Configuration file auditing method and device, electronic equipment, medium and program product

Abstract

This application provides a configuration file review method, apparatus, electronic device, medium, and program product, which can be applied in the field of big data technology, involving the application of large models in artificial intelligence, information security, and fintech. The method includes: acquiring an initial configuration file and a standardized configuration file of a target device; processing the initial configuration file and the standardized configuration file to obtain first structured configuration data and second structured configuration data; inputting the second structured configuration data into a pre-trained semantic vector model to generate semantic vectors; extracting key configuration information from the first structured configuration data and inputting it into the pre-trained semantic vector model to generate query vectors; filtering target semantic vectors from the semantic vectors based on the similarity between the query vector and the semantic vectors; acquiring second structured configuration data of the target semantic vectors and generating prompt words with the first structured configuration data; and inputting these prompt words into a pre-trained large language model to obtain the review result of the initial configuration file.

Description

Technical Field

[0001] This application relates to the field of big data technology, specifically to the application of large models in artificial intelligence, information security, and fintech, and more specifically to a configuration file review method, device, electronic device, medium, and program product. Background Technology

[0002] Currently, the review of device configuration files mainly relies on manual review or automated review based on rule engines. When reviewing configuration files using a rule engine, it is necessary to build rule matching modules for each different configuration item in the configuration file, and these rule matching modules need to be continuously maintained.

[0003] Therefore, when faced with configuration files that are diverse in format and complex in semantics, simply relying on the rule matching module to review the device's configuration files can easily lead to problems such as low review efficiency and high maintenance costs for the rule matching module. Summary of the Invention

[0004] In view of the above problems, this application provides a configuration file review method, apparatus, electronic device, storage medium, and program product, which can improve the review efficiency of configuration files of target devices.

[0005] According to the first aspect of this application, a configuration file review method is provided, comprising: obtaining an initial configuration file and multiple standardized configuration files of a target device; performing structured processing on the initial configuration file and the multiple standardized configuration files respectively to obtain first structured configuration data and multiple second structured configuration data; inputting each second structured configuration data into a pre-trained semantic vector model to generate a semantic vector; extracting key configuration information from the first structured configuration data; inputting the key configuration information into the pre-trained semantic vector model to generate a query vector; calculating the similarity between the query vector and each of the multiple semantic vectors; selecting at least one target semantic vector from the multiple semantic vectors based on the similarity; obtaining the second structured configuration data corresponding to the at least one target semantic vector; generating prompt words based on the at least one second structured configuration data and the first structured configuration data; inputting the prompt words into a pre-trained large language model to obtain the review result of the initial configuration file.

[0006] According to an embodiment of this application, the initial configuration file includes a text configuration file. The initial configuration file and multiple specification configuration files are subjected to structuring processing to obtain first structured configuration data and multiple second structured configuration data, including: extracting multiple configuration data fragments from the text configuration file according to a preset regular expression; performing semantic analysis on the multiple configuration data fragments to obtain semantic relationships between the multiple target configuration data fragments; and combining the multiple target configuration data fragments according to the semantic relationships to obtain the first structured configuration data corresponding to the text-based configuration data.

[0007] According to an embodiment of this application, the initial configuration file includes an image-based configuration file. The initial configuration file and multiple standard configuration files are subjected to structuring processing to obtain first structured configuration data and multiple second structured configuration data, including: identifying multiple text information items in the image-based configuration file; inputting the image-based configuration file into a pre-trained visual understanding model to obtain network topology elements; performing association analysis on the text information and network topology elements based on a multimodal association algorithm to obtain the association relationship between the text information and the network topology elements; and combining the multiple text information items according to the association relationship to obtain the first structured configuration data corresponding to the image-based configuration file.

[0008] According to an embodiment of this application, structuring an initial configuration file and multiple specification configuration files to obtain first structured configuration data and multiple second structured configuration data includes: obtaining structural identification information of multiple initial specification configuration files; and dividing the initial specification configuration files by boundary based on the structural identification information to obtain multiple second structured configuration data.

[0009] According to an embodiment of this application, the pre-trained semantic vector model includes an encoding layer and a normalization layer arranged sequentially; inputting each second structured configuration data into the pre-trained semantic vector model to generate a semantic vector includes: the pre-trained semantic vector model includes an encoding layer and a normalization layer arranged sequentially; inputting each second structured configuration data into the encoding layer to generate an encoding vector; and inputting each encoding vector into the normalization layer to generate a semantic vector.

[0010] According to an embodiment of this application, the standardized configuration data includes standardized configuration information. After inputting the key configuration information into a pre-trained semantic vector model to generate a query vector, the method further includes: classifying multiple standardized configuration data according to the standardized configuration information to obtain multiple standardized configuration data partitions corresponding to the multiple standardized configuration data, wherein each standardized configuration data partition includes at least one standardized configuration data; comparing the key configuration information with the multiple standardized configuration information to determine at least one target standardized configuration information; determining the standardized configuration data partition associated with the at least one target standardized configuration information; and using the multiple semantic vectors corresponding to the standardized configuration data in the standardized configuration data partition as objects for similarity calculation with the query vector.

[0011] According to an embodiment of this application, the first structured configuration data includes configuration data to be reviewed, and the second structured configuration data includes specification clauses corresponding to the configuration data to be reviewed. Generating prompt words based on at least one second structured configuration data and the first structured configuration data includes: the first structured configuration data includes configuration data to be reviewed, the second structured configuration data includes specification clauses corresponding to the configuration data to be reviewed, obtaining a preset prompt template, identifying dynamic variable placeholders in the preset prompt template, wherein the dynamic variable placeholders include at least: specification clause placeholders and configuration data to be reviewed placeholders; filling the configuration data to be reviewed from the first structured configuration data into the configuration data to be reviewed placeholders; filling the specification clauses from at least one second structured configuration data into the specification clause placeholders; and using the filled preset prompt template as the prompt word.

[0012] A second aspect of this application provides a configuration file review device, comprising: a structured processing module for acquiring an initial configuration file and multiple standardized configuration files of a target device, performing structured processing on the initial configuration file and the multiple standardized configuration files respectively to obtain first structured configuration data and multiple second structured configuration data; a semantic vector generation module for inputting each second structured configuration data into a pre-trained semantic vector model to generate a semantic vector; a query vector generation module for extracting key configuration information from the first structured configuration data, inputting the key configuration information into the pre-trained semantic vector model to generate a query vector; a semantic vector filtering module for calculating the similarity between the query vector and each of the multiple semantic vectors, filtering at least one target semantic vector from the multiple semantic vectors based on the similarity, and obtaining the second structured configuration data corresponding to the at least one target semantic vector; and a configuration file review module for generating prompt words based on at least one second structured configuration data and the first structured configuration data, inputting the prompt words into a pre-trained large language model to obtain the review result of the initial configuration file.

[0013] A third aspect of this application provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0014] A fourth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0015] The fifth aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method. Attached Figure Description

[0016] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0017] Figure 1 The illustration schematically depicts application scenarios of the configuration file review method, apparatus, device, medium, and program product according to embodiments of this application;

[0018] Figure 2 A flowchart illustrating a configuration file review method according to an embodiment of this application is shown schematically.

[0019] Figure 3 A flowchart illustrating the processing of text-based configuration files according to an embodiment of this application is shown schematically.

[0020] Figure 4 A flowchart illustrating the processing of image class configuration files according to an embodiment of this application is shown schematically;

[0021] Figure 5 A flowchart illustrating the determination of a query computation object according to an embodiment of this application is shown schematically;

[0022] Figure 6 A flowchart illustrating the determination of prompt words according to an embodiment of this application is shown schematically;

[0023] Figure 7 This schematically illustrates a structural block diagram of a configuration file review device according to an embodiment of this application; and

[0024] Figure 8 A block diagram schematically illustrates an electronic device suitable for implementing a configuration file review method according to an embodiment of this application. Detailed Implementation

[0025] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0026] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0027] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0028] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0029] Figure 1 The illustration shows an application scenario diagram of the configuration file review method, apparatus, device, medium, and program product according to embodiments of this application.

[0030] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0031] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0032] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0033] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0034] It should be noted that the configuration file review method provided in this application embodiment can generally be executed by server 105. Correspondingly, the data storage device provided in this application embodiment can generally be located in server 105. The configuration file review method provided in this application embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the data storage device provided in this application embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0035] It should be understood that Figure 1The number of terminal devices, networks, and servers shown is merely illustrative. Any number of terminal devices, networks, and servers can be used depending on implementation needs. It should be noted that this application can be applied to the field of big data technology, involving the application of large models in artificial intelligence, information security, and fintech, specifically relating to a configuration file auditing method, device, electronic device, medium, and program product. Network device configurations not only vary in format and semantic complexity depending on the manufacturer, but the data centers and network infrastructure of fintech institutions must also strictly adhere to financial industry cybersecurity standards. Therefore, relying solely on static rules for literal matching makes it difficult to understand the security intent and compliance implications of configuration entries in the actual business environment, easily leading to audit blind spots and high false positive and false negative rates. Furthermore, with the cloudification and distributed architecture evolution of financial businesses and the continuous updates to security policies, the maintenance cost of rule templates has significantly increased, auditing efficiency is low, and it is difficult to meet the high availability and high security requirements of financial businesses. The configuration file review method adopted in this application can deeply understand the semantics of network configuration, automatically associate with relevant security specifications in the financial technology field, and has intelligent review capabilities with continuous learning capabilities. This can improve the accuracy and efficiency of network configuration compliance review, reduce reliance on manual rule maintenance, and provide reliable support for the stable and secure operation of financial business.

[0036] It should be noted that the configuration file review method, apparatus, electronic device, medium and program product of this application embodiment can also be used in scenarios such as network security management and business system configuration compliance checks in the financial technology field. The application fields of the configuration file review method, apparatus, electronic device, medium and program product of this application are not limited.

[0037] The following will be based on Figure 1 The described scene, through Figures 2-6 The configuration file review method according to the embodiments of this application will be described in detail.

[0038] Figure 2 A flowchart illustrating a configuration file review method according to an embodiment of this application is shown schematically.

[0039] like Figure 2 As shown, the configuration file review method in this embodiment includes operations S210 to S250.

[0040] In operation S210, the initial configuration file and multiple specification configuration files of the target device are obtained, and the initial configuration file and multiple specification configuration files are processed into structured data to obtain first structured configuration data and multiple second structured configuration data.

[0041] In this embodiment, the initial configuration file of the target device is obtained, and the initial configuration file is processed into a structured form to obtain the first structured configuration data. For example, the target device may be a router, switch, firewall, load balancer, or other such device.

[0042] For example, the initial configuration file of the target device can be obtained through a network management platform, device interface, or configuration file management system. The initial configuration file can then be formatted, segmented, and structured to obtain the first structured configuration data. The device interface can adapt to various network protocols, such as the Simple Network Management Protocol (SMMP) and the Network Configuration Protocol (NIC).

[0043] For example, when the target device is a firewall device, the initial configuration file of the firewall device contains the following key information: collection record identifier, device physical identifier, device logical name, and extended text content, wherein the extended text content includes optical character recognition screenshots.

[0044] For example, the initial configuration file of the obtained firewall device is processed into structured data to obtain the first structured configuration data, including: according to the device type of the firewall device, calling the corresponding parser to format and rewrite the initial configuration file of the firewall device to obtain a structured list of configuration fragments; and using the structured list of configuration fragments as the first structured configuration data.

[0045] For example, the first structured configuration data contains key information such as configuration fragment identifier, device physical identifier code, configuration fragment type, and original line number range. The mapping relationship between the first structured configuration data and the initial configuration file can be indexed by the original line number range contained in the first structured configuration data, so that the first structured data can be traced back to the content of the initial configuration file.

[0046] For example, after a network change is completed, event-driven trigger signals can be received through the Application Programming Interface (API) to collect the initial configuration file of the target device.

[0047] In this embodiment, multiple specification configuration files are obtained, and these files are then processed in a structured manner to obtain multiple second structured configuration data. These specification configuration files include internally maintained network security technical specifications, configuration templates, policy documents, and other related content.

[0048] For example, the structured processing of multiple specification configuration files includes standardization and semantic vectorization encoding. After semantic vectorization encoding, multiple second-structured configuration data are formed, which can be used for subsequent semantic retrieval and compliance comparison. The second-structured configuration data includes: text block identifiers, source document information, chapter identifiers, specification clauses, and the scope of application of specification clauses. Then, these multiple second-structured configuration data can be used as an external knowledge base for a large language model.

[0049] In operation S220, each second structured configuration data is input into a pre-trained semantic vector model to generate a semantic vector.

[0050] For example, the second structured configuration data includes multiple sets of standardized clauses, each containing attribute fields such as the standardized clause, its scope of application, and its effective date. The second structured configuration data is input into a multi-layer neural network within a pre-trained semantic vector model. The multi-layer neural network extracts semantic features from the standardized clauses of the second structured configuration data and outputs semantic vectors.

[0051] For example, when the second structured configuration data includes specification clauses such as "firewall security policy specification clauses", the second structured configuration data is input into a pre-trained semantic vector model. Through the multi-layer neural network in the pre-trained semantic vector model, the specification clauses such as "firewall security policy specification clauses" are mapped into semantic vectors.

[0052] In operation S230, key configuration information is extracted from the first structured configuration data, and the key configuration information is input into a pre-trained semantic vector model to generate a query vector.

[0053] For example, the first structured configuration data includes the identifier of the target device, configuration type classification, configuration content, etc. Key configuration information is extracted from the first structured configuration data, including the identifier of the target device, device logical name, application scenario, etc. Each key configuration information is input into a pre-trained semantic understanding model for feature extraction, resulting in a semantic vector corresponding to each key configuration information. This semantic vector is then used as a query vector.

[0054] Therefore, multiple key configuration information from the first structured configuration data can be input into the semantic understanding model for feature extraction, resulting in multiple semantic vectors, which can then be used as multiple query vectors.

[0055] In operation S240, the similarity between the query vector and each of the multiple semantic vectors is calculated, and at least one target semantic vector is selected from the multiple semantic vectors based on the similarity, and the second structured configuration data corresponding to the at least one target semantic vector is obtained.

[0056] In this embodiment, a similarity score is calculated between the query vector and each semantic vector to obtain a similarity score, thereby obtaining multiple similarities corresponding to multiple semantic vectors. Then, from the multiple semantic vectors, the top N semantic vectors with similarity scores exceeding a preset threshold are selected as target semantic vectors, where N is a positive integer, and the second structured configuration data corresponding to the selected target semantic vectors is obtained.

[0057] For example, each semantic vector includes semantic vector A, semantic vector B, semantic vector C, and semantic vector D, and the query vector is query vector X. Using a cosine similarity algorithm, the similarity of query vector X with semantic vectors A, B, C, and D is calculated sequentially. The results are: query vector X with semantic vector A: 0.8; query vector X with semantic vector B: 0.7; query vector X with semantic vector C: 0.92; and query vector X with semantic vector D: 0.91. Each similarity score falls within the range of 0 to 1. A higher similarity score indicates a higher semantic match between the query vector and the semantic vectors. Semantic vectors C and D are then used as target semantic vectors to obtain the second structured configuration data corresponding to semantic vectors C and D.

[0058] It should be noted that the similarity between multiple query vectors and each semantic vector can be calculated, and the number of target semantic vectors can be increased, for example, filtering the top 2N target semantic vectors that exceed a preset threshold.

[0059] In operation S250, prompt words are generated based on at least one second structured configuration data and the first structured configuration data. The prompt words are then input into a pre-trained large language model to obtain the review results of the initial configuration file.

[0060] In this application embodiment, at least one second structured configuration data is combined with the first structured configuration data according to a preset template to form a structured prompt word. The preset template may include the following elements: (1) Role definition: for example, "You are a network device configuration audit expert"; (2) Configuration content to be audited: for example, device identification and configuration statement, relevant specification clauses; (3) Specific analysis instructions: for example, requiring the output of compliance conclusions, problem types and basis clauses.

[0061] The generated prompts are input into a pre-trained large language model. By parsing the semantic elements of the configuration statements, such as actions, protocols, and address ranges, the model compares them with the restrictions in the specification clauses to determine whether there are policy conflicts, scope deviations, or configuration omissions. The model then outputs the audit results, which include: compliance conclusion, problem description, reference specification number, and confidence score.

[0062] The configuration file review method provided in this application obtains the initial configuration file and the standard configuration file of the target device, and performs structured processing on them to obtain first and second structured data. Based on the first and second structured data, a corresponding query vector and multiple semantic vectors are determined. Based on the similarity between the query vector and the multiple semantic vectors, a target semantic vector is determined. Second structured configuration data corresponding to the target semantic vector is obtained. Based on the second structured configuration data corresponding to the target semantic vector and the second structured configuration data, prompt words are constructed. The prompt words are input into a large speech model to obtain the review result.

[0063] This method automates the review of configuration files. Without relying on manual rules and breaking through the limitations of traditional rule engines, it achieves efficient review of configuration files by combining vector retrieval with large speech model inference, thereby improving the accuracy and intelligent efficiency of configuration file review.

[0064] The following will provide a detailed explanation of operations S210 to S250.

[0065] like Figure 3 As shown, the above operation S210 may further include operation S301 or operation S303.

[0066] In operation S301, the initial configuration file includes a text configuration file, and multiple configuration data fragments are extracted from the text configuration file according to a preset regular expression.

[0067] In this embodiment, a corresponding regular expression template is loaded for the text configuration file of different device types. The regular expression template includes multiple regular expressions used to identify key configuration blocks in the text configuration file. Key configuration blocks include interface definitions, access control list rules (ACLs), routing policies, etc. The regular expression template is matched with the key configuration blocks, and the content text, starting line number, and configuration type of the successfully matched fragments are extracted to form multiple configuration data fragments.

[0068] It should be noted that comment lines and whitespace characters are automatically skipped during the extraction of configuration data fragments to ensure the validity of the extracted content.

[0069] In operation S302, semantic analysis is performed on multiple configuration data fragments to obtain the semantic relationships between multiple target configuration data fragments.

[0070] In this embodiment of the application, multiple configuration data fragments are input into a neural network based on an attention mechanism for semantic encoding to obtain the semantic relationships between entities in multiple target configuration data fragments. The semantic relationships between target configuration data fragments can also be used to form a semantic relationship graph, such as the attribution relationship between interfaces and network protocol addresses, the dependency order between ACL rules, etc.

[0071] In operation S303, multiple configuration data fragments are combined according to semantic relationships to obtain the first structured configuration data corresponding to the text-based configuration data.

[0072] In this embodiment, multiple configuration data fragments are aggregated in an ordered manner according to semantic relationships or semantic relationship graphs to obtain configuration data. The configuration data is then converted into first structured data, which is stored in key-value pair format. The first structured configuration data includes fields such as the target device identifier, device logical name, and application scenario, maintaining its positional mapping relationship with the original text.

[0073] like Figure 4 As shown, the above operation S210 may further include operations S401 to S404.

[0074] In operation S401, the initial configuration file includes an image class configuration file, and multiple text information in the image class configuration file are recognized.

[0075] In operation S402, the image class configuration file is input into the pre-trained visual understanding model to obtain the network topology elements.

[0076] In operation S403, based on the multimodal association algorithm, association analysis is performed on text information and network topology elements to obtain the association relationship between text information and network topology elements.

[0077] In operation S404, multiple text information are combined according to the association relationship to obtain the first structured configuration data corresponding to the image class configuration file.

[0078] For example, an optical character recognition engine processes and identifies all visible text characters in the image-based configuration file to obtain multiple text information entries. A large visual model is then used to identify network topology elements in the image, such as device icons, cloud icons, and connecting lines. Leveraging the capabilities of a large language model, these multiple text information entries are associated with network topology elements to obtain the first structured configuration data corresponding to the image-based configuration file.

[0079] It should be noted that during the parsing process, if the text information cannot be precisely matched by the existing rules or syntax tree, the text information is marked as "parsing anomaly". The original text and context are preserved and supplemented by the fault tolerance of the large speech model to ensure that no information is lost.

[0080] The above operation S210 may further include obtaining structural identification information of multiple specification configuration files; dividing the specification configuration file into boundaries according to the structural identification information to obtain multiple second structural configuration data.

[0081] In this embodiment, structural identification information of multiple specification configuration files is obtained. This structural identification information includes heading structures such as chapters and clause numbers in the specification configuration files. The specification configuration text is then hard-bounded according to the heading structures such as chapters and clause numbers corresponding to the specification configuration files, resulting in multiple second-structure configuration data.

[0082] The above operation S220 can further input each second structured configuration data into the encoding layer to generate an encoding vector; and input each encoding vector into the normalization layer to generate a semantic vector.

[0083] For example, the second structure configuration data is embedded and encoded based on a pre-trained language model to generate a corresponding fixed-length semantic vector.

[0084] For example, for a specific type of second-structure configuration data, such as a policy template for access control columns, key semantic elements in the policy template, such as "action," "source address," "destination address," "protocol," and "port," are identified, extracted, and reconstructed into a semi-structured template string. The reconstructed template string is then embedded and encoded to generate a corresponding fixed-length semantic vector.

[0085] like Figure 5 As shown, operations S501 to S503 may be further included after the above operation S230.

[0086] In operation S501, multiple standard configuration data are classified according to the standard configuration information to obtain multiple standard configuration data partitions corresponding to the multiple standard configuration data, wherein each standard configuration data partition includes at least one standard configuration data.

[0087] For example, the standard configuration data includes standard configuration information. Based on the standard configuration information, multiple standard configuration data are queried and compared. Standard configuration data containing the same standard configuration information are classified into similar standard configuration data partitions. Each standard configuration data partition includes at least one standard configuration data.

[0088] For example, the specification configuration information is "firewall". Based on "firewall", multiple specification configuration data are queried and compared, and the specification configuration data containing "firewall" is classified into specification configuration data partitions.

[0089] In operation S502, the key configuration information is compared with multiple standard configuration information to determine at least one target standard configuration information.

[0090] For example, the key configuration information is compared with the similarity of multiple standard configuration information to determine at least one target standard configuration information that matches the key configuration information from the multiple standard configuration information.

[0091] For example, the key configuration information is "firewall". The "firewall" is compared with multiple specification configuration information for similarity. Based on a preset similarity threshold, at least one target specification configuration information that matches "firewall" is determined from the multiple specification configuration information.

[0092] In operation S503, a specification configuration data partition associated with at least one target specification configuration information is determined, and multiple semantic vectors corresponding to the specification configuration data in the specification configuration data partition are used as objects for similarity calculation with the query vector.

[0093] like Figure 6 As shown, the above operation S250 may further include operations S601 to S603.

[0094] In operation S601, a preset prompt template is obtained, and dynamic variable placeholders in the preset prompt template are identified. The dynamic variable placeholders include at least: specification clause placeholders and configuration placeholders to be reviewed.

[0095] In operation S602, the configuration data to be reviewed in the first structured configuration data is filled into the configuration placeholder to be reviewed.

[0096] In operation S603, at least one specification clause from the second structural specification configuration data is filled into the specification clause placeholder, and the filled preset prompt template is used as the prompt word.

[0097] For example, the configuration data to be reviewed from the first structured configuration data is filled into the placeholders for the configuration data to be reviewed in the preset prompt template, and multiple normative clauses from the second structured specification configuration data are filled into the normative clause placeholders in the preset prompt template, resulting in the filled preset prompt template. The filled preset prompt template is used to guide the large speech model to perform the specified compliance judgment task.

[0098] The large speech model infers from the pre-set prompt template after filling in the information, and parses the deep semantic relationship between the configuration data to be reviewed and the normative clauses, such as parsing the structure of access control list rules and understanding the logical order of policy execution.

[0099] Semantic analysis can identify deviations that are difficult to detect with traditional tools. For example, it can identify configuration items that are syntactically correct but have an overly broad policy coverage due to improper address range definition, or determine that the device configuration is missing access restriction policies for specific business network segments as required by the specification.

[0100] For example, the preset prompt templates include:

[0101] (1) Role prompt: "You are a senior cybersecurity auditing expert";

[0102] (2) Background introduction: "You are reviewing a network device configuration. You need to determine whether the [configuration data to be reviewed] is compliant based on the [specification clauses] provided below";

[0103] (3) Relevant regulatory clauses: "1. {{content of regulatory clause 1 retrieved}}, 2. {content of regulatory clause 2 retrieved}}, 3...";

[0104] (4) Configuration items to be reviewed: "Device identification code: {{Device physical identification code of the configuration data to be reviewed}}; Configuration content: {{Content of the configuration data to be reviewed}}; Configuration line number: {{Original line number range of the configuration data to be reviewed}}";

[0105] (5) Task Instructions: "Please strictly follow the above [Standard Clauses] to analyze the `[Configuration Data to be Reviewed]` and answer the following questions: 1. Is the configuration data to be reviewed compliant? 2. Explain in detail the reasons for your judgment. If compliant, please state which standard it conforms to. If non-compliant, please indicate which standard it violates and what the specific problem is (e.g., configuration omissions, policy conflicts, excessive scope, etc.). 3. List the original text of the most core standard clause on which you made your judgment. Please output your analysis results in a clear natural language text format." Here, [Standard Clauses] represents a placeholder for standard clauses, and [Configuration Data to be Reviewed] represents a placeholder for configurations to be reviewed. The configuration items to be reviewed and the relevant standard clauses are obtained from the first structured configuration data and the second structured configuration data, respectively.

[0106] In this embodiment of the application, natural language text is parsed based on a large language model, and the natural language analysis text is converted into analysis results.

[0107] For example, the natural language analysis text is validated using regular expressions based on a large speech model. The analysis results are then returned in a predefined structured format, containing a predefined set of fields including: compliance conclusion, scope of impact, issue type, and confidence score for the compliance conclusion.

[0108] In this embodiment of the application, the identified configuration deviations are quantitatively assessed and prioritized based on the analysis results in a structured format.

[0109] For example, a risk score is generated based on a risk calculation formula, such as:

[0110] f = (Y×w1)+ (L×w2)

[0111] Where f is the risk score, and w1 and w2 are configurable weighting factors. Y is determined based on the potential business or security impact of the deviation, where Y represents the impact score. L is determined based on the potential business or security impact of the deviation, where L represents the confidence score. The confidence score can be evaluated based on the scope of impact field, such as the impact score of core business interfaces being higher than that of edge devices, and the importance level of the violated regulatory clauses.

[0112] Based on the calculated risk scores, configuration deviations are categorized into different priorities; for example, 9 to 10 points is considered "serious," and 6 to 8 points is considered "high." The calculated risk scores and their corresponding priorities are then appended to the analysis results to obtain the audit records.

[0113] It should be noted that the analysis results are structured, visualized, and integrated into the system, supporting audit report output, problem tracing, remediation suggestion generation, and human-computer interactive query, thereby improving the interpretability and usability of configuration inspection conclusions.

[0114] In this embodiment of the application, the audit records are stored in the audit database. When storing the records, a database index is created based on the key fields of the audit records. The indexed fields include, but are not limited to, device identifier, inspection date, risk level, problem type and compliance conclusion. The audit database includes, but is not limited to, a relational database.

[0115] In this embodiment, the audit records are aggregated and analyzed to obtain analysis results. The aggregation dimensions include, but are not limited to, device, configuration type, risk level, or issue category. The aggregated analysis results are rendered and output in various formats, including portable document format and comma-separated value file, according to a preset report template.

[0116] It should be noted that the system supports querying the compliance explanation of a configuration through natural language, such as "Does a certain device prohibit office terminal network segments from accessing this service?" The system can return the configuration compliance judgment result, the referenced specification paragraph, the cause of the problem, and suggested repair methods.

[0117] For example, a natural language query interface is provided, allowing users to interactively query and request explanations for specific configuration items. Based on a large model and knowledge retrieval results, context-consistent, traceable, and explanatory answers are provided. When a user's natural language query is received, natural language processing technology is used to semantically parse the query statement to identify the user's intent and extract key entities from the query, such as device identifiers and network addresses. Based on the extracted key entities, the most relevant existing audit records are retrieved from the audit database.

[0118] In this embodiment, the original question and retrieved review records can be input into a preset prompt template specifically for Q&A, which then calls a large speech model to generate a clear and logical natural language answer. If the judgment result is non-compliant, the large model can be further guided to generate corresponding remediation suggestions, and the generated complete answer can be returned to the user's query interface.

[0119] For example, based on feedback tags such as misjudgments or omissions confirmed by humans in the work order system, an automated closed-loop feedback and model optimization process can be built to continuously improve the accuracy of the system's judgment.

[0120] For example, manual feedback tags from external systems are obtained through an interface, and these tags, along with their corresponding initial configuration information and specification configuration information, are stored in a feedback database. Newly labeled samples added within a given period are merged from the feedback database, and data cleaning and deduplication are performed. Based on the newly labeled samples, the parameters of the large language model are fine-tuned to correct previously erroneous judgment patterns and update the large language model.

[0121] Based on the above-mentioned configuration file review method, this application also provides a configuration file review device. The following will combine... Figure 7 The device is described in detail.

[0122] Figure 7 A schematic block diagram of a configuration file review device according to an embodiment of this application is shown.

[0123] like Figure 7 As shown, the configuration file review device 700 of this embodiment includes a structured processing module 710, a semantic vector generation module 720, a query vector generation module 730, a semantic vector filtering module 740, and a configuration file review module 750.

[0124] The structured processing module 710 is used to acquire the initial configuration file and multiple specification configuration files of the target device, and to perform structured processing on the initial configuration file and the multiple specification configuration files respectively to obtain first structured configuration data and multiple second structured configuration data. In one embodiment, the structured processing module 710 can be used to perform the operation S210 described above, which will not be repeated here.

[0125] The semantic vector generation module 720 is used to input each second structured configuration data into a pre-trained semantic vector model to generate semantic vectors. In one embodiment, the semantic vector generation module 720 can be used to perform the operation S220 described above, which will not be repeated here.

[0126] The query vector generation module 730 is used to extract key configuration information from the first structured configuration data, input the key configuration information into a pre-trained semantic vector model, and generate a query vector. In one embodiment, the query vector generation module 730 can be used to perform the operation S230 described above, which will not be repeated here.

[0127] The semantic vector filtering module 740 is used to calculate the similarity between the query vector and each of the multiple semantic vectors, and to filter at least one target semantic vector from the multiple semantic vectors based on the similarity, thereby obtaining the second structured configuration data corresponding to the at least one target semantic vector. In one embodiment, the semantic vector filtering module 740 can be used to perform the operation S240 described above, which will not be repeated here.

[0128] The configuration file review module 750 is used to generate prompt words based on at least one second structured configuration data and the first structured configuration data, input the prompt words into a pre-trained large language model, and obtain the review result of the initial configuration file. In one embodiment, the configuration file review module 750 can be used to perform the operation S250 described above, which will not be repeated here.

[0129] According to embodiments of this application, any multiple modules among the structured processing module 710, semantic vector generation module 720, query vector generation module 730, semantic vector filtering module 740, and configuration file review module 750 can be merged into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this application, at least one of the structured processing module 710, semantic vector generation module 720, query vector generation module 730, semantic vector filtering module 740, and configuration file review module 750 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the structured processing module 710, semantic vector generation module 720, query vector generation module 730, semantic vector filtering module 740, and configuration file review module 750 may be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0130] Figure 8 A block diagram schematically illustrates an electronic device suitable for implementing a configuration file review method according to an embodiment of this application.

[0131] like Figure 8 As shown, an electronic device 800 according to an embodiment of this application includes a processor 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage portion 808 into a random access memory (RAM) 803. The processor 801 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 801 may also include onboard memory for caching purposes. The processor 801 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this application.

[0132] RAM 803 stores various programs and data required for the operation of electronic device 800. Processor 801, ROM 802, and RAM 803 are interconnected via bus 804. Processor 801 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 802 and / or RAM 803. It should be noted that programs may also be stored in one or more memories other than ROM 802 and RAM 803. Processor 801 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in one or more memories.

[0133] According to embodiments of this application, the electronic device 800 may further include an input / output (I / O) interface 805, which is also connected to a bus 804. The electronic device 800 may also include one or more of the following components connected to the input / output (I / O) interface 805: an input section 806 including a keyboard, mouse, etc.; an output section 807 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a LAN card, modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the input / output (I / O) interface 805 as needed. A removable medium 811, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 810 as needed so that computer programs read from it can be installed into the storage section 808 as needed.

[0134] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0135] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 802 and / or RAM 803 and / or one or more memories other than ROM 802 and RAM 803 described above.

[0136] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to enable the computer system to implement the configuration file auditing method provided in the embodiments of this application.

[0137] When the computer program is executed by the processor 801, it performs the functions defined in the system / apparatus of this application embodiment. According to the embodiments of this application, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0138] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 809, and / or installed from a removable medium 811. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0139] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 809, and / or installed from the removable medium 811. When the computer program is executed by the processor 801, it performs the functions defined in the system of this application embodiment. According to the embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0140] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0141] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0142] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. A configuration file review method, characterized in that, include: Obtain the initial configuration file and multiple standard configuration files of the target device, and perform structured processing on the initial configuration file and the multiple standard configuration files respectively to obtain first structured configuration data and multiple second structured configuration data; Each of the second structured configuration data is input into a pre-trained semantic vector model to generate a semantic vector; Extract key configuration information from the first structured configuration data, input the key configuration information into the semantic vector model, and generate a query vector; Calculate the similarity between the query vector and each of the multiple semantic vectors, filter at least one target semantic vector from the multiple semantic vectors based on the similarity, and obtain the second structured configuration data corresponding to the at least one target semantic vector; Based on at least one of the second structured configuration data and the first structured configuration data, prompt words are generated, and the prompt words are input into a pre-trained large language model to obtain the review result of the initial configuration file.

2. The method according to claim 1, characterized in that, The initial configuration file includes a text configuration file. The step of performing structured processing on the initial configuration file and the plurality of specification configuration files to obtain first structured configuration data and a plurality of second structured configuration data includes: Based on a preset regular expression, extract multiple configuration data fragments from the text configuration file; Semantic analysis is performed on multiple configuration data fragments to obtain the semantic relationships between multiple target configuration data fragments; Based on the semantic relationships, multiple target configuration data fragments are combined to obtain the first structured configuration data corresponding to the text-based configuration data.

3. The method according to claim 1, characterized in that, The initial configuration file includes an image class configuration file. The step of performing structured processing on the initial configuration file and the plurality of specification configuration files to obtain first structured configuration data and a plurality of second structured configuration data includes: Identify multiple text information entries in the image class configuration file; The image class configuration file is input into the pre-trained visual understanding model to obtain network topology elements; Based on a multimodal association algorithm, association analysis is performed on the text information and the network topology elements to obtain the association relationship between the text information and the network topology elements; The multiple text information are combined according to the association relationship to obtain the first structured configuration data corresponding to the image class configuration file.

4. The method according to claim 1, characterized in that, The step of performing structured processing on the initial configuration file and the plurality of specification configuration files to obtain first structured configuration data and a plurality of second structured configuration data includes: Obtain the structural identification information of multiple specification configuration files; Based on the structural identification information, the multiple specification configuration files are segmented by boundaries to obtain multiple sets of second structural configuration data.

5. The method according to claim 1, characterized in that, The pre-trained semantic vector model includes an encoding layer and a normalization layer set sequentially; the step of inputting each of the second structured configuration data into the pre-trained semantic vector model to generate semantic vectors includes: Each of the second structured configuration data is input into the encoding layer to generate an encoding vector; Each of the encoded vectors is input into the normalization layer to generate the semantic vector.

6. The method according to claim 1, characterized in that, The standardized configuration data includes standardized configuration information. After inputting the key configuration information into the pre-trained semantic vector model to generate the query vector, the data further includes: The multiple standard configuration data are classified according to the standard configuration information to obtain multiple standard configuration data partitions corresponding to the multiple standard configuration data, wherein each standard configuration data partition includes at least one standard configuration data. The key configuration information is compared with multiple standard configuration information to determine at least one target standard configuration information; Determine the specification configuration data partition associated with the at least one target specification configuration information, and use the multiple semantic vectors corresponding to the specification configuration data in the specification configuration data partition as objects for similarity calculation with the query vector.

7. The method according to claim 1, characterized in that, The first structured configuration data includes configuration data to be reviewed, and the second structured configuration data includes specification clauses corresponding to the configuration data to be reviewed. The step of generating prompt words based on at least one of the second structured configuration data and the first structured configuration data includes: Obtain a preset prompt template and identify the dynamic variable placeholders in the preset prompt template, wherein the dynamic variable placeholders include at least: a specification clause placeholder and a configuration placeholder to be reviewed; Fill the pending configuration data from the first structured configuration data into the pending configuration placeholder; Fill the specification clause placeholder with at least one specification clause from the second structural specification configuration data; The pre-set prompt template, after being filled in, will be used as the prompt word.

8. A configuration file review device, characterized in that, include: The structured processing module is used to obtain the initial configuration file and multiple standard configuration files of the target device, and to perform structured processing on the initial configuration file and the multiple standard configuration files respectively to obtain first structured configuration data and multiple second structured configuration data. The semantic vector generation module is used to input each of the second structured configuration data into the pre-trained semantic vector model to generate semantic vectors; The query vector generation module is used to extract key configuration information from the first structured configuration data, input the key configuration information into the pre-trained semantic vector model, and generate a query vector. The semantic vector filtering module is used to calculate the similarity between the query vector and each of the multiple semantic vectors, filter at least one target semantic vector from the multiple semantic vectors based on the similarity, and obtain the second structured configuration data corresponding to the at least one target semantic vector; The configuration file review module is used to generate prompt words based on at least one of the second structured configuration data and the first structured configuration data, input the prompt words into a pre-trained large language model, and obtain the review result of the initial configuration file.

9. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, It stores a computer program or instructions thereon, which, when executed by a processor, implement the steps of the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

Images