A method and system for determining access rights to enterprise documents

Abstract

The application provides a kind of enterprise document access permission determination method and system, method includes: obtaining query statement in preset historical period and obtaining permission rule;Based on query statement, build annotated sample set, and based on annotated sample set, build primary document semantic analysis model, utilize document semantic analysis model to build representative sample set;According to representative sample set and annotated sample set, build target sample set, based on target sample set, again to primary document semantic analysis model training, obtain document semantic analysis model;Obtain the query statement of current staff, and input it into document semantic analysis model, output each kind of probability distribution of permission attribute;According to permission rule and each kind of probability distribution of permission attribute, determine whether current staff has access permission.The application constructs high-precision document semantic analysis model with minimum annotation cost through layer-by-layer screening mechanism, which is conducive to improving the accuracy of enterprise document permission control.

Description

Technical Field

[0001] This invention relates to the field of enterprise management technology, and more specifically, to a method and system for determining enterprise document access permissions. Background Technology

[0002] As enterprises deepen their IT infrastructure development, document management systems store a large number of sensitive documents containing trade secrets, technical data, and financial information. Employees using natural language queries to quickly retrieve required documents in their daily work has become a crucial means of improving efficiency. However, ensuring that employees can only access documents within their authorized scope, thus preventing the leakage of sensitive information, is a core security challenge facing enterprise document management systems. Summary of the Invention

[0003] The purpose of this invention is to provide a method and system for determining enterprise document access permissions, so as to improve the above-mentioned problems.

[0004] To achieve the above objectives, this application provides the following technical solution:

[0005] On the one hand, embodiments of this application provide a method for determining enterprise document access permissions, the method comprising:

[0006] Retrieve query statements and access rules within a preset historical time period. Each access rule includes the subject's job level, operation type, document type, document security level, and the corresponding access permission result.

[0007] A labeled sample set is constructed based on the query statement, and a primary document semantic parsing model is built based on the labeled sample set. A representative sample set is then constructed using the primary document semantic parsing model. A target sample set is constructed based on the representative sample set and the labeled sample set. The primary document semantic parsing model is then trained again based on the target sample set to obtain a document semantic parsing model. The document semantic parsing model is used to output the probability distribution of each permission attribute of the query statement. The permission attributes include operation type attribute, document type attribute, and document security level attribute.

[0008] Obtain the query statement of the current employee and input it into the document semantic parsing model to output the probability distribution of each permission attribute; based on the permission rules and the probability distribution of each permission attribute, determine whether the current employee has access permissions.

[0009] Secondly, this application provides an enterprise document access permission determination system, the system comprising:

[0010] The acquisition module is used to acquire query statements and access rules within a preset historical time period. Each access rule includes the subject's job level, operation type, document type, document security level, and the corresponding access permission result.

[0011] The construction module is used to build an labeled sample set based on the query statement, and to build a primary document semantic parsing model based on the labeled sample set. The primary document semantic parsing model is then used to build a representative sample set. A target sample set is built based on the representative sample set and the labeled sample set. The primary document semantic parsing model is then trained again based on the target sample set to obtain a document semantic parsing model. The document semantic parsing model is used to output the probability distribution of each permission attribute of the query statement. The permission attributes include operation type attribute, document type attribute, and document security level attribute.

[0012] The determination module is used to obtain the query statement of the current employee and input it into the document semantic parsing model, outputting the probability distribution of each permission attribute; based on the permission rules and the probability distribution of each permission attribute, it determines whether the current employee has access rights.

[0013] Thirdly, this application provides an enterprise document access permission determination device, the device including a memory and a processor. The memory is used to store a computer program; the processor is used to execute the computer program to implement the steps of the above-described enterprise document access permission determination method.

[0014] Fourthly, this application provides a readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the above-described method for determining enterprise document access permissions.

[0015] The beneficial effects of this invention are as follows:

[0016] 1. This invention first calculates the predicted entropy of each unlabeled sample on three permission attributes—operation type, document type, and document security level—through value-based screening, prioritizing the selection of samples with the least model uncertainty to ensure that subsequent screening focuses on the region with the most information. Second, through clustering and surrounding sample screening, the main distribution pattern of the data and surrounding samples in the inter-class transition region are identified, and the two are merged to form an initial screening sample set, ensuring that the main distribution region and key boundary region are included in subsequent screening, so that the model can be fully trained at the decision boundary. Finally, through representativeness screening and diversity screening, the weights of semantic, syntactic, and keyword features are adaptively determined using information entropy, and the overall feature distribution is covered with the fewest samples, while ensuring that the selected samples maintain the maximum difference from the existing labeled samples, thereby comprehensively covering the unknown feature space in multiple dimensions, which is beneficial to improving the accuracy of model training while reducing labeling costs.

[0017] Other features and advantages of the invention will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing embodiments of the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a schematic diagram of the enterprise document access permission determination method described in this embodiment of the invention;

[0020] Figure 2 This is a schematic diagram of the enterprise document access permission determination system described in this embodiment of the invention;

[0021] Figure 3 This is a schematic diagram of the device structure for determining enterprise document access permissions as described in an embodiment of the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0023] It should be noted that similar reference numerals or letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this invention, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0024] Example 1

[0025] like Figure 1 As shown in the figure, this embodiment provides a method for determining enterprise document access permissions, which includes steps S1, S2 and S3.

[0026] Step S1: Obtain the query statements and permission rules within the preset historical time period. Each permission rule includes the subject's job level, operation type, document type, document security level, and the corresponding access permission result.

[0027] In this step, the preset historical period can be the past 1 year, 2 years, etc.; the query statement is the query statement entered by the user, such as "Please help me find last year's annual report PPT", etc.

[0028] Before executing step S2, all query statements can be filtered for anomalies. The remaining query statements are then input into step S2. The anomaly filtering steps include step S11.

[0029] Step S11: Cluster all query statements to obtain multiple clusters; for each cluster: count the number of query statements contained in the cluster, denoted as the cluster size; pair the query statements in the cluster to obtain multiple query statement pairs, and count the total number of query statement pairs, denoted as the total number of pairs; calculate the similarity between the two query statements in each query statement pair, and count the number of query statement pairs with similarity values ​​less than a preset similarity threshold, denoted as the number of low similarity pairs; add the cluster size to the total number of pairs to obtain the total number of items; denoted as the first proportion; subtract 1 from the cluster size to obtain the adjusted size, and then denoted as the second proportion; simultaneously, calculate the average similarity of all query statement pairs in the cluster, denoted as the average similarity; when the first proportion is greater than the second proportion and the average similarity is less than the preset average similarity threshold, delete all query statements in the cluster.

[0030] In this step, assuming the number of query statements in each cluster is A, the total number of query statement pairs is C(A,2)=A×(A-1) / 2.

[0031] Step S2: Construct an labeled sample set based on the query statement, and construct a primary document semantic parsing model based on the labeled sample set. Use the primary document semantic parsing model to construct a representative sample set. Construct a target sample set based on the representative sample set and the labeled sample set. Train the primary document semantic parsing model again based on the target sample set to obtain a document semantic parsing model. The document semantic parsing model is used to output the probability distribution of each permission attribute of the query statement. The permission attributes include operation type attribute, document type attribute, and document security level attribute.

[0032] In this step, a labeled sample set is constructed based on the query statement, and a primary document semantic parsing model is constructed based on the labeled sample set. The specific implementation steps for constructing a representative sample set using the primary document semantic parsing model include steps S21 and S22.

[0033] Step S21: Randomly select a preset number of query statements from all query statements and use them as samples; obtain the annotation information corresponding to each sample to form an annotated sample set. The annotation information includes the probability distribution of multiple permission attributes, and the probability distribution is the probability of different categories under each permission attribute.

[0034] In this step, the probability distribution of various permission attributes can be understood as follows:

[0035] Under the operation type attribute, there are three categories: view, download, and other. The probability distribution of this permission attribute can be understood as follows (e.g., view: 0.85, download: 0.10, other: 0.05).

[0036] The document type attribute can include six categories: PPT, Word, Excel, PDF, Email, and Other. The probability distribution of this permission attribute can be understood as follows (e.g., PPT: 0.90, Word: 0.03, Excel: 0.03, PDF: 0.02, Email: 0.01, Other: 0.01).

[0037] Document security classification can be categorized into four levels: Public, Internal, Confidential, and Top Secret. The probability distribution of this permission level can be understood as follows (e.g., Public: 0.10, Internal: 0.80, Confidential: 0.08, Top Secret: 0.02).

[0038] Step S22: Train the convolutional neural network model using the labeled sample set to obtain a primary document semantic parsing model; input unlabeled query statements as unlabeled samples into the primary document semantic parsing model to obtain the predicted probability distribution of various permission attributes of the unlabeled samples; filter the unlabeled samples based on the predicted probability distribution of various permission attributes of the unlabeled samples to obtain a representative sample set.

[0039] In this step, when training the convolutional neural network model using the labeled sample set, the query statement can be used as input and the labeled information as output to train the convolutional neural network model and obtain a primary document semantic parsing model.

[0040] Meanwhile, in this step, the specific implementation steps for filtering unlabeled samples based on the predicted probability distribution of multiple permission attributes of unlabeled samples to obtain a representative sample set include steps S221 and S222.

[0041] Step S221: For each unlabeled sample, calculate its prediction entropy for each permission attribute. The formula for calculating the prediction entropy is as follows: ,in Let n be the predicted probability of the i-th category on the permission attribute, and n be the total number of categories on the permission attribute; sum the predicted entropy on each permission attribute to obtain the sample value of each unlabeled sample; sort the samples from high to low according to the sample value, select the top K unlabeled samples and record them as the preliminary screening samples;

[0042] Step S222: Perform clustering operations on the preliminary screening samples to obtain multiple preliminary screening sample clusters; count the number of preliminary screening samples contained in each preliminary screening sample cluster, sort the preliminary screening sample clusters in descending order of the number of preliminary screening samples contained, and select the top N preliminary screening sample clusters as target clusters; screen the preliminary screening samples based on the target clusters to obtain a representative sample set.

[0043] In steps S221 and S222, K and N are both positive integers;

[0044] In this step, the K-means clustering algorithm can be used to perform clustering operations on the initial screening samples to be selected; in addition, in this step, the specific implementation steps of screening the initial screening samples based on the target cluster to obtain the representative sample set include steps S2221 and S2222.

[0045] Step S2221: For each target cluster: Calculate the similarity between each candidate initial screening sample that does not belong to any target cluster and each candidate initial screening sample in the target cluster. Take the maximum similarity as the inter-class similarity between the candidate initial screening sample and the target cluster. If the inter-class similarity is greater than a preset first similarity threshold and less than a preset second similarity threshold, then the candidate initial screening sample is recorded as a surrounding sample corresponding to the target cluster.

[0046] The maximum similarity is taken as the inter-class similarity between the candidate initial screening sample and the target cluster. In this step, the candidate initial screening sample is the candidate initial screening sample that does not belong to any target cluster.

[0047] Step S2222: Collect the surrounding samples corresponding to each target cluster and the candidate initial screening samples contained in each target cluster, and then perform deduplication to obtain the initial screening sample set; calculate the semantic features, syntactic features and keyword features of each initial screening sample in the initial screening sample set; based on the semantic features, syntactic features and keyword features of each initial screening sample, calculate the semantic similarity, syntactic similarity and keyword similarity between each pair of initial screening samples to form a semantic similarity matrix, a syntactic similarity matrix and a keyword similarity matrix; obtain the representative sample set based on the semantic similarity matrix, the syntactic similarity matrix and the keyword similarity matrix.

[0048] In this step, conventional methods can be used to extract semantic features, syntactic features, and keyword features. Alternatively, BERT can be used to extract semantic features, LTP to extract syntactic features, and TF-IDF to extract keyword features. Specifically, BERT is used to extract vectors at the [CLS] positions as semantic features, LTP is used to concatenate syntactic component statistics and dependency relation statistics as syntactic features, and TF-IDF is used to calculate keyword weights as keyword features.

[0049] In this step, the specific implementation steps for obtaining the representative sample set based on the semantic similarity matrix, syntactic similarity matrix, and keyword similarity matrix include steps S22221 and S22222.

[0050] Step S22221: Calculate the information entropy of the semantic similarity matrix, syntactic similarity matrix, and keyword similarity matrix respectively, and calculate the reciprocal of the three information entropies. Sum the three reciprocals to obtain the sum of the reciprocals. Divide the reciprocal of the semantic similarity matrix, syntactic similarity matrix, and keyword similarity matrix respectively by the sum of the reciprocals to obtain the weight of semantic similarity, syntactic similarity, and keyword similarity in the comprehensive similarity calculation.

[0051] Step S22222: Place all preliminary screening samples into the first candidate pool and initialize an empty set as a representative queue; calculate the sum of the comprehensive similarities between each preliminary screening sample in the first candidate pool and all other preliminary screening samples in the first candidate pool, wherein the comprehensive similarity between two preliminary screening samples is obtained by weighted summation of semantic similarity, syntactic similarity and keyword similarity; based on the sum of comprehensive similarities, the representative sample set is obtained from the first candidate pool.

[0052] In this step, the specific implementation steps for obtaining the representative sample set based on the sum of comprehensive similarities and the first candidate pool include step S222221;

[0053] Step S222221: Select the initial screening sample with the highest sum of comprehensive similarity as the first representative sample and move it from the first candidate pool into the representative queue; for each remaining initial screening sample in the first candidate pool, calculate its comprehensive similarity with the first representative sample in the current representative queue, and select the initial screening sample with the smallest comprehensive similarity as the second representative sample and move it from the first candidate pool into the representative queue; repeat the following steps until the number of initial screening samples in the representative queue reaches a preset first value, thus obtaining the representative sample set:

[0054] For each remaining preliminary screening sample in the first candidate pool, calculate the maximum comprehensive similarity between each preliminary screening sample and each representative sample in the current representative queue, and move the preliminary screening sample with the minimum maximum comprehensive similarity from the first candidate pool into the representative queue.

[0055] In this step, the overall similarity between each initial screening sample and each representative sample in the current representative queue is calculated, and the largest overall similarity is found as the maximum overall similarity corresponding to each initial screening sample; then the initial screening sample corresponding to the smallest maximum overall similarity is moved from the first candidate pool into the representative queue.

[0056] In step S2, the specific implementation steps for constructing the target sample set based on the representative sample set and the labeled sample set include step S23;

[0057] Step S23: Calculate the similarity between the semantic features of each representative sample in the representative sample set and the semantic features of all labeled samples. Take the maximum similarity and subtract 1 from the maximum similarity to obtain the semantic distance for each representative sample. Calculate the similarity between the syntactic features of each representative sample and the syntactic features of all labeled samples. Take the maximum similarity and subtract 1 from the maximum similarity to obtain the syntactic distance for each representative sample. Calculate the similarity between the keyword features of each representative sample and the keyword features of all labeled samples. Take the maximum similarity and subtract 1 from the maximum similarity to obtain the keyword distance for each representative sample. Use the maximum value among the semantic distance, syntactic distance, and keyword distance as the distance score for each representative sample. Obtain the target sample set based on the distance scores and the representative sample set.

[0058] In this step, after obtaining the target sample set, the target samples in the target sample set are labeled, and then the primary document semantic parsing model is trained to obtain the document semantic parsing model.

[0059] In this step, the specific implementation steps for obtaining the target sample set based on the distance score and the representative sample set include step S231;

[0060] Step S231: Place all representative samples into the second candidate pool and initialize an empty set as the target queue; select the representative sample with the highest distance score as the first target sample and move it from the second candidate pool into the target queue; for each remaining representative sample in the second candidate pool, repeat the following steps until the number of target samples in the target queue reaches a preset second value, thus obtaining the target sample set:

[0061] For each remaining representative sample in the second candidate pool, calculate the semantic distance, syntactic distance, and keyword distance of each representative sample relative to the labeled sample set and the current target queue. Take the maximum value among the semantic distance, syntactic distance, and keyword distance as the distance score of each representative sample, and move the representative sample with the highest distance score from the second candidate pool into the target queue.

[0062] In this step, calculating the semantic distance of each representative sample relative to the labeled sample set and the current target queue can be understood as follows: for each remaining representative sample in the candidate pool, calculate the similarity between each representative sample and the query statements in the labeled sample set and the current target queue, take the maximum similarity, and subtract the maximum similarity from 1 to obtain the semantic distance corresponding to each representative sample; the syntactic distance and keyword distance are calculated in the same way.

[0063] The goal of step S2 above is to select a small number of samples from a massive amount of unlabeled queries for labeling, minimizing labeling costs while maximizing model performance improvement. The entire selection process employs a four-level progressive mechanism:

[0064] Level 1: First, calculate the predicted entropy for each unlabeled sample across three permission attributes: operation type, document type, and document security level. Sum these three entropy values ​​to obtain the sample's value. Predictive entropy reflects the model's uncertainty in judging the sample; a higher entropy value indicates a greater amount of information contained in the sample and a greater potential contribution to model improvement. After sorting samples by value from highest to lowest, select the top K samples as initial screening candidates to ensure that subsequent screening focuses on the areas where the model is most uncertain.

[0065] The second stage involves K-means clustering of the initial screening samples to obtain multiple clusters. The number of samples in each cluster is counted, and the top N largest clusters are selected as target clusters, representing the main distribution pattern of the data. For each target cluster, surrounding samples with moderate similarity (inter-class similarity greater than a first threshold and less than a second threshold) are selected. These samples are located in the inter-class transition region and have the highest discriminative value. Then, all samples within the target clusters are merged with the selected surrounding samples to form the initial screening sample set. This step ensures that both the main distribution areas and key boundary areas are included in subsequent screening.

[0066] The third level: The first representative sample is selected based on the maximum sum of similarities with all other samples (best representing the whole). Subsequent representative samples are selected based on the minimum sum of similarities with the selected representative samples (least similar to the selected samples). This process is iterated until a predetermined number of representative samples are selected, forming a representative sample set. This mechanism can cover the feature distribution of the entire initial screening sample set with the fewest samples, effectively removing redundancy.

[0067] Level 4: Based on the representative sample set, calculate the semantic distance, syntactic distance, and keyword distance between each representative sample and the labeled sample set. Take the maximum of these three distances as the distance score, and prioritize selecting the sample with the highest distance score as the first target sample. Subsequently, dynamically update the distance scores of the remaining samples relative to the "labeled sample set + selected target sample set" to ensure that subsequently selected samples maintain maximum difference from the entire existing sample set. Iterate until a predetermined number of target samples are selected. This strategy guarantees that the final selected target sample set comprehensively covers the unknown feature space across multiple dimensions (semantics, syntax, keywords), maximizing sample diversity.

[0068] Step S3: Obtain the query statement of the current employee and input it into the document semantic parsing model to output the probability distribution of each permission attribute; determine whether the current employee has access rights based on the permission rules and the probability distribution of each permission attribute.

[0069] In this step, the specific implementation steps for determining whether the current employee has access rights based on the permission rules and the probability distribution of each permission attribute include step S31;

[0070] Step S31: Obtain the current employee's job level; take the category with the largest value in the probability distribution of each permission attribute as the target category for each permission attribute, and obtain the first target category for operation type attribute, the second target category for document type attribute, and the third target category for document security level attribute; perform matching, if there is a rule that simultaneously satisfies the following conditions, then determine that the current employee has access rights, otherwise determine that the current employee does not have access rights:

[0071] The main job level specified in the rules should match the current employee's job level;

[0072] The operation type specified in the rule matches the first target category;

[0073] The document type specified in the rule matches the second target category;

[0074] The document security classification specified in the rules matches the third target category;

[0075] The access permission result for the rule is "allowed".

[0076] This step can be understood as follows: First, obtain the current employee's job level; then, take the category with the highest probability value in the probability distribution of each permission attribute output by the model as the target category of that permission attribute. For example, if the probability distribution of the operation type attribute output by the model is [View: 0.85, Download: 0.10, Other: 0.05], then "View" is taken as the target category of the operation type attribute; finally, match the current employee's job level and the three target categories of operation type attribute, document type attribute, and document security level attribute with each rule in the permission rule base; for example, if the current employee's job level is "Supervisor", the target categories are operation type attribute: "View", document type attribute: "PPT", and document security level attribute: "Internal", and there is a rule in the rule base that is: Employee Job Level = Supervisor, Operation Type = View, Document Type = PPT, Document Security Level = Internal, Access Permission Result = Allowed, then all four conditions are matched, and access permission is determined; after determining that access permission is granted, the corresponding authorization operation can be executed according to the operation type specified in the permission rule. For example, the system can then return the preview content of the document.

[0077] In this step, the permission rules adopt a structured format based on subject level, operation type, document type, and document security level. The rules are logically clear, facilitating flexible configuration and adjustment by administrators according to the enterprise's security policy. When permission rules need to be updated, only the rule base needs to be modified, without retraining the model, greatly reducing system maintenance costs. Simultaneously, the entire permission determination process is automated, requiring no manual intervention, and can respond to user queries in real time, ensuring the efficiency and accuracy of enterprise document access control and providing reliable technical protection for the secure management of sensitive enterprise information.

[0078] Example 2

[0079] like Figure 2 As shown in the figure, this embodiment provides an enterprise document access permission determination system, which includes an acquisition module 1, a construction module 2, and a determination module 3.

[0080] Module 1 is used to obtain query statements and access rules within a preset historical time period. Each access rule includes the subject's job level, operation type, document type, document security level, and the corresponding access permission result.

[0081] Module 2 is used to construct an labeled sample set based on the query statement, and to construct a primary document semantic parsing model based on the labeled sample set. The primary document semantic parsing model is then used to construct a representative sample set. A target sample set is constructed based on the representative sample set and the labeled sample set. The primary document semantic parsing model is then trained again based on the target sample set to obtain a document semantic parsing model. The document semantic parsing model is used to output the probability distribution of each permission attribute of the query statement. The permission attributes include operation type attribute, document type attribute, and document security level attribute.

[0082] Module 3 is used to obtain the query statement of the current employee and input it into the document semantic parsing model, outputting the probability distribution of each permission attribute; based on the permission rules and the probability distribution of each permission attribute, it determines whether the current employee has access rights.

[0083] In one specific embodiment of this disclosure, the construction module 2 further includes a labeling unit 21 and a filtering unit 22.

[0084] The annotation unit 21 is used to randomly select a preset number of query statements from all query statements and use them as samples; obtain the annotation information corresponding to each sample to form an annotated sample set. The annotation information includes the probability distribution of multiple permission attributes, and the probability distribution is the probability of different categories under each permission attribute.

[0085] The filtering unit 22 is used to train the convolutional neural network model using the labeled sample set to obtain a primary document semantic parsing model; input unlabeled query statements as unlabeled samples into the primary document semantic parsing model to obtain the predicted probability distribution of multiple permission attributes of the unlabeled samples; and filter the unlabeled samples based on the predicted probability distribution of multiple permission attributes of the unlabeled samples to obtain a representative sample set.

[0086] In one specific embodiment of this disclosure, the screening unit 22 further includes a sorting unit 221 and a clustering unit 222.

[0087] Sorting unit 221 is used to calculate the prediction entropy of each unlabeled sample for each permission attribute. The formula for calculating the prediction entropy is as follows: ,in Let n be the predicted probability of the i-th category on the permission attribute, and n be the total number of categories on the permission attribute; sum the predicted entropy on each permission attribute to obtain the sample value of each unlabeled sample; sort the samples from high to low according to the sample value, select the top K unlabeled samples and record them as the preliminary screening samples;

[0088] Clustering unit 222 is used to perform clustering operations on the preliminary screening samples to obtain multiple preliminary screening sample clusters; count the number of preliminary screening samples contained in each preliminary screening sample cluster, sort the preliminary screening sample clusters in descending order of the number of preliminary screening samples contained, and select the top N preliminary screening sample clusters as target clusters; screen the preliminary screening samples based on the target clusters to obtain a representative sample set.

[0089] In one specific embodiment of this disclosure, the clustering unit 222 further includes a first calculation unit 2221 and a second calculation unit 2222.

[0090] The first calculation unit 2221 is used for each target cluster to: calculate the similarity between each candidate initial screening sample that does not belong to any target cluster and each candidate initial screening sample in the target cluster, take the maximum similarity as the inter-class similarity between the candidate initial screening sample and the target cluster, and if the inter-class similarity is greater than a preset first similarity threshold and less than a preset second similarity threshold, then the candidate initial screening sample is recorded as the surrounding sample corresponding to the target cluster;

[0091] The second calculation unit 2222 is used to collect the surrounding samples corresponding to each target cluster and the candidate preliminary screening samples contained in each target cluster, and then perform a deduplication operation to obtain a preliminary screening sample set; calculate the semantic features, syntactic features and keyword features of each preliminary screening sample in the preliminary screening sample set; calculate the semantic similarity, syntactic similarity and keyword similarity between pairs of preliminary screening samples based on the semantic features, syntactic features and keyword features of each preliminary screening sample, forming a semantic similarity matrix, a syntactic similarity matrix and a keyword similarity matrix; and obtain a representative sample set based on the semantic similarity matrix, the syntactic similarity matrix and the keyword similarity matrix.

[0092] In one specific embodiment of this disclosure, the second calculation unit 2222 further includes a third calculation unit 22221 and a fourth calculation unit 22222.

[0093] The third calculation unit 22221 is used to calculate the information entropy of the semantic similarity matrix, the syntactic similarity matrix and the keyword similarity matrix respectively, and calculate the reciprocal of the three information entropies. The three reciprocals are summed to obtain the sum of the reciprocals. The reciprocals corresponding to the semantic similarity matrix, the syntactic similarity matrix and the keyword similarity matrix are divided by the sum of the reciprocals to obtain the weights of semantic similarity, syntactic similarity and keyword similarity in the comprehensive similarity calculation.

[0094] The fourth calculation unit 22222 is used to put all the initial screening samples into the first candidate pool and initialize an empty set as a representative queue; calculate the sum of the comprehensive similarity between each initial screening sample in the first candidate pool and all other initial screening samples in the first candidate pool, wherein the comprehensive similarity between two initial screening samples is obtained by weighted summation of semantic similarity, syntactic similarity and keyword similarity; and obtain the representative sample set based on the comprehensive similarity sum and the first candidate pool.

[0095] It should be noted that the specific methods by which each module performs operations in the system described in the above embodiments have been described in detail in the embodiments related to the method, and will not be elaborated here.

[0096] Example 3

[0097] Corresponding to the above method embodiments, this disclosure also provides an enterprise document access permission determination device. The enterprise document access permission determination device described below and the enterprise document access permission determination method described above can be referred to each other.

[0098] Figure 3 This is a block diagram illustrating the determination of enterprise document access permissions for device 300 according to an exemplary embodiment. For example... Figure 3 As shown, the enterprise document access permission determination device 300 may include: a processor 301 and a memory 302. The enterprise document access permission determination device 300 may also include one or more of a multimedia component 303, an I / O interface 304, and a communication component 305.

[0099] The processor 301 controls the overall operation of the enterprise document access permission determination device 300 to complete all or part of the steps in the enterprise document access permission determination method described above. The memory 302 stores various types of data to support the operation of the enterprise document access permission determination device 300. This data may include, for example, instructions for any application or method operating on the enterprise document access permission determination device 300, and application-related data such as contact data, sent and received messages, images, audio, video, etc. The memory 302 can be implemented using any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The multimedia component 303 may include a screen and an audio component. The screen may be, for example, a touchscreen, and the audio component is used to output and / or input audio signals. For example, the audio component may include a microphone for receiving external audio signals. The received audio signals may be further stored in the memory 302 or transmitted via the communication component 305. The audio component also includes at least one speaker for outputting audio signals. I / O interface 304 provides an interface between processor 301 and other interface modules, such as keyboards, mice, and buttons. These buttons can be virtual or physical. Communication component 305 is used for wired or wireless communication between the enterprise document access permission determination device 300 and other devices. Wireless communication includes Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G, or 4G, or a combination thereof. Therefore, the corresponding communication component 305 may include a Wi-Fi module, a Bluetooth module, and an NFC module.

[0100] In one exemplary embodiment, the enterprise document access permission determination device 300 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the enterprise document access permission determination method described above.

[0101] In another exemplary embodiment, a computer-readable storage medium including program instructions is also provided, which, when executed by a processor, implement the steps of the enterprise document access permission determination method described above. For example, the computer-readable storage medium may be the memory 302 including the program instructions described above, which may be executed by the processor 301 of the enterprise document access permission determination device 300 to complete the enterprise document access permission determination method described above.

[0102] Example 4

[0103] Corresponding to the above method embodiments, this disclosure also provides a readable storage medium. The readable storage medium described below can be referred to in conjunction with the enterprise document access permission determination method described above.

[0104] A readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the enterprise document access permission determination method described in the above method embodiments.

[0105] Specifically, the readable storage medium can be a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, or any other readable storage medium capable of storing program code.

[0106] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for determining enterprise document access permissions, characterized in that, include: Retrieve query statements and access rules within a preset historical time period. Each access rule includes the subject's job level, operation type, document type, document security level, and the corresponding access permission result. A labeled sample set is constructed based on the query statement, and a primary document semantic parsing model is constructed based on the labeled sample set. A representative sample set is then constructed using the primary document semantic parsing model. A target sample set is constructed based on the representative sample set and the labeled sample set. The primary document semantic parsing model is trained again based on the target sample set to obtain the document semantic parsing model. The document semantic parsing model is used to output the probability distribution of each permission attribute of the query statement. The permission attributes include operation type attribute, document type attribute, and document security level attribute. Obtain the query statement of the current employee and input it into the document semantic parsing model, outputting the probability distribution of each permission attribute; based on the permission rules and the probability distribution of each permission attribute, determine whether the current employee has access permissions. This process involves constructing an labeled sample set based on the query statement, building a preliminary document semantic parsing model based on the labeled sample set, and then using the preliminary document semantic parsing model to construct a representative sample set, including: A preset number of query statements are randomly selected from all query statements and used as samples; the annotation information corresponding to each sample is obtained to form an annotated sample set. The annotation information includes the probability distribution of multiple permission attributes, and the probability distribution is the probability of different categories under each permission attribute. A convolutional neural network model is trained using a labeled sample set to obtain a primary document semantic parsing model. Unlabeled query statements are input into the primary document semantic parsing model as unlabeled samples to obtain the predicted probability distribution of various permission attributes of the unlabeled samples. Based on the predicted probability distribution of various permission attributes of the unlabeled samples, the unlabeled samples are filtered to obtain a representative sample set. Among them, the unlabeled samples are filtered based on the predicted probability distribution of multiple permission attributes to obtain a representative sample set, including: For each unlabeled sample, calculate its prediction entropy for each permission attribute. The formula for calculating the prediction entropy is as follows: ,in Let n be the predicted probability of the i-th category on the permission attribute, and n be the total number of categories on the permission attribute; sum the predicted entropy on each permission attribute to obtain the sample value of each unlabeled sample; sort the samples from high to low according to their sample value, select the top K unlabeled samples and record them as the preliminary screening samples; Clustering operations are performed on the preliminary screening samples to obtain multiple preliminary screening sample clusters; the number of preliminary screening samples contained in each preliminary screening sample cluster is counted, and the preliminary screening sample clusters are sorted from largest to smallest according to the number of preliminary screening samples contained. The top N preliminary screening sample clusters are selected as target clusters; the preliminary screening samples are screened based on the target clusters to obtain a representative sample set; Among them, the initial screening samples are selected based on the target cluster to obtain a representative sample set, including: For each target cluster: calculate the similarity between each candidate initial screening sample that does not belong to any target cluster and each candidate initial screening sample in the target cluster, and take the maximum similarity as the inter-class similarity between the candidate initial screening sample and the target cluster. If the inter-class similarity is greater than a preset first similarity threshold and less than a preset second similarity threshold, then the candidate initial screening sample is recorded as the surrounding sample corresponding to the target cluster. The surrounding samples corresponding to each target cluster, as well as the candidate initial screening samples contained in each target cluster, are collected and then deduplicated to obtain the initial screening sample set. The semantic features, syntactic features, and keyword features of each initial screening sample in the initial screening sample set are calculated. Based on the semantic features, syntactic features, and keyword features of each initial screening sample, the semantic similarity, syntactic similarity, and keyword similarity between each pair of initial screening samples are calculated to form a semantic similarity matrix, a syntactic similarity matrix, and a keyword similarity matrix. Based on the semantic similarity matrix, the syntactic similarity matrix, and the keyword similarity matrix, a representative sample set is obtained. The representative sample set, obtained based on the semantic similarity matrix, syntactic similarity matrix, and keyword similarity matrix, includes: Calculate the information entropy of the semantic similarity matrix, syntactic similarity matrix, and keyword similarity matrix respectively, and calculate the reciprocal of the three information entropies. Sum the three reciprocals to obtain the sum of the reciprocals. Divide the reciprocal of the semantic similarity matrix, syntactic similarity matrix, and keyword similarity matrix respectively by the sum of the reciprocals to obtain the weight of semantic similarity, syntactic similarity, and keyword similarity in the comprehensive similarity calculation. All preliminary screening samples are placed into the first candidate pool, and an empty set is initialized as the representative queue. The sum of the comprehensive similarities between each preliminary screening sample in the first candidate pool and all other preliminary screening samples in the first candidate pool is calculated. The comprehensive similarity between two preliminary screening samples is obtained by weighted summation of semantic similarity, syntactic similarity and keyword similarity. The representative sample set is obtained based on the sum of comprehensive similarities and the first candidate pool.

2. A system for determining enterprise document access permissions, characterized in that, include: The acquisition module is used to acquire query statements and access rules within a preset historical time period. Each access rule includes the subject's job level, operation type, document type, document security level, and the corresponding access permission result. The construction module is used to build a labeled sample set based on the query statement, build a primary document semantic parsing model based on the labeled sample set, and build a representative sample set using the primary document semantic parsing model; A target sample set is constructed based on the representative sample set and the labeled sample set. The primary document semantic parsing model is trained again based on the target sample set to obtain the document semantic parsing model. The document semantic parsing model is used to output the probability distribution of each permission attribute of the query statement. The permission attributes include operation type attribute, document type attribute, and document security level attribute. The determination module is used to obtain the query statement of the current employee, input it into the document semantic parsing model, and output the probability distribution of each permission attribute; Based on the permission rules and the probability distribution of each permission attribute, determine whether the current employee has access permissions; The building modules include: The annotation unit is used to randomly select a preset number of query statements from all query statements and use them as samples; obtain the annotation information corresponding to each sample to form an annotated sample set. The annotation information includes the probability distribution of multiple permission attributes, and the probability distribution is the probability of different categories under each permission attribute. The filtering unit is used to train the convolutional neural network model using the labeled sample set to obtain a primary document semantic parsing model; input unlabeled query statements as unlabeled samples into the primary document semantic parsing model to obtain the predicted probability distribution of various permission attributes of the unlabeled samples; and filter the unlabeled samples based on the predicted probability distribution of various permission attributes of the unlabeled samples to obtain a representative sample set. The filtering unit includes: The sorting unit is used to calculate the prediction entropy of each unlabeled sample for each permission attribute. The formula for calculating the prediction entropy is as follows: ,in Let n be the predicted probability of the i-th category on the permission attribute, and n be the total number of categories on the permission attribute; sum the predicted entropy on each permission attribute to obtain the sample value of each unlabeled sample; sort the samples from high to low according to the sample value, select the top K unlabeled samples and record them as the preliminary screening samples; Clustering units are used to perform clustering operations on the preliminary screening samples to obtain multiple preliminary screening sample clusters; the number of preliminary screening samples contained in each preliminary screening sample cluster is counted, and the preliminary screening sample clusters are sorted from largest to smallest according to the number of preliminary screening samples contained, and the top N preliminary screening sample clusters are selected as target clusters; the preliminary screening samples are screened based on the target clusters to obtain a representative sample set; The clustering unit includes: The first calculation unit is used for each target cluster to: calculate the similarity between each candidate initial screening sample that does not belong to any target cluster and each candidate initial screening sample in the target cluster, take the maximum similarity as the inter-class similarity between the candidate initial screening sample and the target cluster, and if the inter-class similarity is greater than a preset first similarity threshold and less than a preset second similarity threshold, then the candidate initial screening sample is recorded as the surrounding sample corresponding to the target cluster; The second calculation unit is used to aggregate the surrounding samples corresponding to each target cluster and the candidate initial screening samples contained in each target cluster, and then perform a deduplication operation to obtain the initial screening sample set; calculate the semantic features, syntactic features, and keyword features of each initial screening sample in the initial screening sample set; based on the semantic features, syntactic features, and keyword features of each initial screening sample, calculate the semantic similarity, syntactic similarity, and keyword similarity between each pair of initial screening samples, forming a semantic similarity matrix, a syntactic similarity matrix, and a keyword similarity matrix; and obtain the representative sample set based on the semantic similarity matrix, the syntactic similarity matrix, and the keyword similarity matrix. The second computing unit includes: The third calculation unit is used to calculate the information entropy of the semantic similarity matrix, syntactic similarity matrix and keyword similarity matrix respectively, and calculate the reciprocal of the three information entropies. The three reciprocals are summed to obtain the sum of the reciprocals. The reciprocals of the semantic similarity matrix, syntactic similarity matrix and keyword similarity matrix are divided by the sum of the reciprocals to obtain the weight of semantic similarity, syntactic similarity and keyword similarity in the comprehensive similarity calculation. The fourth calculation unit is used to put all the initial screening samples into the first candidate pool and initialize an empty set as a representative queue; calculate the sum of the comprehensive similarity between each initial screening sample in the first candidate pool and all other initial screening samples in the first candidate pool, wherein the comprehensive similarity between two initial screening samples is obtained by weighted summation of semantic similarity, syntactic similarity and keyword similarity; and obtain the representative sample set based on the sum of comprehensive similarity and the first candidate pool.

Images