit code is used as the associated field. Based on the enterprise-related dictionary table, the basic data wide table and the dynamic data wide table are associated, cleaned, integrated and transformed to obtain a readable subject library wide table.

3. The method as described in claim 1, characterized in that, A knowledge base for enterprise security is constructed based on the results of data fusion and enterprise security risk indices from multiple companies, specifically including: By vectorizing domain terminology, the results of data fusion and domain knowledge from enterprise security risk indices of multiple enterprises are semantically vectorized to obtain a semantic knowledge base. The results of data fusion and the schema information in the enterprise security risk index of multiple enterprises are processed into table structure knowledge vectorization to obtain a table structure knowledge base. The data fusion results and the business rule information in the enterprise security risk index of multiple enterprises are processed into a business rule knowledge base by vectorizing the business rule knowledge. A knowledge base for enterprise security is constructed based on a semantic knowledge base, a table structure knowledge base, and a business rule knowledge base.

4. The method as described in claim 3, characterized in that, By using intelligent orchestration tools to orchestrate the workflow of question-and-answer tasks on the enterprise security domain knowledge base and the preset large language model, an intelligent analysis engine for enterprise security risks is constructed, specifically including: Intent parsing: Design natural language commands, utilize a pre-defined large language model to perform intent parsing and domain terminology alignment from the enterprise security domain knowledge base, and convert them into query elements; Task planning: Based on the query elements, task planning is performed, and an executable SQL question-and-answer task is generated through an intelligent orchestration tool; Task execution: Execute the SQL question-and-answer task within a secure execution environment. Tasks are orchestrated according to the workflow of intent parsing, task planning, and task execution to build an intelligent analysis engine for enterprise security risks.

5. The method as described in claim 4, characterized in that, The enterprise security knowledge base includes: a semantic knowledge layer, a structural knowledge layer, and a business rules layer.

6. The method as described in claim 1, characterized in that, Based on the natural language questions related to enterprise security raised by the user, the corresponding interface of the intelligent security risk analysis engine is invoked to perform analysis and query, and enterprise security risks are identified based on the generated query results, specifically including: Receiving natural language questions related to enterprise security through a user interface; Call the interface corresponding to the security risk intelligent analysis engine to analyze and query the natural language question, and generate query results; The data and charts in the query results are visualized using the echarts component; The results of the visualization are returned to the large language model for text extraction to generate an enterprise security risk identification report.

7. The method as described in claim 6, characterized in that, The interfaces corresponding to the security risk intelligent analysis engine include at least: chat dialogue interface, page turning and download interface, historical dialogue list interface, delete historical dialogue interface, get parameter configuration interface, and get historical message details interface.

8. The method according to any one of claims 1-7, characterized in that, The basic data includes: enterprise basic information table, enterprise business address table, enterprise national economic classification table, enterprise safety management information table, enterprise industry regulatory information table, enterprise label table, inspection / self-inspection plan table, and dictionary table; The dynamic data includes: enterprise reporting information form, enterprise risk list form, QR code inspection / self-inspection record form, and QR code inspection / self-inspection potential hazard form.

9. The method according to any one of claims 1-7, characterized in that, The enterprise dimensions of the preset types include at least: personnel dimension, material and environment dimension, management dimension, environment and risk dimension, regulatory dimension, and safety performance dimension; Each dimension contains multiple enterprise-specific indicators and is assigned corresponding weights, which are used to calculate the enterprise security risk index for each enterprise through weighted average.

10. A smart identification device for enterprise security risks based on a large model, characterized in that, include: The acquisition module is used to acquire enterprise security risk data from multiple enterprises, process the enterprise security risk data into a wide table of thematic library, and perform data fusion by associating it with relevant dictionary tables of the enterprises; The calculation module is used to calculate the enterprise security risk index of each enterprise from the preset enterprise dimension based on the preset enterprise dimension indicators and the calculation logic corresponding to each enterprise dimension indicator. The orchestration module is used to build an enterprise security domain knowledge base based on the results of data fusion and the enterprise security risk index of multiple enterprises. It also uses an intelligent orchestration tool to orchestrate the workflow of question-and-answer tasks on the enterprise security domain knowledge base and a preset large language model to build an intelligent analysis engine for enterprise security risks. The identification module is used to call the corresponding interface of the security risk intelligent analysis engine to perform analysis and query based on the natural language questions raised by the user that are related to enterprise security, and to identify enterprise security risks based on the generated query results.

11. An electronic device, comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1-9.

12. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-9.

13. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1-9.

Images