Grade protection-oriented network security configuration checking method

Abstract

The invention provides a level protection-oriented network security configuration checking method, which comprises the following steps of: constructing a knowledge graph associated with a security control item and a technical implementation mode by relying on a standard document and configuration data, and implementing a control item logic dependency and semantic weight reconstruction model; security configuration of assets is automatically collected and semantically mapped to map nodes, configuration deviation is recognized, a risk influence path template is matched in combination with asset importance and service context, semantic propagation path influence intensity is dynamically calculated, and an accumulated risk influence value of configuration deviation is generated in an aggregation mode; according to the method, risk level judgment is carried out by adopting a piecewise nonlinear function, a structured risk assessment record is output, risk identification and reinforcement suggestion closed loop are realized, and the hierarchical management and control and automatic compliance response capability of security configuration deviation in a network environment is improved.

Description

Technical Field

[0001] This invention relates to the field of network security classification protection compliance assessment and risk determination technology, and in particular to a network security configuration verification method for classification protection. Background Technology

[0002] Currently, compliance assessment and risk determination for cybersecurity level protection have become core directions in the field of information security, especially with the increasing demand for intelligent analysis of security configuration status in large-scale asset environments. To improve the automation and accuracy of risk identification, the industry has widely explored knowledge graph-driven methods for cybersecurity risk perception and compliance determination. Mainstream technologies typically include rule-based compliance item checks, hierarchical Boolean logic judgments, or static dependency analysis. Some technologies attempt to introduce new technologies such as knowledge reasoning and graph databases to model complex control item dependencies and compliance relationships. However, existing technical solutions generally rely on single-point judgments of known configuration items or semantic diffusion using full graph traversal, making it difficult to achieve efficient, context-aware, and dynamically mapped risk level determination. Current common cybersecurity compliance testing systems generally employ static rule bases or pre-defined causal chains to determine the compliance of configuration items. These methods can meet basic assessment needs in small-scale assets and low-complexity environments. In recent years, some research has combined knowledge graphs to model the semantic relationships between security control elements using graph structures, and uses graph databases to store and query dependencies, influences, and hierarchical relationships. Some solutions have also attempted to introduce shallow path reasoning, feeding the reasoning results back to risk scoring models to generate quantitative levels. However, most of these solutions face technical limitations such as semantic fragmentation, coarse reasoning granularity, and difficulty in dynamically aggregating multi-dimensional influences. Especially in scenarios with dynamic business changes, asset grading, and multi-regional deployment, traditional graph reasoning based on full graph traversal or single-path propagation struggles to balance performance and accuracy. Summary of the Invention

[0003] In order to solve the above-mentioned technical problems, this invention provides a network security configuration verification method for graded protection.

[0004] The technical solution of this invention is implemented as follows: a network security configuration verification method for graded protection, comprising: S1: Based on the Level Protection 2.0 standard documents and configuration data, construct a Level Protection compliance knowledge graph that includes security control items, sub-requirements, technical implementation methods and device types. Nodes represent compliance elements, and edges represent semantic relationships such as 'dependency', 'impact', and 'satisfaction'. Each type of edge is assigned an initial semantic weight coefficient to support subsequent semantic path propagation calculations. S2: Based on the logical association rules between control items in the Information Security Protection 2.0, a set of semantic influence path templates are predefined. Each template corresponds to the influence propagation mode of a typical deviation event. The templates are constructed based on the known causal chain between control items and are used to limit the scope of reasoning activated in the knowledge graph to avoid full graph traversal. S3: Through lightweight proxy or agentless detection technology, collect the actual configuration values ​​of the target network asset's identity authentication, access control, security audit and other configuration items, and map each configuration item to the corresponding node in the information security compliance knowledge graph to form a set of configuration deviation nodes to be evaluated; S4: For each identified configuration deviation node, match the semantic impact path template that best matches its type. Based on the template, locate and activate the associated local subgraph region in the information security compliance knowledge graph, and generate a restricted semantic propagation path set as the operational domain for risk impact reasoning. S5: Based on business context information, including asset importance level and sensitivity of the network region, assign dynamic attenuation coefficients to subsequent nodes on each activated semantic propagation path, calculate path influence intensity by combining path length and edge weight, and output quantitative influence scores for each path. S6: Weight and aggregate the quantitative impact scores of all activated paths to generate the cumulative impact value of the configuration deviation. The cumulative impact value reflects the direct and indirect risk diffusion effects of the original deviation in the compliance knowledge system. S7: Input the cumulative impact value into the piecewise nonlinear risk level mapping function, determine the risk level range it belongs to based on the preset threshold range, and output three-level risk level labels of low, medium and high to realize context-aware dynamic determination of configuration deviation risk. S8: The output risk level label and the corresponding semantic propagation path evidence chain are encapsulated together into a structured risk assessment record, which is used to drive the subsequent security hardening suggestion generation and work order closed-loop processing flow.

[0005] The network security configuration verification method for graded protection provided by this invention has the following beneficial effects: (1) This invention effectively limits the search space in the reasoning process by constructing a knowledge graph of compliance with information security standards and introducing a predefined "semantic impact path template" mechanism. Based on the logical dependencies between control items in the information security 2.0 standard, typical impact propagation patterns are pre-modeled, such as finite state path templates like "identity authentication failure → untrustworthy audit entity". When a specific deviation is detected, the system only activates the local subgraph region that matches the node of that type for semantic expansion, avoiding the resource consumption caused by global traversal. Combined with the rule package pre-compilation and high-frequency path caching index mechanism, the reasoning process can be completed in milliseconds, significantly improving the response speed of risk assessment.

[0006] (2) This invention employs a path weight dynamic assignment algorithm and a piecewise nonlinear risk mapping mechanism to achieve an organic transformation from structured semantic paths to quantified risk levels. An impact attenuation coefficient based on business context is introduced into the activated semantic path. Taking into account factors such as asset importance and network area sensitivity, differentiated weights are assigned to each subsequent node in the path, reflecting the characteristic that security impact decreases with the propagation path. Each path generates an independent impact strength score, which is aggregated and input into a nonlinear piecewise mapping function, ultimately outputting four risk levels: low, medium, high, and severe. This design not only preserves the semantic expressive power of knowledge graphs but also transforms complex multi-hop impact relationships into interpretable and quantifiable evaluation results, enhancing the accuracy of evaluation conclusions and the usability of decision-making. It is particularly suitable for graded protection application scenarios requiring refined hierarchical responses.

[0007] (3) This invention deeply integrates the structured semantic reasoning capabilities of knowledge graphs with lightweight rule-driven risk assessment logic to construct an efficient, scalable, closed-loop adaptive compliance risk identification system. It eliminates the need for extensive labeled data and offline training processes; all path templates and parameters can be directly constructed and quickly deployed according to the compliance standards, exhibiting good interpretability and maintenance flexibility. Simultaneously, it supports dynamically expanding the path template library based on newly emerging security events or policies, ensuring the continuous evolution of the knowledge system. The entire mechanism significantly reduces computational load while ensuring assessment depth, enabling continuous compliance scanning and risk warning of massive assets without affecting existing IT operations and maintenance performance. It is particularly suitable for industry scenarios with strict compliance requirements and large asset scales, such as campuses, government agencies, and financial institutions, significantly improving the automation level and response sensitivity of security management. Attached Figure Description

[0008] Figure 1 This is a flowchart of the network security configuration verification method for graded protection according to the present invention. Figure 2 This is a sub-flowchart of the network security configuration verification method for graded protection according to the present invention; Figure 3 This is another sub-flowchart of the network security configuration verification method for graded protection according to the present invention. Detailed Implementation

[0009] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0010] The following disclosure provides many different embodiments or examples for implementing different structures of the invention. To simplify the disclosure, specific examples of components and arrangements are described below. Of course, these are merely examples and are not intended to limit the invention. Furthermore, reference numerals and / or letters may be repeated in different examples; such repetition is for simplification and clarity and does not in itself indicate a relationship between the various embodiments and / or arrangements discussed.

[0011] like Figure 1 As shown, this invention provides a network security configuration verification method for graded protection, specifically including: S1: Based on the Level Protection 2.0 standard documents and configuration data, construct a Level Protection compliance knowledge graph that includes security control items, sub-requirements, technical implementation methods and device types. Nodes represent compliance elements, and edges represent semantic relationships such as 'dependency', 'impact', and 'satisfaction'. Each type of edge is assigned an initial semantic weight coefficient to support subsequent semantic path propagation calculations. S2: Based on the logical association rules between control items in the Information Security Protection 2.0, a set of semantic influence path templates are predefined. Each template corresponds to the influence propagation mode of a typical deviation event. The templates are constructed based on the known causal chain between control items and are used to limit the scope of reasoning activated in the knowledge graph to avoid full graph traversal. S3: Through lightweight proxy or agentless detection technology, collect the actual configuration values ​​of the target network asset's identity authentication, access control, security audit and other configuration items, and map each configuration item to the corresponding node in the information security compliance knowledge graph to form a set of configuration deviation nodes to be evaluated; S4: For each identified configuration deviation node, match the semantic impact path template that best matches its type. Based on the template, locate and activate the associated local subgraph region in the information security compliance knowledge graph, and generate a restricted semantic propagation path set as the operational domain for risk impact reasoning. S5: Based on business context information, including asset importance level and sensitivity of the network region, assign dynamic attenuation coefficients to subsequent nodes on each activated semantic propagation path, calculate path influence intensity by combining path length and edge weight, and output quantitative influence scores for each path. S6: Weight and aggregate the quantitative impact scores of all activated paths to generate the cumulative impact value of the configuration deviation. The cumulative impact value reflects the direct and indirect risk diffusion effects of the original deviation in the compliance knowledge system. S7: Input the cumulative impact value into the piecewise nonlinear risk level mapping function, determine the risk level range it belongs to based on the preset threshold range, and output three-level risk level labels of low, medium and high to realize context-aware dynamic determination of configuration deviation risk. S8: The output risk level label and the corresponding semantic propagation path evidence chain are encapsulated together into a structured risk assessment record, which is used to drive the subsequent security hardening suggestion generation and work order closed-loop processing flow.

[0012] Step S1: Based on the Cybersecurity Classified Protection 2.0 standard document and historical compliance configuration data, construct a Cybersecurity Classified Protection compliance knowledge graph containing security control items, sub-requirements, technical implementation methods, and device types. Nodes represent compliance elements, and edges represent semantic relationships such as 'dependency,' 'impact,' and 'satisfaction.' Each type of edge is assigned an initial semantic weight coefficient to support subsequent semantic path propagation calculations. Specifically, this includes: S1.1: Obtain the structured security control clause text from the Level Protection 2.0 standard document, use natural language processing technology to perform semantic parsing on the clause content, extract the security control items and their subordinate sub-requirements as the initial node set, generate standardized compliance semantic units, and use them as the basic building blocks of the knowledge graph; Using the structured security control clause text of the Cybersecurity Classified Protection 2.0 standard document as input, a text parsing module (parameter: word segmentation granularity is at the phrase level of control clauses) is used to achieve formatted segmentation and semantic category recognition of the original standard document; Furthermore, by using a combination algorithm based on dependency parsing and named entity recognition (parameters: entity tag set including control item identifier, sub-requirement number, and constraint conditions), the syntactic structure tree and semantic role labeling of each structured control text are constructed, and a preliminary candidate set of control items and sub-requirements is obtained; Furthermore, a domain ontology mapping algorithm (parameters: Level Protection 2.0 control item ontology lexicon, alignment threshold 0.85) is adopted to achieve semantic matching between the candidate set and the standardized security control ontology, and to generate prototype data of compliant semantic units, wherein each unit contains control item name, sub-requirement description and clause reference index; Furthermore, a semantic disambiguation algorithm (parameter: context window size 5, based on WordNet-OWL extended dictionary) is used to semantically clarify the names of ambiguous control items and generate unique node labels to ensure that synonymous control items with different names are merged and unified. By using attribute appending processing, the node tags from the previous step are bound to metadata such as the source clause number and clause level attributes, forming a standardized compliance semantic unit with complete traceability information, and realizing the output of the basic constituent elements of the information security compliance knowledge graph. For example, in a document containing 300 security control clauses of the Cybersecurity Classified Protection 2.0 standard, the text parsing module segments the document at the phrase level. After syntactic analysis, it identifies three primary control items: identity authentication, access control, and security audit, each containing 10 secondary sub-requirements. The domain ontology mapping algorithm, with an alignment threshold of 0.85, maps "user login verification" to an identity authentication control item and "password complexity setting" to an identity authentication sub-requirement. The semantic disambiguation algorithm normalizes the occurrences of "audit logs" and "operation logs," unifying them into audit log sub-requirement node labels. The final output set of standardized compliance semantic units contains 3 primary nodes and 30 secondary nodes, each node bearing a clause number and hierarchical attribute, providing precise structured input for subsequent expansion of technical implementation methods and device types in S1.2. S1.2: Based on the technical implementation records accumulated in the configuration database, identify the specific technical implementation methods and compatible device types corresponding to each security control item, and use the technical implementation methods and device types as new nodes to establish semantic relationship edges of 'implemented in' and 'applied to' with the corresponding control item nodes, so as to expand the technical implementation dimension of the knowledge graph; S1.3: Based on the logical dependency relationship specification between control items in the Cybersecurity Classified Protection 2.0 standard, analyze the causal chain and constraints between control items, construct three core semantic relationship types: 'dependency', 'influence', and 'satisfaction', and assign an initial semantic weight coefficient normalized in the range [0,1] to each relationship type based on the expert rule base to form a quantifiable semantic association measurement benchmark; Based on the set of security control item nodes and the set of technical implementation method nodes extracted in the previous steps, the input conditions include the control item logical dependency relationship specifications clearly defined in the Information Security Protection 2.0 standard, the control item interaction records of historical compliance events, and the preset relationship weight range in the expert rule base; The logical dependency analysis method (parameters: control item semantic tag set, dependency relationship specification document) is used to extract the causal chain between control items and establish the initial directional dependency matrix between control item pairs; Furthermore, by using a causal chain inference algorithm (parameters: historical event sequence, control item interaction frequency), the constraints between control items are identified, and a set of constraint rules containing condition triggering logic is obtained. Furthermore, a semantic relation classification algorithm (parameters: dependency matrix, constraint rule set) is used to perform cluster analysis on relation types and generate accurate classification results for three core semantic relation types: 'dependency', 'influence', and 'satisfaction'. Furthermore, by using a relation weight normalization calculation method (parameters: initial weights of the expert rule base, relation type classification results), the weight values ​​for each relation type are quantified, and initial semantic weight coefficients normalized to the [0,1] interval are generated, where the normalization process satisfies the formula:

[0013] in, These are the original weight values. and These are the minimum and maximum weight limits set for this relationship type in the expert rule base, respectively; Furthermore, a semantic association measurement model (parameters: normalized weight coefficient, relation type) is used to generate an association benchmark table, and the table records indicators such as relation type, starting node type, and association index. Through the above algorithm chain, the causal chain and constraint analysis results of the previous step are transformed into a quantifiable semantic association metric, realizing the structured and quantitative support of semantic relationships in knowledge graph construction. For example, during the construction of a compliance knowledge graph for a large financial data center, the input logical dependency specifications include identity authentication control items depending on account management control items, access control control items depending on identity authentication control items, and audit control items depending on both access control and identity authentication control items. Historical event interaction records show that access control anomalies occurred multiple times simultaneously with identity authentication failures. Using logical dependency analysis, the dependency direction from identity authentication to access control is marked in the matrix with a value of 0.85, and the dependency direction from access control to audit is marked with a value of 0.92. These are then classified into 'dependency' relationship types using a semantic relationship classification algorithm. The expert rule base sets the weight range for the 'dependency' type to [0.7, 0.95]. The normalized weight coefficient from identity authentication to access control is calculated based on the frequency of historical events, resulting in: = The value is then recorded in the association benchmark table. The final generated semantic association metric covers control item types, three core relationship types, and their normalized weights, providing accurate data support for calculating the impact intensity in subsequent path activation and risk assessment processes. After application in this scenario, the knowledge graph significantly improves both graph traversal performance and semantic reasoning accuracy, achieving dynamic weight loading of association relationships and continuous optimization of the impact of risk paths. S1.4: The extracted compliance semantic units, technical implementation methods, and device types are used as nodes. Combined with the defined semantic relationship types and their initial weight coefficients, a graph database modeling method is used to construct a compliance knowledge graph. Node-edge-attribute triple storage is performed to generate a knowledge network topology with a hierarchical structure and weighted semantic connections. S1.5: Perform consistency verification and redundancy resolution on the constructed compliance knowledge graph, detect and merge semantically duplicated nodes based on graph pattern matching algorithm, optimize edge weight distribution, and output a final version of the knowledge graph with complete structure, clear logic and support for efficient querying, as the underlying knowledge source for subsequent semantic influence path reasoning.

[0014] Step S2: Based on the logical association rules between control items in the Cybersecurity Classified Protection 2.0, a set of semantic influence path templates are predefined. Each template corresponds to a typical deviation event's influence propagation pattern. These templates are constructed based on known causal chains between control items and are used to limit the scope of reasoning activated in the knowledge graph, avoiding full graph traversal. Specifically, this includes: S2.1: Based on the logical dependencies between security control items in the Level Protection 2.0 standard document and historical compliance event analysis data, identify typical configuration deviation types such as identity authentication failure, access control relaxation, and audit configuration missing, and use them as the basis for constructing semantic impact path templates to generate a set of N types of deviation event classification labels to support the classification modeling of subsequent templates; Based on the logical dependencies between security control items in the Cybersecurity Classified Protection 2.0 standard document and historical compliance event analysis data, the input data includes the semantically parsed control item hierarchy structure, causal relationship matrix, and event type label records; The knowledge graph association analysis method (parameters: relationship matrix = dependency / influence / satisfaction, node dimension = control item level) is used to realize the structured modeling of the logical dependency relationship between control items, and output a relationship graph dataset that can be directly used for event type pattern recognition; Furthermore, by using a historical compliance event frequency statistics algorithm (parameters: time window = 36 months, event type threshold = occurrence count ≥ 10), high-frequency patterns of different deviation events are filtered, and a preliminary selection set of high-impact categories such as identity authentication failure, access control relaxation, and audit configuration deficiency is obtained. Furthermore, by using an event association measurement algorithm based on conditional probability (parameter: minimum association confidence = 0.65), we can perform matching analysis between deviation events and multi-control item dependency paths, and generate feature vectors of event-dependency chain combinations for subsequent template construction input. Furthermore, by using a pattern clustering algorithm (parameters: clustering method = hierarchical clustering, distance metric = Jaccard similarity coefficient), high-frequency deviation events are clustered in the dependency space, and representative event labels for each cluster are generated, forming a set of classification labels for N types of deviation events. By using semantic tag standardization, the clustering results from the previous step are transformed into deviation event classification tags in a unified format, thus realizing a standardized deviation tag data structure that can be directly associated with the knowledge graph path template library. For example, in the environment of a large financial enterprise, the input control item hierarchy includes four primary control items: identity authentication, access control, security audit, and intrusion prevention, as well as 20 secondary sub-requirements. The event log database contains 2150 compliance events from the past 36 months, including 450 identity authentication-related events, 380 access control-related events, and 310 audit configuration-related events. Using knowledge graph association analysis, the dependency matrix between control items is 24×24, with 132 key dependency chains. Through event frequency statistics, 12 high-frequency deviation types with an event type occurrence frequency ≥10 were identified, including identity authentication failure events occurring 450 times and access control relaxation events occurring 380 times. The confidence level of the association between identity authentication failure and missing audit configuration was calculated using a conditional probability algorithm. The confidence level for the association between relaxed access control and abnormal intrusion prevention configuration is: All exceeded the set threshold. Hierarchical clustering was used to cluster the aforementioned high-frequency events, resulting in N=5 categories of representative labels for deviation events. Each label was coded in a unified format, including the event name, trigger control item ID, set of associated dependency path IDs, and historical impact frequency index. Performing this step in the enterprise environment significantly improved the accuracy and coverage of subsequent semantic impact path template matching. S2.2: For each type of deviation event classification label, use the semantic edge relationships such as 'impact', 'dependency', and 'satisfaction' in the information security compliance knowledge graph to extract the high-frequency causal propagation path patterns between control items, abstract and summarize these paths to form a reusable initial semantic impact path structure as a template prototype; Using the set of deviation event classification labels output from S2.1 as input, the information security compliance knowledge graph constructed in step S1 is loaded, and the operation scope is limited to node connection domains containing three types of semantic edge relationships: 'influence', 'dependency', and 'satisfaction'. A traversal algorithm based on high-frequency path counting is adopted (parameters: edge type filtering condition = influence / dependency / satisfaction, node repeated access threshold = 1) to extract the multi-hop path output list of the starting node corresponding to the deviation event classification label in the knowledge graph. Furthermore, by using a path pattern mining algorithm (parameters: minimum support threshold = 0.3, maximum path length = 5), frequency statistics and pattern recognition are performed on the extracted multi-hop path sequences to screen out causal propagation chains that have a high probability of appearing in historical compliance deviation scenarios, and a set of high-frequency causal propagation paths is obtained as a candidate set. Furthermore, through the path structure abstraction and induction method (parameters: control item hierarchy mapping rules, technical implementation dimension mapping rules), the specific node names in the candidate set are transformed into standardized expressions of control item type symbols and device category symbols, and a path structure skeleton with instantiated attributes removed is generated to achieve reusability across asset scenarios. Furthermore, by using a path pattern unique indexing algorithm (parameters: hash seed = event tag ID, collision detection mode = double hash), the abstract path structure is encoded and a unique index value is formed. Path patterns with the same structure are folded and stored to reduce redundancy in the template prototype set. Through the above pattern abstraction and encoding process, the high-frequency causal propagation path candidate set of the previous step is transformed into a set of initial semantic influence path structures that are reusable and maintain semantic structural consistency, so as to achieve the expected technical effect of fast calling and structural alignment in the subsequent template library construction. For example, for the "Identity Authentication Failure" type in the off-event classification label set, the input condition is a constructed knowledge graph fragment whose nodes include identity authentication control item nodes (ID-AUTH), access control nodes (ACCESS-CONTROL), and security audit nodes (SEC-AUDIT), with edge types limited to 'impact' and 'dependency'. When the path traversal algorithm expands outward from the ID-AUTH node, it extracts the path sequence: ID-AUTH → ACCESS-CONTROL → SEC-AUDIT. The support of this path in the historical event database is 0.45. The path pattern mining algorithm retains this path with a minimum support threshold of 0.3, mapping the nodes to standardized control hierarchy symbols: [C1] → [C2] → [C3], where C1, C2, and C3 correspond to the hardware / software implementation dimensions of the first-level control item, second-level sub-item, and third-level sub-item, respectively. The hash value is calculated using the path pattern unique indexing algorithm, resulting in index key=HASH(event tag ID=AUTH_FAIL, seed=4521)=983742, which is stored in the initial template prototype set. This initial semantic influence path structure can be directly mapped to a path node sequence during subsequent S2.3 normalization processing, and combined with weight parameters to form a complete template for local subgraph activation and influence reasoning of the "identity authentication failure" risk. The execution effect was demonstrated in a simulated test environment with 20 heterogeneous devices, showing that the correct template prototype could be retrieved within milliseconds, significantly improving the risk assessment response speed. S2.3: Perform normalization processing on the initial semantic impact path structure, and perform standardized mapping of path nodes based on the control item hierarchy (such as first-level control and second-level sub-items) and technical implementation dimensions (such as network layer, host layer, and application layer) to generate a path node sequence in a unified format, and assign a unique identifier to each path to form a standardized semantic impact path template library. S2.4: Configure an initial propagation weight parameter set for each standardized semantic influence path template. This parameter set includes the initial influence strength of the path, the influence attenuation coefficient between nodes, and the enhancement factor of key control points. It is set based on expert experience rules and the statistical results of historical risk diffusion cases to support the subsequent dynamic influence strength calculation. S2.5: Compile standardized semantic influence path templates and their associated parameters into a lightweight rule package, define its structure and syntax using JSONSchema, and build a fast template matching table based on deviation type index in memory to support efficient template matching and local subgraph activation operations for configured deviation nodes during risk assessment.

[0015] like Figure 2 As shown, step S3 involves: using lightweight proxy or agentless detection technology to collect the actual configuration values ​​of the target network asset's identity authentication, access control, security audit, and other configuration items, and mapping each configuration item to the corresponding node in the compliance knowledge graph to form a set of configuration deviation nodes to be evaluated. Specifically, this includes: S3.1: Based on the target network asset list, obtain access credentials or probe entry information of the device to be detected, and use a lightweight proxy probe or agentless scanning engine to perform multi-protocol adapted data collection tasks. The protocols include SSH, WMI, SNMP and RESTful API to be compatible with servers, network devices and database systems in heterogeneous environments. The original response message is syntactically structured through the protocol parsing module to generate standardized device configuration snapshot data as input conditions for subsequent semantic mapping. Based on the target network asset list dataset, a credential parsing module (parameters: device identifier, access authentication type, interface protocol category) is used to achieve standardized extraction of access credentials or probe entry information of the device to be detected. Furthermore, by using a lightweight agent probe deployment algorithm (parameters: probe load threshold, process priority) and an agentless scanning engine calling mechanism (parameters: port open status, protocol handshake success rate), automatic adaptation to multi-protocol environments is achieved, and data collection tasks are started, covering SSH, WMI, SNMP and RESTful API protocol families, to ensure compatibility with the configuration access capabilities of servers, network devices and database systems in heterogeneous environments. Furthermore, secure connection construction under each protocol is achieved through the protocol handshake manager (parameters: timeout, number of retries) and the session key exchange mechanism (parameters: encryption algorithm type, bit length specification), and the successful handshake session is transmitted to the original data acquisition buffer to ensure that the data transmission link is secure and meets the information security requirements of the information security level protection. Furthermore, a protocol parsing module (parameters: protocol message format description, field extraction rule set) is used to perform syntactic structuring processing on the original response message, parsing the unstructured message content into intermediate data units in the form of key-value pairs, so as to realize the semantic indexability of configuration parameters; Furthermore, by configuring the snapshot generation algorithm (parameters: field mapping rules, timestamp precision control), the intermediate data units after syntactic structuring are compiled in batches into standardized device configuration snapshot data. This data is stored in a structured table format and comes with a unique snapshot identifier, which serves as the input condition for the subsequent semantic mapping stage. Through the protocol adaptation and parsing chain, the access credential parsing results, protocol handshake sessions, and structured configuration data are transformed into standardized device configuration snapshots, achieving the expected technical effect of semantic alignment in the subsequent feature parsing stage; For example, in one embodiment, the asset list includes 300 devices, including 150 Linux servers, 100 Windows servers, and 50 multi-vendor network switches. The credential parsing module loads SSH key files (RSA 2048-bit) for Linux servers, loads domain account credentials and adapts them to the WMI protocol for Windows servers, and calls the SNMP v3 credential set for the switches. In the lightweight agent probe deployment, the CPU usage limit for the Linux server probe process is set to 5%, and an agentless mode is used for the switches to avoid the risk of firmware modification. The protocol handshake manager sets the SSH session timeout to 5 seconds and the SNMP polling retry count to 2 to ensure timely and stable data collection. The protocol parsing module parses the fields returned by the Windows server based on the JSON Schema of the RESTful API, mapping the raw string "password_policy" to a policy length field and value combination structure, with intermediate data units recorded as table entries. The snapshot generation algorithm is configured to generate a snapshot file for each device. The file name includes the device ID and a high-precision timestamp (0.001 seconds precision). In the subsequent feature extraction stage, the snapshot is mapped one-to-one with the identity authentication, access control and security audit nodes in the information security compliance knowledge graph. The verification results show that the snapshot data structure meets the semantic alignment requirements and the generation time window is less than 3 seconds, which significantly improves the real-time performance and accuracy of the data acquisition link. S3.2: Extract key security control fields from standardized device configuration snapshot data, including identity authentication mechanism type, password policy strength parameters, access control list rule set, audit log enable status and coverage; extract features from unstructured configuration text based on a combination of regular expression matching and syntax tree parsing to generate a set of security configuration feature vectors with clear semantic labels, each feature vector corresponding to a verifiable security control dimension; S3.3: Perform multimodal semantic alignment between the generated security configuration feature vector and the predefined security control item nodes in the information security compliance knowledge graph. Use an ontology-based similarity calculation algorithm (such as Jaccard-OWL) to compare the semantic consistency between feature tags and node attributes. When the matching degree exceeds the preset threshold, establish the mapping relationship between the configuration item and the knowledge graph node, and output a set of located compliance check anchors as the operational benchmark for deviation judgment. Using the security configuration feature vector as the input data set, an ontology-based semantic similarity calculation algorithm (parameters: ontology structure = Level Protection 2.0 security control item ontology model, similarity measure = Jaccard-OWL) is adopted to achieve a preliminary semantic consistency comparison between feature labels and knowledge graph node attributes; Furthermore, by performing Jaccard similarity calculations on the feature label attribute set and the target node attribute set, the number of elements in their intersection and union is obtained, and the initial similarity value is calculated based on the following formula. :

[0016] in The attribute set for feature labels. For node attribute sets; Furthermore, the ontology synonym and hyponymy relationships of the terms in the feature labels are expanded through the OWL reasoning mechanism, ontology reasoning expansion is performed, semantic expansion attribute set is generated, and it is integrated into the similarity calculation process to improve the accuracy of cross-term matching. Furthermore, by introducing a weight adjustment function, the ontology-level depth factor and the node attribute weight vector are fused into the similarity metric to form a context-aware corrected similarity value. By setting a preset matching degree threshold (parameter: threshold range [0.75, 0.9]), the corrected similarity result is judged by a threshold. When the matching degree exceeds the threshold, the mapping relationship between the configuration item and the target node of the knowledge graph is established, and the mapping metadata, including feature ID, node ID, matching degree value and matching evidence chain, is recorded. Through the above algorithm or processing method, the feature vector data of the previous step is transformed into the located compliance inspection anchor points, so as to realize the construction of the operational benchmark for deviation judgment; For example, in an implementation scenario targeting a large financial data center, the input security configuration feature vector includes the following fields: authentication mechanism type ("LDAP+MFA"), password policy strength parameter (minimum length 12, complexity includes uppercase and lowercase letters, numbers, and special symbols), access control list rule set (64 rules), and audit log enabling status (covering the entire business process). The Jaccard-OWL algorithm is used to analyze the feature tag attribute set of the authentication mechanism. ={"LDAP","MFA"} and the attribute set of the identity authentication control item node in the knowledge graph. The initial similarity calculation is performed on the set {"LDAP","MFA","Kerberos"}. The number of elements in the intersection is 2, and the number of elements in the union is 3. The similarity value is calculated as follows: =0.666. Through ontology-extended matching, a terminological equivalence relation is established between the MFA and the "two-factor authentication" node in the knowledge graph, increasing the number of intersection elements to 3 while maintaining the union of 3. The corrected similarity value is... =1.0, which is higher than the preset threshold of 0.9, and a mapping relationship is established. Similarly, numerical attribute matching is performed on the password policy strength parameter, with the attribute set set as {"minLength=12","complexity=4"}. The similarity value after weight adjustment reaches 0.85, which meets the mapping condition. The final output set of compliance check anchor points contains two mapping items, each recording the matching degree, evidence chain, and node reference, achieving efficient and accurate semantic mapping in this scenario, and significantly improving the accuracy and reliability of deviation detection. S3.4: Based on the standard configuration expected values ​​of each security control item in the information security compliance knowledge graph, perform Boolean compliance judgment on the actual configuration values ​​corresponding to the mapped compliance check anchor points, and perform logical comparison operations such as 'equal to', 'included', and 'satisfies minimum length / complexity'; for configuration items that do not meet the expected conditions, mark them as configuration deviation instances, and record their actual values, expected values, and difference types to form a preliminary configuration deviation candidate set; S3.5: Perform context filtering and priority sorting on the initial configuration deviation candidate set, and combine asset importance level and network area exposure information to screen out high-potential risk deviations that affect critical business systems; encapsulate the screened results into a set of configuration deviation nodes to be evaluated, each node containing device identifier, deviation name, knowledge graph node reference, deviation degree quantification value and business context label, as the trigger input for semantic path reasoning in the next stage.

[0017] like Figure 3As shown, step S4 involves: for each identified configuration deviation node, matching the semantic impact path template that best matches its type; based on this template, locating and activating the associated local subgraph region in the compliance knowledge graph to generate a restricted set of semantic propagation paths, which serves as the operational domain for risk impact reasoning. Specifically, this includes: S4.1: Based on the set of semantic influence path templates predefined in the previous step S2, obtain the security control item type and its deviation semantic label of the currently identified configuration deviation node, and perform template retrieval operation using the type matching algorithm to determine the semantic influence path template that best matches the deviation node; wherein, the type matching algorithm adopts the ontology semantic similarity calculation method to align the control item category of the deviation node with the starting node type covered by each template, and output the optimal matching semantic influence path template as the guiding basis for subsequent local graph activation; Obtain the security control item categories and their deviation semantic labels from the set of configuration deviation nodes to be evaluated, and use an ontology-based semantic similarity calculation method (parameters: control item ontology vocabulary, deviation label ontology vocabulary, similarity threshold) to achieve semantic alignment between the current deviation node and the template starting node; Furthermore, by using a vectorized embedding mapping algorithm (parameters: pre-trained ontology word vector model, embedding dimension size), vector representations of the offset node categories and the starting node categories of the path template are realized, and semantic representation data of the vector space are obtained.

[0018] Furthermore, a cosine similarity calculation method (parameters: vectorized deviation node category representation, vectorized template starting node category representation) is used to calculate the similarity score between the two and generate a matching score matrix, where each element represents the degree of matching of the current node with different templates. Furthermore, by using a maximum value selection strategy (parameters: similarity score matrix, preset optimal matching threshold), the unique determination of the matching template is achieved, and an optimal matching template identifier is generated to ensure that the template has the highest semantic relevance to the off-node. By using a template retrieval algorithm based on ontology semantic similarity, the similarity score results from the previous step are transformed into the optimal matching semantic influence path template data, thereby guiding the input of the local subgraph activation process. For example, in a real-world network security configuration verification system, the configuration deviation node to be evaluated is categorized as "lack of identity authentication mechanism," and the deviation semantic tag is "does not meet password complexity requirements." The system uses a constructed ontology vocabulary of security compliance control items (2000 words), a deviation tag ontology vocabulary (500 words), and a similarity threshold set to... Using embedded dimensions The pre-trained Word2Vec model performs vectorization mapping between node categories and template starting node categories to obtain corresponding vectors. and Calculate the cosine similarity to obtain the similarity value. Based on the matching score matrix, the template corresponding to the maximum value is selected, and the optimal matching template is determined to be "T-IDAUTH-ACCTRL". This template identifier is used as the input for local subgraph activation. In subsequent steps, the system only activates the knowledge graph sub-regions related to this template, which significantly improves the accuracy of matching and the efficiency of inference, and avoids the performance overhead caused by full graph traversal. S4.2: Taking the semantic influence path template matched in S4.1 as input, parse the semantic jump rule sequence contained therein. The rule sequence is represented by a state transition chain composed of edge types such as 'dependency', 'influence', and 'satisfaction'. Based on the rule sequence, lock the starting node (i.e. the currently configured deviation node) in the information security compliance knowledge graph constructed in S1, and start a restricted multi-hop adjacency expansion mechanism, which only allows graph traversal along edge types and directions that conform to the template definition, and generates a controlled local subgraph region. Using the semantic influence path template obtained through matching as input, a template parsing algorithm is employed (parameters: edge type set {dependency, influence, satisfaction}, state transition sequence length limit). This enables structured decoding of the semantic jump rule sequence within the template; Furthermore, by using the state transition chain mapping method (parameters: control item node set, edge weight initial coefficient matrix), the parsed semantic jump rule sequence is mapped into edge type constraints that can be recognized by the knowledge graph, and the directional traversal rule data structure is obtained. Furthermore, by utilizing a node locking algorithm (parameters: offset node ID, graph database index structure), the precise location of the corresponding starting node in the compliance knowledge graph is achieved, and an access handle for the starting node is generated. Furthermore, a restricted multi-hop adjacency expansion algorithm is adopted (parameter: maximum traversal depth). (Allows edge type set and directional constraints) to enable multi-hop traversal in the knowledge graph based on the edge type and direction defined by the template, and expands high adjacency nodes only along legal semantic edges to generate an initial local subgraph adjacency list; Furthermore, through the local subgraph generator (parameters: adjacency list, node attribute set, edge weight set), the adjacency structure of the previous step is transformed into a local subgraph region data model containing nodes, edges and attributes, achieving accurate correspondence with the template topology and information encapsulation; By using a template-driven restricted adjacency expansion mechanism, the node locking result of the previous step is transformed into a local subgraph region that conforms to semantic rule constraints, thereby achieving the expected technical effect of controlling the scope of reasoning and improving reasoning efficiency. For example, in a network security configuration verification system, when the deviation node type is "identity authentication failure" and the matched semantic impact path template contains a state transition chain [impact → dependency → satisfaction], the input parameter settings... =3, =3, the initial coefficient matrix of edge weights is defined based on the expert rule base as {Influence: 0.8, Dependency: 0.6, Satisfaction: 0.9}. Starting with the offset node ID “AUTH_FAIL_NODE_01”, a unique node reference is retrieved from the Neo4j graph database using a node locking algorithm. When executing the restricted multi-hop adjacency expansion algorithm, it only expands along the edge type [Influence] from the starting node to the access control node, then along the edge type [Dependency] to the audit control node, and finally along the edge type [Satisfaction] to the log integrity node. The generated adjacency list contains 4 nodes and 3 edges. The local subgraph generator encapsulates the above adjacency list into a local subgraph region data model. Node attributes include control item ID, security level, and technical implementation type; edge attributes include type identifier and initial weight. In this scenario, the generated local subgraph region size is significantly smaller than the full graph traversal result, verifying that template-driven expansion significantly improves inference efficiency while maintaining necessary inference accuracy. S4.3: Perform semantic path pruning on the local subgraph regions generated in S4.2, and remove redundant path branches whose path length exceeds a preset threshold or whose cumulative semantic weight is lower than the minimum influence threshold, so as to compress the inference space. The semantic weight is obtained by multiplying the initial weight coefficient of the edge type with the path depth decay factor to ensure that the propagation paths with high potential influence are retained, and output the simplified set of restricted semantic propagation paths. In the local subgraph region generated in step S4.2, the input conditions are node sequence and edge type attribute data, and each edge has been loaded with its initial semantic weight coefficient and path depth information; A depth-first search pruning algorithm is used (parameter: maximum path length threshold). This implements the function of filtering the length of all semantic paths in the local subgraph and marks the set of path indexes that meet the length condition for subsequent filtering; Furthermore, a semantic weight evaluation method is used (parameter: initial weight coefficient of edge type). Path depth attenuation factor This method calculates the cumulative semantic weight for each path and obtains a path influence metric, which is used to determine its potential contribution to risk reasoning. The formula is as follows:

[0019] in, For cumulative weighting, This represents the number of edges contained in the path. Let i be the i-th edge on the path. This is the hop count of the edge. Furthermore, through the influence threshold filtering algorithm (parameter: minimum influence threshold) This allows for the removal of paths with accumulated semantic weights below a threshold and the generation of a set of high-impact paths, ensuring that only propagation paths that significantly contribute to the overall risk assessment are retained. Furthermore, a composite condition screening method (parameters: and Combination rules are used to calculate the intersection of path sets with both length and weight constraints, and to obtain a final simplified set of restricted semantic propagation paths, which includes path indices, node sequences and optimized edge weight parameters. Through the above pruning and filtering algorithms, the local subgraph traversal results of the previous step are transformed into a set of semantic propagation paths with compressed scale and high impact potential, thereby achieving the expected technical effect of controlling the scale of the inference space and preserving the critical path. For example, for a local subgraph containing a starting offset node A and its three-hop adjacent nodes, a maximum path length threshold is set. For 3 hops, minimum impact threshold The initial weight coefficients for edge types are 0.4, 0.9, 0.8, and 0.7 respectively, and the path depth decay factor α is 0.85. During pruning, all paths longer than 3 hops are removed. For the three retained paths P1, P2, and P3, their cumulative semantic weights W are calculated according to the formula: for example, if the weights of the three edges of P1 are 0.9, 0.8, and 0.7 respectively, and the hop counts are 1, 2, and 3 respectively, then the cumulative weights W are calculated as follows: The numerical result is approximately 2.04. (Comparison) =0.4, P1 and P2 meet the threshold condition, and P3 is eliminated due to insufficient weight. The final output simplified path set contains the node sequences of P1 and P2 and the optimized edge weight parameters. After application, it significantly improves the inference efficiency and accuracy in risk assessment calculation. S4.4: The restricted semantic propagation path set output by S4.3 is structured and encoded. Each path is represented as an ordered pair of node sequence and edge type sequence, and the path source (i.e., the original deviation node ID) and matching template identifier are attached to form a standardized risk impact reasoning operation domain description file. This file serves as the input data structure for subsequent path impact strength calculation and supports fast loading and index query. S4.5: Based on the memory caching mechanism, an index snapshot is created for the local subgraph region corresponding to the frequently occurring semantic propagation path template. When the same type of configuration deviation occurs again, the cached operation domain result is directly called to avoid repeated graph traversal and path generation. This mechanism manages the cached content based on the LRU (Least Recently Used) replacement strategy, which significantly reduces real-time inference latency and improves the system's response efficiency in large-scale asset environments.

[0020] Step S5: Based on business context information, including asset importance level and the sensitivity of the network region, assign dynamic attenuation coefficients to subsequent nodes on each activated semantic propagation path, calculate the path influence intensity by combining path length and edge weights, and output the quantitative influence score for each path. Specifically, this includes: S5.1: Obtain the asset importance level and network region sensitivity as business context input parameters, discretize them based on the predefined context classification standard, and generate asset context feature vectors to support the differentiated adjustment of the degree of attenuation of the influence of nodes in the semantic propagation path. S5.2: Based on the asset context feature vector generated in S5.1, a dynamic decay coefficient is assigned to the subsequent nodes in each activated semantic propagation path. An exponential decay function model is adopted to jointly model the number of hops that the node distance from the starting point is deviated from the starting point with the context feature vector. The decay factor sequence that reflects the decrease in influence as the path extends is calculated, forming a path-level influence decay curve. S5.3: Obtain the topological data of each path in the restricted semantic propagation path set generated in S4, extract the initial semantic weight coefficients of the edges traversed by the path, and combine the attenuation factor sequence output by S5.2 to perform context-weighted correction on the weight of each edge on the path, generating a context-aware dynamic edge weight sequence to reflect the actual impact differences of the same semantic relationship in different asset scenarios. S5.4: Based on the dynamic edge weight sequence generated by S5.3, the path integral is calculated for each semantic propagation path. The path length is normalized by the multiplication-accumulation hybrid algorithm to obtain the intermediate value of the path-level influence intensity. This value represents the overall semantic transmission capability of the path in the current business context. Based on the dynamic edge weight sequence generated by S5.3, a multiplication and accumulation hybrid algorithm (parameters: edge weight sequence, path length normalization coefficient) is used to calculate the overall semantic transmission capability of each semantic propagation path; Furthermore, by using the path multiplication calculation method (parameter: dynamically ordered edge weights), the transmission effects of each edge on the path are multiplied and accumulated to obtain the original path product value; this product value reflects the total energy transfer of the entire path without considering length normalization. Furthermore, by using an accumulation calculation method (parameter: logarithmic form of edge weights), the numerical stabilization of the path multiplication result is achieved, and a corrected accumulated energy value is generated; this value is used to reduce the nonlinear amplification effect of a single high-weight edge on the overall result. Furthermore, by using a path length normalization method (parameter: number of path nodes), the accumulated energy value is scaled according to the path length, ensuring the comparability of influence intensity calculations for paths of different lengths; the calculation formula is as follows:

[0021] in, Adjust the weights for the i-th edge using context weighting. This represents the total path length (number of edges). Furthermore, through the comprehensive calculation of the multiplication-accumulation hybrid algorithm, the multiplication result and the accumulated normalized value are weighted and fused to generate the intermediate value of path-level influence intensity; the fusion weight is set by the empirical rule base according to the historical transmission pattern, and is used to balance the product diffusion characteristics and the accumulation stability characteristics. This algorithm transforms the dynamic edge weight sequence from the previous step into a quantifiable intermediate value of path-level influence intensity, thereby achieving an accurate representation of the overall semantic transmission capability of the semantic propagation path in the current business context. For example, in a semantic propagation path containing four edges, the dynamic edge weight sequence is 0.8, 0.7, 0.6, and 0.9. The original product value is obtained by calculating the path product. Then, take the natural logarithm of the edge weights and sum them to obtain the cumulative value. Total path length = The average weight is obtained by normalizing and accumulating the values ​​according to the formula. Finally, the fusion algorithm was executed with the set fusion weights α=0.6 and β=0.4, and the calculation result was as follows: = This serves as an intermediate value for the impact strength of the path within the current business context. After subsequent normalization, this result can be directly used to calculate risk contribution, and it demonstrates significantly improved real-time performance and computational stability in real-world large-scale asset environments. S5.5: Input the intermediate value of the path-level impact intensity output by S5.4 into the normalization mapping function, perform normalization based on the historical maximum impact intensity benchmark value, and generate a quantitative impact score in the range of [0,1] as the risk contribution output of the semantic propagation path for S6 to use for weighted aggregation; The intermediate value of the path-level influence intensity output in S5.4 is obtained as the input data for this sub-step. The intermediate value represents the overall semantic transmission capability of the path in the current business context. A normalization method (parameter: historical maximum impact intensity benchmark value) is adopted to transform path intensity values ​​under different scales and contexts into comparable standardized quantitative indicators; Furthermore, by standardizing the mapping function (parameter: input value range constrained to the [0,1] interval), the intermediate value of the path-level influence intensity is scaled to a uniform interval, and a quantitative influence score with consistent dimensions for the subsequent weighted aggregation process is obtained; Furthermore, the difference ratio calculation method is used to compare the median value of the current path's impact intensity with the historical maximum impact intensity benchmark value to ensure that the scores of different paths reflect their relative risk contribution. The formula is as follows:

[0022] in, This represents the median value of the path-level impact intensity. This is the benchmark value for the greatest historical impact. Furthermore, a truncation operation is performed on the calculated score through a boundary constraint function (parameters: minimum value 0, maximum value 1) to prevent quantization distortion caused by abnormal or high noise values, and to generate the final quantization impact score. By using normalization operations and boundary constraint processing, the path strength results from the previous step are transformed into single-path risk contribution data, thereby achieving comparability and aggregation feasibility of different paths in risk assessment. For example, during a compliance assessment of a company's data center, the median value of path-level impact intensity was 0.78, and the historical maximum impact intensity baseline value was 1.25. Substituting the parameters into the above normalization formula: The calculated ratio is 0.624. By standardizing the mapping function to restrict this value to the [0,1] interval, the resulting quantified impact score is 0.624. For different possible scenarios, such as when the median impact strength of another path is 1.30 and the normalized result is higher than 1, the boundary constraint function truncates it to 1.000. This process significantly improves the consistency of input data and the accuracy of verification during the multi-path risk aggregation stage, and demonstrates good real-time response performance and evaluation stability in actual tests.

[0023] Step S6: Weighted aggregation of the quantitative impact scores of all activated paths to generate the cumulative impact value of the configuration deviation. This cumulative impact value reflects the direct and indirect risk diffusion effects of the original deviation within the compliance knowledge system. Specifically, this includes: S6.1: Obtain the quantified impact score of each semantic propagation path output in S5. The score of each path is generated by the path impact intensity calculation model based on business context information, edge semantic weights and path length attenuation coefficients. Based on the path template type, assign initial aggregation weights to different categories of impact paths. Use a weighted summation algorithm to initially fuse the impact scores of all activated paths to generate an unnormalized total path impact component, which serves as the basic input for calculating the cumulative impact value. Obtain the semantic propagation path quantification impact score set output by step S5, and use it as the original input parameter set for this sub-step. All scores are within the range of... Within the range, it reflects the risk contribution of the path after correction of business context and semantic weight; A path template type mapping method (parameters: type label set, template category weight table) is adopted to realize the initial aggregation weight allocation of semantic propagation paths of different categories. The initial aggregation weight is formulated based on the risk sensitivity of various control items in the Cybersecurity Classified Protection 2.0 standard and the statistical results of the propagation impact of historical events, to ensure that different risk propagation modes reflect differentiated weights when the total impact value is integrated. Furthermore, the aggregated weights are dynamically corrected through a weight calibration algorithm (parameters: initial weights of template categories, actual frequency of path occurrence), resulting in a calibrated path weight vector, which is a sequence of equal-length weight coefficients corresponding to the path score. Furthermore, a weighted summation algorithm (parameters: path score set, calibrated path weight vector) is used to linearly combine the quantized impact scores of all activated paths, achieving preliminary fusion of the total impact components. The calculation expression is as follows:

[0024] in, The unnormalized path total influence component, The calibration weight for the i-th path, The corresponding quantitative impact score; Furthermore, by normalizing the weighted summation and outputting the unnormalized total path impact component, the initial risk diffusion effect of this configuration deviation under the current context loading is quantified. Through the above weighted aggregation processing method, the risk contribution of each path in the previous step is transformed into an unnormalized total impact component, thereby realizing a quantitative characterization of the overall impact of configuration deviations in the information security compliance knowledge graph, and providing a stable numerical basis for subsequent introduction of path confidence factors for semantic accuracy correction. For example, in a data center network security audit scenario, the S5 step outputs the quantitative impact scores of 5 activation paths, which are as follows: , , , , The initial weight of the corresponding path template category is... , , , , Considering the combination of actual path occurrence frequency and category risk sensitivity, the calibrated weight vector is adjusted to... , , , , Substitute into the formula to calculate: The unnormalized total influence component value is approximately This value will be used for path confidence factor correction in the next step, achieving risk aggregation with higher semantic accuracy; S6.2: Based on the unnormalized total path influence component generated in S6.1, a path confidence factor is introduced to correct the excessive contribution of low-probability propagation paths. This factor is dynamically adjusted according to the historical matching accuracy of the path template and the topological adaptability of the current asset environment. An exponential decay function is used to suppress long-hop paths, and path confidence weighted correction processing is performed to obtain a reliability-calibrated influence component sequence, thereby improving the semantic accuracy of the aggregation results. S6.3: Normalize the reliability-calibrated impact component sequence output by S6.2 and map it to the preset [0,1] value range using the max-min normalization method; the normalization benchmark is determined based on the cumulative impact distribution statistics of historical typical deviation events to ensure that the cumulative impact values ​​generated in network environments of different scales are horizontally comparable, and generate the normalized cumulative impact intermediate value as the input variable for the next stage of nonlinear transformation. S6.4: Based on the standardized cumulative impact median value generated by S6.3, a business context adjustment parameter set is introduced, including the asset importance adjustment factor and the network area sensitivity gain coefficient; the above adjustment parameters and the median value are coupled through a product fusion mechanism to perform context-enhanced impact amplification or suppression processing, and generate a context-aware extended impact value, so that the final cumulative impact value can reflect the risk preference differences under specific business scenarios. S6.5: The context-aware extended impact value output by S6.4 is subjected to saturation constraint processing. A truncation function is used to limit its value range to a reasonable closed interval to prevent extreme value interference caused by abnormal paths. The processed result is defined as the final cumulative impact value of the configuration deviation item. This value comprehensively represents the multi-hop semantic association impact and business environment modulation effect of the original configuration deviation in the information security compliance knowledge graph, and is used to drive the piecewise nonlinear risk level mapping process in S7. Based on the context-aware extended influence value generated by S6.4, a saturation constraint algorithm (parameters: upper limit threshold U, lower limit threshold L) is used to limit the numerical range. Furthermore, by using an interval truncation function model (parameters: U, L), the upper and lower bounds of the extended impact value are truncated, and the truncated impact value sequence is obtained to prevent numerical anomalies caused by high-jump-count, low-confidence paths from interfering with the accuracy of risk assessment. Furthermore, by using the continuous saturation function transformation method (parameters: U, L, saturation curve control factor k), the numerical smooth transition near the truncation boundary is achieved, generating a sequence of constrained post-influence values ​​that meet the continuity requirements, thus avoiding the gradient abruptness caused by hard truncation from affecting subsequent nonlinear mappings; Furthermore, the constraint processing results are calculated using the formula:

[0025] in, To expand the impact value, The value after constraint processing. The upper limit threshold, The lower limit threshold; Furthermore, by using a threshold adaptive adjustment algorithm (parameters: network environment scale, historical cumulative influence distribution), the dynamic optimization configuration of U and L is achieved, and the final set of constraint parameters is generated, so that the processed values ​​maintain relative stability under different environments; By using a saturation constraint processing algorithm, the context-aware extended impact value of the previous step is transformed into the final cumulative impact value, thereby suppressing outliers and stabilizing risk propagation quantification, and providing reliable input for S7 segmented nonlinear risk level mapping. For example, in a large-scale network environment containing 5000 assets belonging to four security domains, U is set to 0.92, L to 0.08, and the saturation curve control factor k to 0.15. The extended impact value is... When, the truncation function outputs: The constrained values ​​are obtained after smoothing the saturation curve. To maintain a small difference from the U value, high-risk significance is preserved. When the expanded effect value is... When, the truncation function outputs: After smoothing, we get This effectively improves the stability of low-risk items. Batch constraint processing is performed in this environment, and the post-constraint impact values ​​of all paths are concentrated in the [0.08, 0.92] interval. The classification boundary of the nonlinear mapping process is stable, significantly improving the continuity and accuracy of risk level determination.

[0026] Step S7: The cumulative impact value is input into the piecewise nonlinear risk level mapping function. Based on a preset threshold range, the risk level range to which it belongs is determined, and four risk level labels (low, medium, high, and severe) are output to achieve context-aware dynamic determination of configuration deviation risk. Specifically, this includes: S7.1: Based on the cumulative impact value output from the previous steps, obtain this value as the input variable of the piecewise nonlinear risk level mapping function. The cumulative impact value reflects the direct and indirect risk diffusion effect of the configuration deviation item in the information security compliance knowledge graph, and provides a quantitative basis for subsequent classification. S7.2: Based on the differences in risk sensitivity of different security control items in the Cybersecurity Classified Protection 2.0 standard and the statistical analysis results of historical violations, a piecewise nonlinear risk level mapping function with multiple breakpoints is constructed. The mapping function consists of several linear or power-law sub-intervals with different slopes to adapt to the risk expression requirements of sensitive response in low-value areas and gradual saturation in high-value areas. Based on the cumulative impact value output in step S7.1, a risk response function construction method (parameters: risk sensitivity of safety control items, distribution characteristics of historical violations) is adopted to generate the preliminary structure of the piecewise nonlinear risk level mapping function. Furthermore, by using a sensitivity weight allocation algorithm (parameter: risk coefficient matrix of different security control items), differentiated slope settings are achieved for the low-sensitivity control item interval and the high-sensitivity control item interval, and the initial slope dataset for each risk response segment is obtained. Furthermore, a breakpoint optimization algorithm (parameter: sorted sequence of cumulative impact values ​​of historical violations) is adopted to select the location of the boundary point for each risk level and generate a set of multiple breakpoint thresholds to divide the sub-interval structure of the mapping function; Furthermore, by using slope adjustment and power-law function fitting methods (parameter: sample set of sub-interval influence values), risk response curves in different intervals are fitted, and composite mapping curves containing linear segments and power-law segments are generated to satisfy the dynamic change characteristics of sensitive response in low-value areas and gradual saturation in high-value areas. Furthermore, by utilizing the interval continuity constraint algorithm (parameter: mapping value at adjacent breakpoints), the function smoothing at the junction of sub-intervals is achieved, and a complete piecewise nonlinear risk level mapping function that satisfies the conditions of continuity and monotonicity is obtained; By constructing a piecewise nonlinear mapping function, the cumulative impact value data from the previous step is transformed into a curve mapping structure that satisfies the risk expression characteristics of the information security level protection system, thereby achieving a precise response to different risk ranges. For example, in a risk assessment scenario targeting a database server, the cumulative impact value of the input is 0.72; the security control item is "access control," and historical violation analysis shows that the sensitivity coefficient of this control item is 1.25. The event distribution shows inflection points in risk level change at impact values ​​of 0.3, 0.6, and 0.85. During the construction process, a risk response function construction method is first used. Based on the high sensitivity of access control, a steep slope of 2.1 is set for the low segment, 1.3 for the middle segment, and 0.6 for the high segment. A breakpoint optimization algorithm selects three breakpoints, dividing the interval into [0, 0.3], [0.3, 0.6], [0.6, 0.85], and [0.85, 1]. Linear fitting is used for the first and second segments, and power-law function fitting is used for the third and fourth segments. ,in These are the fitting coefficients. This represents the cumulative impact value. The power-law fitting algorithm obtains the value in the interval [0.6, 0.85]. The value is 1.08, obtained in the interval [0.85, 1]. The cumulative impact value of 0.92 reflects a slowing rate of risk increase. An interval continuity constraint algorithm is used at all interval transitions. By adjusting the starting value of the power-law segment to match the ending value of the previous segment, the continuity and smoothness of the function are ensured. The resulting piecewise nonlinear risk level mapping function achieves a rapid response in the low intervals and exhibits a gradual risk saturation characteristic in the middle and high intervals. In this example, the cumulative impact value of 0.72 is located in the third interval, calculated using the power law. The output of 0.773 maps to a "high" risk level, effectively reflecting the severity of the risk associated with access control deviations in highly sensitive business operations. S7.3: Perform parameterized modeling on the piecewise nonlinear risk level mapping function, set the threshold boundaries and transformation coefficients for each sub-interval, and divide the entire function into four output intervals, corresponding to the four risk level labels of 'low', 'medium', 'high', and 'severe' respectively, to ensure that the mapping process complies with the risk classification specifications under the graded protection system; Based on the constructed piecewise nonlinear risk level mapping function structure, the initial value range and historical statistical distribution of each breakpoint set in S7.2 are obtained as the initial input conditions for parametric modeling. A piecewise threshold fitting algorithm (parameters: set of initial values ​​for breakpoints, set of risk sensitivity coefficients for control items) is adopted to achieve precise setting of the boundaries of each sub-interval of the risk level mapping function; wherein, the boundary values ​​are obtained by optimizing the solution to minimize the probability of misjudgment between levels on the cumulative impact value distribution curve; Furthermore, by using an interval transformation coefficient solution algorithm (parameters: boundary value set, slope constraint of risk response curve within the interval), the linear transformation coefficients or power law transformation coefficients of each sub-interval of the mapping function are calculated, and the sub-interval response slope matrix is ​​obtained, which is used to determine the numerical mapping speed of different risk levels. Furthermore, a curve smoothing and continuity constraint method (parameters: interval boundary values, transformation coefficient matrix) is adopted to achieve first-order and second-order continuity smoothing of the mapping function between sub-intervals, generating an overall response curve without jumps, and ensuring the numerical stability of the risk level conversion process; Furthermore, by using the numerical partition identifier injection method (parameters: a set of four-level risk labels and a set of interval boundary values), a strict binding relationship between each sub-interval of the mapping function and the three-level risk labels of 'low', 'medium', and 'high' is achieved, and an interval-label index table is generated to ensure that the mapping results meet the risk classification specifications under the graded protection system. Through the above algorithm processing, the mapping function corresponding to the cumulative impact value of the previous step is transformed into a parameterized risk level mapping model with precise boundaries, adjustable response slope, good continuity and clear label binding, so as to realize the fine classification of configuration deviation risk under different business scenarios. For example, in a large financial data center environment, the input conditions are: initial breakpoint value set = {0.15, 0.35, 0.65}, control item risk sensitivity coefficient set = {1.2, 1.5, 1.8}, and historical cumulative impact values ​​distributed between 0.05 and 0.9. By optimizing the interval boundaries using a piecewise threshold fitting algorithm, the boundary value set = {0.18, 0.38, 0.62} is calculated. An interval transformation coefficient solution algorithm is used, setting the linear transformation coefficient within the first sub-interval (0-0.18) to... The power-law transformation coefficients are set to [value] within the second subinterval (0.18-0.38). The linear coefficient is set to [value] within the third subinterval (0.38-0.62). The power law coefficient is set to [value] in the fourth subinterval (0.62-1.0). A smoothing method was used to apply continuity constraints at 0.18, 0.38, and 0.62, generating smooth mapping curves. Using an interval-label index table, mapping results with a cumulative impact value less than 0.18 were labeled 'low', those between 0.18 and 0.38 were labeled 'medium', and those greater than 0.38 were labeled 'high'. In actual risk assessment, the model accurately classified the risk levels of different configuration deviation events. The overall classification results were highly consistent with expert judgments on the validation set, significantly improving the standardization and stability of risk classification. S7.4: Substitute the obtained cumulative impact value into the parameterized piecewise nonlinear risk level mapping function, perform piecewise comparison and function calculation, determine the specific threshold interval in which it falls, and generate a unique risk level label based on the output rule corresponding to the interval, thus completing the conversion from continuous risk score to discrete level. S7.5: Output the determined level 4 risk label and associate it with the original configuration deviation node and the activated semantic propagation path evidence chain to form a structured risk assessment result, which serves as the decision input basis for driving the generation of subsequent security hardening suggestions and linkage with the work order system.

[0027] Step S8: The output risk level label and the corresponding semantic propagation path evidence chain are jointly encapsulated into a structured risk assessment record, which is used to drive the subsequent security hardening suggestion generation and work order closed-loop processing flow. Specifically, this includes: S8.1: Based on the four-level risk level labels output from the previous steps and the set of activated semantic propagation paths, construct the original evidence tuple containing the risk subject, scope of impact, path dependency relationship and context weight parameters to form the initial data structure of the risk assessment record, providing complete input for subsequent structured encapsulation; S8.2: Perform field normalization processing on the original evidence tuple, and use the predefined information security compliance model to perform terminology standardization mapping on node identifiers, edge semantic types, and asset context attributes to generate intermediate evidence instances that conform to a unified data pattern, ensuring that the evaluation records of deviation events from different sources have semantic consistency. S8.3: Based on intermediate evidence instances, a hierarchical structured risk assessment record is generated through a nested JSON object construction method. The top-level fields include risk level labels, deviation configuration item IDs, and unique asset identifiers. The secondary fields embed a compressed and encoded semantic propagation path sequence and the influence strength score of each hop node, forming a parsable composite output object. S8.4: Add digital signature and timestamp information to the structured risk assessment record, use asymmetric encryption algorithm to perform integrity protection processing on the record, generate risk assessment credentials with authentication attributes, prevent the record from being tampered with during transmission, and ensure the legal validity and credibility of evidence in the audit traceability process; S8.5: The generated structured risk assessment record is pushed to the security hardening suggestion generation module through a standardized API interface and simultaneously written into the event bus to trigger the work order creation process, realizing the automated flow of risk assessment results to handling actions and completing the technical closed loop from risk identification to response-driven action.

[0028] The technical solution of the present invention has been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will all fall within the scope of protection of the present invention.

[0029] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and rules of the present invention should be included within the scope of protection of the present invention.

Claims

1. A network security configuration verification method for graded protection, characterized in that, Includes the following steps: S1: Construct a compliance knowledge graph based on the Cybersecurity Classified Protection 2.0 standard documents and configuration data; S2: Based on the logical association rules between control items in the Cybersecurity Classified Protection 2.0 standard document, predefine semantic impact path templates, where each template corresponds to a typical deviation event's impact propagation mode; S3: Collect the actual configuration values ​​of the configuration items of the target network assets, and map each configuration item to the corresponding node in the information security compliance knowledge graph to form a set of configuration deviation nodes to be evaluated; S4: For each identified configuration deviation node, match the semantic impact path template that best matches its type, locate and activate the associated local subgraph region in the information security compliance knowledge graph based on the template, and generate a restricted semantic propagation path set. S5: Based on business context information, assign dynamic attenuation coefficients to subsequent nodes on each activated semantic propagation path, combine path length and edge weight to calculate path influence intensity, and output the quantitative influence score of each path. S6: Weight and aggregate the quantified impact scores of all activation paths to generate the cumulative impact value of the configuration deviation item corresponding to the identified configuration deviation node; S7: Input the cumulative impact value into the piecewise nonlinear risk level mapping function, determine the risk level range to which it belongs based on the preset threshold range, and output the risk level label.

2. The network security configuration verification method for graded protection as described in claim 1, characterized in that, The process following step S7 also includes: S8: The risk level label and the corresponding semantic propagation path evidence chain are encapsulated together into a structured risk assessment record, which is used to drive the subsequent security hardening suggestion generation and work order closed-loop processing process.

3. The network security configuration verification method for graded protection as described in claim 1, characterized in that, In the compliance knowledge graph, nodes represent compliance elements, and edges represent three core semantic relationship types: dependency, influence, and satisfaction.

4. The network security configuration verification method for graded protection as described in claim 1, characterized in that, The semantic influence path template is constructed based on known causal chains between control items and is used to limit the scope of reasoning activated in the knowledge graph.

5. The network security configuration verification method for graded protection as described in claim 1, characterized in that, Step S3 specifically includes: Based on the target network asset list, obtain access credentials or probe entry information of the device to be detected, execute multi-protocol adaptation data collection tasks, generate original response messages, perform syntactic structuring processing on the original response messages, and generate standardized device configuration snapshot data. Key security control fields are extracted from the standardized device configuration snapshot data. Features are extracted from unstructured configuration text based on a combination of regular expression matching and syntax tree parsing to generate a security configuration feature vector. The security configuration feature vector is semantically matched with the predefined security control item nodes in the information security compliance knowledge graph, and the similarity result is used as the matching degree. When the matching degree exceeds a preset threshold, the mapping relationship between the configuration item corresponding to the security configuration feature vector and the knowledge graph node is established, and the located compliance check anchor point is output. Based on the standard configuration expected value of each security control item in the aforementioned compliance knowledge graph, a Boolean compliance judgment is performed on the measured configuration value corresponding to the located compliance check anchor point. A logical comparison operation is executed. For configuration items that do not meet the expected conditions, they are marked as configuration deviation instances, and their actual value, expected value, and difference type are recorded to form a preliminary configuration deviation candidate set. The initial set of configuration deviation candidates is filtered and prioritized based on context. Combining asset importance level and network area exposure information, high-potential-risk deviations that affect critical business systems are selected, and these high-potential-risk deviations are encapsulated into a set of configuration deviation nodes to be evaluated.

6. The network security configuration verification method for graded protection as described in claim 5, characterized in that, The key security control fields include the identity authentication mechanism type, password policy strength parameters, access control list rule set, audit log enable status and coverage.

7. The network security configuration verification method for graded protection as described in claim 1, characterized in that, Step S4 specifically includes: Based on the set of semantic influence path templates predefined in step S2, obtain the security control item type and its deviation semantic label of the currently identified configuration deviation node, perform template retrieval operation using the type matching algorithm, and output the optimal matching semantic influence path template; Using the semantic influence path template as input, the semantic jump rule sequence contained therein is parsed. Based on the semantic jump rule sequence, the starting node is locked in the information security compliance knowledge graph constructed in step S1, and a restricted multi-hop adjacency expansion mechanism is started, allowing graph traversal only along edge types and directions that conform to the template definition, generating controlled local subgraph regions. Semantic path pruning is performed on the local subgraph region to remove redundant path branches whose path length exceeds a preset threshold or whose cumulative semantic weight is lower than the minimum influence threshold, and outputs a simplified set of restricted semantic propagation paths. The restricted semantic propagation path set is structured and encoded, with each path represented as an ordered pair of node sequence and edge type sequence, and path source and matching template identifiers are added to form a standardized risk impact reasoning operation domain description file.

8. The network security configuration verification method for graded protection as described in claim 7, characterized in that, The type matching algorithm specifically employs an ontology-based semantic similarity calculation method to align the control item category of the off-node with the starting node type covered by each template.

9. The network security configuration verification method for graded protection according to claim 1, characterized in that, Step S5 specifically includes: The asset importance level and network region sensitivity are obtained as business context input parameters, and they are discretized based on a predefined context classification standard to generate an asset context feature vector. Based on the asset context feature vector, a dynamic decay coefficient is assigned to the subsequent nodes in each activated semantic propagation path. An exponential decay function model is used to jointly model the number of hops the node deviates from the starting point and the context feature vector to calculate the decay factor sequence. Obtain the topological structure data of each path in the restricted semantic propagation path set generated in step S4, extract the initial semantic weight coefficients of the edges traversed by the path, and combine the attenuation factor sequence to perform context-weighted correction on the weight of each edge on the path to generate a dynamic edge weight sequence. Based on the dynamic edge weight sequence, path integral calculation is performed for each semantic propagation path, and the path length is normalized for the corrected edge weights to obtain the intermediate value of path-level influence intensity. The intermediate value of the path-level impact intensity is input into the standardized mapping function, and normalized based on the historical maximum impact intensity benchmark value to generate a quantitative impact score.

10. The network security configuration verification method for graded protection according to claim 1, characterized in that, The cumulative impact value reflects the direct and indirect risk diffusion effects of the original deviation within the compliance knowledge system.

Images