A multi-source information-oriented contradiction detection and credibility fusion method

Abstract

The application provides a multi-source information-oriented contradiction detection and credibility fusion method, and relates to the technical field of information processing.The method comprises the following steps: step 1, performing structured processing on collected multi-source information data, and extracting entity, attribute, relationship and time information to convert into a standard triple format to construct an information knowledge graph; step 2, performing semantic alignment on multiple information describing the same entity or event in the information knowledge graph, and performing contradiction detection based on preset contradiction determination rules to obtain information data with contradiction marks; and step 3, calculating initial credibility for each piece of information based on source authority and evidence support degree for the information data with contradiction marks, and performing credibility fusion between multi-source information through an iterative credibility propagation algorithm to obtain a fused credibility score.The application realizes automatic detection of multi-source information contradictions and dynamic fusion of credibility, and improves the consistency and reliability of information analysis.

Description

Technical Field

[0001] This invention relates to the field of information processing technology, and in particular to a method for contradiction detection and credibility fusion of multi-source intelligence. Background Technology

[0002] In the process of multi-source intelligence aggregation and analysis, there are often inconsistencies in the descriptions of intelligence information from different channels. For example, in the scenario of cybersecurity threat intelligence analysis, the descriptions of the same security event may differ. One threat intelligence platform reports that an APT attack occurred on March 15, 2023 at 14:30, with the attacker's IP belonging to a certain region and the malware family A being used; while intelligence from another security vendor shows that the attack occurred on March 15, 2023 at 16:00, with the attacker's IP belonging to another region and the malware family B being used. Such inconsistencies in time, attributes, and relationships are quite common in multi-source intelligence aggregation.

[0003] Currently, the main methods for handling inconsistencies in multi-source intelligence include manual comparison and experience-based judgment, or automatic processing based on simple rules. Manual methods are adequate for handling small amounts of intelligence, but are less efficient when dealing with large amounts of intelligence, and the judgment results are greatly affected by subjective factors. In rule-based automatic processing, common methods include selecting the most recent intelligence as the adoption result, or selecting a highly authoritative source as the basis. However, the systematic detection of complex contradictory relationships between intelligence is still insufficient, making it difficult to comprehensively identify different types of inconsistencies. Summary of the Invention

[0004] The technical problem to be solved by this invention is to provide a method for contradiction detection and credibility fusion of multi-source intelligence, so as to realize the automated detection of contradictions and dynamic credibility fusion of multi-source intelligence, and improve the consistency and reliability of intelligence analysis.

[0005] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows: Firstly, a method for contradiction detection and credibility fusion based on multi-source intelligence, the method comprising: Step 1: The collected multi-source intelligence data is structured and the entity, attribute, relationship and time information is extracted and converted into a standard triple format to construct an intelligence knowledge graph; Step 2: Semantically align multiple pieces of intelligence describing the same entity or event in the intelligence knowledge graph, and perform contradiction detection based on preset contradiction judgment rules to obtain intelligence data with contradiction tags. Step 3: For intelligence data marked with contradictions, calculate the initial credibility of each intelligence based on the authority of the source and the degree of evidence support, and perform credibility fusion among multiple intelligence sources through an iterative credibility propagation algorithm to obtain the fused credibility score. Step 4: Based on the fused credibility score and the intelligence data marked with contradictions, the contradictory information is automatically resolved or marked according to the preset multi-level resolution rules to obtain integrated intelligence. Step 5 involves using integrated intelligence and actual verification information as feedback to dynamically optimize structured processing parameters, contradiction judgment rule thresholds, and the weights of credibility calculation and fusion models, forming a closed-loop optimization mechanism.

[0006] In a second aspect, a computer-readable storage medium storing a program that, when executed by a processor, implements the method.

[0007] The above-described solution of the present invention has at least the following beneficial effects: By structuring multi-source intelligence and constructing knowledge graphs, scattered and non-standardized intelligence data is transformed into a unified and standardized knowledge representation, achieving clarity, correlation, and computability of intelligence information, thus improving the efficiency of intelligence organization and retrieval. Semantic alignment and contradiction detection automatically identify conflicting information in multi-source intelligence, preventing erroneous and contradictory intelligence from being directly used in decision-making and reducing the risk of misjudgment. Credibility fusion based on source authority, evidence support, and iterative credibility propagation objectively quantifies the reliability of each intelligence piece, overcoming the bias and subjectivity of single-source intelligence. Multi-level contradiction resolution rules enable automatic processing and labeling of contradictory information, filtering or labeling low-credibility conflicting content while retaining high-credibility intelligence, improving the accuracy and usability of the final integrated intelligence. A closed-loop feedback optimization mechanism is introduced, continuously and dynamically adjusting model parameters and rule thresholds based on actual verification results, enabling the entire intelligence processing flow to have self-learning and self-optimization capabilities, continuously enhancing long-term reliability and adaptability. Attached Figure Description

[0008] Figure 1 This is a flowchart illustrating a method for contradiction detection and credibility fusion based on multi-source intelligence, provided by an embodiment of the present invention.

[0009] Figure 2 This is a schematic diagram of an embodiment of the present invention, which shows how to semantically align multiple pieces of intelligence describing the same entity or event in an intelligence knowledge graph and perform contradiction detection based on a preset contradiction judgment rule to obtain intelligence data with contradiction markers. Detailed Implementation

[0010] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0011] like Figure 1 As shown, embodiments of the present invention propose a method for contradiction detection and credibility fusion based on multi-source intelligence, the method comprising the following steps: Step 1: The collected multi-source intelligence data is structured and the entity, attribute, relationship and time information is extracted and converted into a standard triple format to construct an intelligence knowledge graph; Step 2: Semantically align multiple pieces of intelligence describing the same entity or event in the intelligence knowledge graph, and perform contradiction detection based on preset contradiction judgment rules to obtain intelligence data with contradiction tags. Step 3: For intelligence data marked with contradictions, calculate the initial credibility of each intelligence based on the authority of the source and the degree of evidence support, and perform credibility fusion among multiple intelligence sources through an iterative credibility propagation algorithm to obtain the fused credibility score. Step 4: Based on the fused credibility score and the intelligence data marked with contradictions, the contradictory information is automatically resolved or marked according to the preset multi-level resolution rules to obtain integrated intelligence. Step 5 involves using integrated intelligence and actual verification information as feedback to dynamically optimize structured processing parameters, contradiction judgment rule thresholds, and the weights of credibility calculation and fusion models, forming a closed-loop optimization mechanism.

[0012] In this embodiment of the invention, by structuring multi-source intelligence and constructing knowledge graphs, scattered and non-standardized intelligence data are transformed into a unified and standardized knowledge representation, realizing the clarity, correlation, and computability of intelligence information, and improving the efficiency of intelligence organization and retrieval. Semantic alignment and contradiction detection are employed to automatically identify conflicting information in multi-source intelligence, preventing erroneous and contradictory intelligence from being directly used in decision-making and reducing the risk of misjudgment. Credibility fusion based on source authority, evidence support, and iterative credibility propagation objectively quantifies the reliability of each piece of intelligence, overcoming the one-sidedness and subjectivity of intelligence from a single source. Automatic processing and labeling of contradictory information are achieved through multi-level contradiction resolution rules, filtering or labeling low-credibility conflicting content while retaining high-credibility intelligence, improving the accuracy and usability of the final integrated intelligence. A closed-loop feedback optimization mechanism is introduced to continuously and dynamically adjust model parameters and rule thresholds based on actual verification results, enabling the entire intelligence processing flow to have self-learning and self-optimization capabilities, continuously enhancing long-term reliability and adaptability.

[0013] In a preferred embodiment of the present invention, step 1 above, which involves structuring the collected multi-source intelligence data and extracting entity, attribute, relationship, and time information, converting it into a standard triplet format, and constructing an intelligence knowledge graph, may include: In this embodiment of the invention, step 110 involves obtaining raw intelligence data from multiple intelligence sources in real time or periodically through a preset data acquisition interface to obtain a raw dataset. Specifically, this includes: pre-building a standardized data acquisition interface adapted to the needs of multi-source intelligence acquisition. This interface integrates standard API interfaces, database connectors, multi-format file parsers, and dedicated acquisition components such as targeted web crawlers. Each component is adapted to the access and data capture needs of different types of intelligence sources. For different intelligence sources with varying information update frequencies and transmission characteristics, a corresponding acquisition strategy is configured for each intelligence source. For dynamically updated intelligence sources such as threat intelligence platforms and real-time sensor logs, a real-time acquisition strategy is used for immediate data acquisition. For open-source intelligence sites, manual analysis reports, and offline data from third-party intelligence providers... For intelligence sources that are not updated in real time, a periodic collection strategy is adopted, with data being acquired in batches at preset time intervals, such as hours or days. The scope of intelligence sources collected comprehensively covers all relevant channels, including Open Network Intelligence (OSINT), internal security databases, real-time sensor logs, manual analysis reports, data from third-party intelligence vendors, threat intelligence platforms, security device logs, and dark web monitoring nodes. The raw intelligence data collected includes both structured data, such as JSON and XML formats, structured records from various databases, and unstructured data, such as natural language text, PDF / Word reports, and random log files. The raw intelligence data collected from all intelligence sources is uniformly aggregated, categorized, and stored to form a raw dataset, denoted as . ,in Represents the total number of original records in the original dataset, and each original record Each record contains three core components: first, the core textual content of the intelligence; second, basic metadata such as data collection time, data format identifier, and data storage path; and third, a unique source identifier that corresponds one-to-one with the intelligence source, allowing for the tracing of the specific acquisition channel for each original record.

[0014] Step 111 involves cleaning the original dataset, removing redundant, erroneous, or irrelevant information, and performing standardized preprocessing to obtain cleaned data. Specifically, this includes cleaning the original dataset... Each original record in The data cleaning process is performed sequentially across all dimensions. First, redundant information is removed by performing multi-dimensional hash comparisons and content similarity matching on the text content, metadata, and source identifiers of the original records. Completely duplicated records or records with highly overlapping core information are identified and eliminated to ensure the uniqueness of each record in the dataset. Second, erroneous information is removed by using pre-defined data validity rules to verify the completeness of core elements, the rationality of data format, and the consistency of content logic for each record. Records lacking core elements such as the intelligence subject or key attributes are filtered out, invalid records with formatting errors, garbled characters, or abnormal values ​​are removed, as are erroneous records with obvious logical contradictions. Finally, irrelevant information is filtered by setting intelligence relevance judgment criteria based on specific intelligence analysis objectives and application scenarios, using keywords... Through matching, topic semantic analysis, and other methods, records irrelevant to the analysis objective are identified and removed, retaining only the core, relevant, and valid data. After cleaning up redundant, erroneous, and irrelevant information, all remaining valid original records undergo unified data format preprocessing. For structured data of different formats, they are uniformly converted into a preset standard structured format, such as standard JSON, and field naming rules, field data types, and field sorting methods are standardized. For unstructured data such as natural language text and report documents, they are uniformly converted into a standard plain text format, while character encoding, line break rules, and special symbol representation methods are standardized. All valid data that has undergone format unification are re-collected, numbered, and stored to obtain cleaned data. Each data point in this dataset possesses the characteristics of uniqueness, validity, relevance, and standardized format.

[0015] Step 112 involves applying a natural language processing pipeline to the cleaned data for named entity recognition (NAME) to extract a set of entities including attackers, victims, geographical locations, malware, and time points. Specifically, this includes: inputting the cleaned data (with standardized format) into a pre-built natural language processing pipeline, initiating the NAME recognition technology step, and performing key entity localization and extraction operations. During NAME recognition, a deep learning-based NAME recognition model is used, taking cleaned plain text or structured text as input. Through the model's feature extraction and sequence labeling functions, entities in the text content are labeled and recognized word by word. The identified entity type is strictly limited to attackers. The core intelligence entities are categorized into five types: attacker, victim, geographic location, malware, and time point. Attacker entities include attacking organizations, attackers, and attack accounts; victim entities include attacked companies, servers, and terminal devices; geographic location entities include the location of the attack and the region under attack; malware entities include viruses, Trojans, and ransomware; and time point entities include the time of the attack and the time of intelligence gathering. All identified entities are reviewed individually, and incorrectly identified or unclear entity information is removed. The remaining valid entities are deduplicated to ensure that each entity is a unique intelligence object. Each valid entity is then uniquely identified and assigned a value, forming an ordered set of entities, denoted as [entity name missing]. ,in , These represent the first and second independent valid entities extracted, respectively. The set contains all five core entities extracted from the cleaned data, with no omissions or duplicates.

[0016] Step 113 involves extracting relations from each entity in the entity set, identifying semantic relationships between entities, and obtaining a relation set; parsing the time expressions appearing in the cleaned data, and normalizing all time information into a standard timestamp format using a time parser to obtain a time information set; specifically, this includes: based on the extracted entity set... Continuing with the relation extraction technique in the natural language processing pipeline, this step involves identifying and extracting semantic relationships between entities. First, all entities in the entity set are matched with the cleaned data to determine the context of each entity within the text. Then, a relation extraction architecture based on semantic dependency analysis is used to identify, determine, and label the semantic relationships between any two or more related entities. The identified semantic relationship types are strictly limited to four core categories: attack, exploit, location, and membership. Attack relationships refer to an entity's attack on another entity; exploit relationships refer to an entity using another entity for related operations; location relationships refer to spatial affiliation between an entity and a geographical location; and membership relationships refer to organizational or hierarchical affiliation between entities. Each identified semantic relationship is reviewed, and invalid relationships with incorrect determinations or flawed association logic are removed. The remaining valid relationships are deduplicated to ensure each relationship is a unique semantic association. Finally, each valid relationship is uniquely identified and assigned a value, forming an ordered set of relationships, denoted as [reference needed]. ,in , These represent the first and second independent valid semantic relations identified, respectively.

[0017] Full-text search was performed on the cleaned data to extract all time expressions containing time descriptions, including all types of time expressions such as specific dates, points in time, time intervals, and relative times. All extracted time expressions were then completely input into a dedicated time parser. This parser has built-in multi-timezone conversion and time format standardization functions. First, timezone identification and conversion were performed on each time expression, converting all non-UTC timezone time expressions to UTC. Then, time expressions in different formats, such as Chinese dates, numeric dates, and English dates, were all normalized to the standard UTC timestamp format, accurate to the second, ensuring the uniqueness and comparability of time information. All standardized UTC timestamps were reviewed one by one, removing parsed errors and invalid time information. The remaining valid timestamps were organized, and each timestamp was associated with its corresponding intelligence content, forming an ordered set of time information. Each piece of data in this set is a standard UTC timestamp that corresponds one-to-one with the intelligence content, without errors or omissions.

[0018] Step 114: Integrate the entity set, relation set, and time information set, transforming each piece of intelligence information into a unified triplet form to obtain a triplet set; specifically, this includes: extracting the entity set... Relation sets The system integrates standardized time information sets across multiple dimensions. The integration process uses individual intelligence messages as the basic processing unit, ensuring complete mapping of the core information of each message without information splitting. Based on the semantic logic and content structure of each message, its core information is transformed into a unified triplet format. The triplets are divided into two core types: the first is (subject, attribute, value), where the subject is the core entity extracted from the entity set E, the attribute is the specific dimension describing the subject's characteristics, including time, state, quantity, etc., and the value is the specific content of the corresponding attribute. If the attribute is a time attribute, the value is the standard UTC timestamp corresponding to the subject extracted from the time information set; otherwise, the value is the specific feature value extracted from the intelligence content. The second type is (subject, relation, object), where both the subject and object are derived from the entity set... The related entities extracted are from the relation set. The core semantic relationships connecting the subject and object are extracted, and these semantic relationships are completely consistent with the entity association logic in the intelligence content. When transforming each piece of intelligence into a triple, it is ensured that the transformed triple can completely and accurately express the core semantic information of the intelligence, without missing core information or semantic deviation. Each transformed triple is reviewed, and triples with transformation errors or incomplete semantic expression are eliminated. All valid triples that pass the review are summarized and organized to form a triple set. Each triple in this set is uniformly denoted as . ,in Subject entity, directly corresponding to entity set A single entity in the, As a predicate, it can correspond to the attribute describing the subject or the semantic relationship connecting the subject and the object, depending on the type of the triple. For object entities or specific attribute values, if it is a (subject, relation, object) type, For entity collection If a given entity is of type (subject, attribute, value), This refers to the specific feature value or standard UTC timestamp of the corresponding attribute.

[0019] Step 115 involves storing the triple set in a graph database to construct an intelligence knowledge graph with entities as nodes and relationships as edges. Specifically, this includes: selecting Neo4j as a dedicated graph database storage medium; pre-completing the graph database environment setup and storage rule configuration to ensure the database supports batch import and efficient relational queries of triple data; adapting the existing triple set to the Neo4j graph database storage format; and storing each triple... The core elements are mapped to the database storage structure. The mapping rule is to map the subject entity in the triplet. Object entity That is, the set of all entities All independent entities in the graph are mapped to vertices in the intelligence knowledge graph, and the vertices are uniformly represented by symbols. This means that each vertex corresponds to a unique entity, and each vertex is assigned a unique identifier consistent with the entity. Simultaneously, the entity's core attribute information is attached to the corresponding vertex; the predicates in the triples... In other words, attributes or semantic relationships are mapped to edges connecting corresponding vertices in an intelligence knowledge graph, and the edges are uniformly represented by symbols. This means that each edge corresponds to a unique attribute or semantic relationship. Each edge is assigned a unique identifier consistent with its attribute or relationship. Simultaneously, the association information and weight information of the edges are attached to the corresponding edges. Following the above mapping rules, all valid triples in the triple set are imported in batches into the Neo4j graph database. Through the database's graph structure construction function, all vertices and edges are associated and connected to form an interconnected intelligence semantic network, ultimately constructing a complete intelligence knowledge graph. This knowledge graph is uniformly denoted as... ,in The set of all vertices in the graph, corresponding to the entity set. All entities in the, Let be the set of all edges in the graph, and the set of correspondences. The intelligence knowledge graph, constructed by combining all semantic relationships and attributes of all entities, enables efficient retrieval, association analysis, and visualization of entity, attribute, and relationship information, providing structured and operable basic data support for contradiction detection and credibility calculation.

[0020] By building a multi-component preset collection interface, comprehensive coverage of multiple types and formats of intelligence sources was achieved. Combined with real-time and periodic collection methods, the integrity and timeliness of the original intelligence data were ensured. At the same time, source identifiers were marked for each original record and a standardized original dataset format was defined.

[0021] In a preferred embodiment of the present invention, step 2 above, which involves semantically aligning multiple pieces of intelligence describing the same entity or event in the intelligence knowledge graph and performing contradiction detection based on a preset contradiction determination rule to obtain intelligence data with contradiction markers, may include: In this embodiment of the invention, step 220 involves extracting all entity nodes and their corresponding triplet information from the intelligence knowledge graph to obtain the original entity data to be aligned. By calculating the semantic similarity of entity names, context attributes, and relation embedding vectors, different entity references that may point to the same real-world entity are identified, resulting in candidate alignment entity pairs. Specifically, this includes: performing full information extraction on the constructed intelligence knowledge graph, extracting all entity nodes contained in the graph, and simultaneously extracting all triplet information associated with each entity node. All entity nodes and their corresponding associated triplet information are then bound and integrated to form the original entity data to be aligned. This data must completely contain the basic information and associated semantic information of all entities in the knowledge graph, without any omissions of entity nodes or triplet information. For each entity in the original entity data to be aligned, respectively... Three core features are obtained for semantic similarity calculation: the first is entity name features, i.e., the original name and related aliases of the entity; the second is entity context attribute features, i.e., various attributes and attribute values ​​describing the entity; the third is entity relation embedding vector features. Entities are represented by vectors using TransE or ComplEx graph embedding models, transforming all entity relationships into fixed-dimensional low-dimensional dense vectors, resulting in a unique relation embedding vector for each entity. For any two entities in the original entity data, the semantic similarity between the two entities is calculated sequentially across the three dimensions: entity name, context attributes, and relation embedding vector. The similarity results from these three dimensions are then weighted and fused to obtain the comprehensive semantic similarity between the two entities. The similarity calculation for the relation embedding vector dimension uses the cosine similarity formula, which is: In the formula and For the two entities to be calculated, For entities Relational embedding vectors, For entities Relational embedding vectors, Let be the dot product of two vectors. For entities The magnitude of the relation embedding vector. For entities The magnitude of the relation embedding vector is calculated by multiplying the corresponding dimension values ​​of the two vectors and summing the results to obtain the inner product. The magnitude is then obtained by taking the square root of the sum of the squares of the values ​​of each dimension. The semantic similarity of that dimension is obtained by dividing the inner product by the product of the two magnitudes. Based on the comprehensive semantic similarity results of the two entities, entity combinations with a comprehensive semantic similarity greater than 0 and potential common orientation are identified. These are different entity references that may point to the same real-world entity. These entity combinations are then organized, and each combination is labeled with a corresponding comprehensive semantic similarity value to form candidate aligned entity pairs. Candidate aligned entity pairs must contain all entity combinations with the possibility of the same orientation, without omissions or mismatches.

[0022] Step 221: Merge entities in candidate alignment entity pairs whose similarity exceeds a preset alignment threshold, unifying multiple nodes pointing to the same entity into a single entity identifier, completing entity semantic alignment, and obtaining an aligned entity set; specifically including: preset the entity semantic alignment similarity threshold. This threshold is a quantified value between 0 and 1, which can be set according to the actual intelligence analysis scenario and needs. The preferred threshold is 0.85. Candidate alignment entity pairs are screened one by one, and the comprehensive semantic similarity value of each candidate alignment entity pair is compared with the preset alignment threshold. The comparison is performed to determine whether the similarity of the candidate aligned entity pair exceeds a preset threshold. If the similarity exceeds the preset alignment threshold, the pair is aligned accordingly. For candidate alignment entity pairs, perform entity merging processing, which merges multiple entity nodes in the entity pair that point to the same real-world entity, retains the valid core information of all entity nodes, removes duplicate and redundant information, and assigns a unique single entity identifier to the merged entity. This identifier is unique, can be distinguished from all other entities, and is unrepeated and unambiguous. The entities after merging processing, as well as the original entities that do not appear in any candidate alignment entity pairs and do not need to be merged, are uniformly organized and classified according to the single entity identifier to form an aligned entity set. Each entity in this set corresponds to a unique real-world entity, with no entity nodes having the same name but different names, and each entity contains complete core information and a unique identifier.

[0023] Step 222: Based on the aligned entity set, for each entity or event node, retrieve all intelligence triples related to that entity or event from the intelligence knowledge graph to form a set of multiple intelligence statements for the same entity or event to be detected. Specifically, this includes: using the aligned entity set as the retrieval basis, extracting each entity node from the set, and simultaneously identifying all event nodes associated with the entity in the intelligence knowledge graph to form a list of entities and event nodes to be retrieved; for each entity node or event node in the list, performing a precise retrieval operation in the intelligence knowledge graph, using that node as the core, retrieving all intelligence triples that have a direct or indirect semantic relationship with that node, covering the entire knowledge graph. The system retrieves tuple information to ensure no relevant triples are missed, while removing irrelevant triples that have no semantic connection to the node. All retrieved intelligence triples related to the same entity or event node are then organized and treated as a whole to form a set of intelligence statements for that entity or event. Each triple in this set represents a different intelligence description of the same entity or event. After completing the above retrieval and organization operations on all entity and event nodes, several sets of intelligence statements are obtained. Each set corresponds to a unique entity or event, and there is no overlap or intersection between sets. All sets together constitute multiple sets of intelligence statements for the same entity or event to be detected, providing a unified detection object for contradiction detection.

[0024] Step 223: Iterate through each piece of intelligence in the intelligence statement set, and sequentially call the preset time contradiction judgment rules, numerical contradiction judgment rules, attribute contradiction judgment rules, and relationship contradiction judgment rules to compare and analyze the time attributes, numerical attributes, category attributes, and relationship types of each piece of intelligence to determine whether there are any conflicts. Specifically, for each intelligence statement set to be tested, iterate through each intelligence triple in the set in a preset order, take any two intelligence triples as a comparison object, form multiple intelligence comparison combinations, and ensure that all intelligence in the set is compared pairwise without any comparison combination being missed. For each intelligence comparison combination, sequentially call the four types of preset contradiction judgment rules to check one by one, and execute them in a fixed order of time contradiction judgment rules, numerical contradiction judgment rules, attribute contradiction judgment rules, and relationship contradiction judgment rules. After completing the previous type of rule check, the next type of rule check is executed. Skipping steps and reversing the order are not allowed.

[0025] Time discrepancy determination involves extracting the time attribute from two pieces of intelligence describing the same event in the comparison and combination. and Calculate the absolute difference between two time attributes. The calculation method is to use minus Take the absolute value to get Then Contradictory threshold with preset time To make a comparison, if Greater than If so, it is determined that the comparison combination has a time inconsistency. The threshold is related to the domain and can be set according to the type of intelligence. For example, it can be set to 24 hours for the attack start time. Numerical contradiction determination involves extracting the numerical attributes of the same entity from the two intelligence reports in the comparison combination. and Calculate the relative error between two numerical attributes using the following method: minus Take the absolute value and then divide by and The maximum value in is obtained The calculation results will be compared with the preset numerical discrepancy threshold. Compare them; if the relative error is greater than... If so, it is determined that the compared combination contains a numerical contradiction. The preferred value is 10%; Attribute conflict determination: Pre-construct an attribute semantic conflict table. The table contains all conflicting attribute value pairs. Extract the two attribute values ​​from the comparison pairs that describe the same entity. and Determine attribute value pairs ( , Does it exist in the attribute semantic conflict table? If such a pair exists, then the pair is determined to have an attribute contradiction. Determining relationship conflicts involves pre-constructing a table of relationship oppositions. This table contains all mutually exclusive entity relationship pairs. The comparison extracts and compares two intelligence descriptions of the same entity pair, showing both relationship descriptions. and Determine the relationship pair ( , Does it exist in the relational opposition table? If such a pair exists, then the pair is determined to have a contradictory relationship.

[0026] Finally, for each intelligence comparison combination, based on the detection results of the four types of rules, a comprehensive judgment is made as to whether there is a conflict between the combinations. If any one type of rule determines that there is a contradiction, then the comparison combination is in conflict. Only when all four types of rules determine that there is no contradiction is the comparison combination in conflict-free. At the same time, the specific conflict type and judgment basis of each comparison combination are recorded.

[0027] Step 224: During the comparison process, if a contradiction is detected, record the type of contradiction, the relevant intelligence statement identifier, and the contradiction intensity score to obtain the contradiction detection result. Specifically, this includes: during the comparison analysis of the four types of contradiction judgment rules in step 223, monitoring the detection results of each intelligence comparison combination in real time. If any type of contradiction is detected, the contradiction information recording operation is immediately initiated. If no contradiction is detected, no recording is performed. For intelligence comparison combinations where contradictions are detected, three types of core information are recorded sequentially. The first type is the type of contradiction, strictly labeled according to the detection results as time contradiction, numerical contradiction, etc. The first category is contradictions of shield, attribute, or relationship. If multiple contradiction types exist in the same comparison combination, all are marked without omission. The second category is the intelligence statement identifier involved. The unique intelligence statement identifier corresponding to each of the two intelligences in the comparison combination is extracted, and both identifiers are recorded completely to ensure that the corresponding intelligence content can be accurately traced based on the identifier. The third category is the intensity score of the contradiction. A quantitative intensity score is calculated for each contradiction based on the threshold difference or conflict level of the contradiction judgment rules. The score range is 0-1, with higher values ​​indicating more severe contradictions. For example, the intensity score of time contradictions can be based on the actual time difference and the time contradiction threshold. The ratio calculation, the intensity score of numerical contradiction can be based on the actual relative error and the numerical contradiction threshold. The ratio calculation involves uniformly organizing the three core information categories of all detected contradictory intelligence comparison combinations, assigning a unique contradiction identifier to each contradictory piece of information, and simultaneously marking the corresponding intelligence statement set identifier to clarify the entity or event to which the contradiction belongs. All the organized contradictory information is then summarized to form a complete contradiction detection result. This result must include all detected contradictory information without any omissions, and the type, involved intelligence identifiers, and intensity score of each contradictory piece of information must be complete, accurate, traceable, and verifiable.

[0028] Step 225: Based on the contradiction detection results, add corresponding contradiction tags to each piece of intelligence containing contradictions, and attach the contradiction type and intensity score as metadata to the intelligence, ultimately obtaining intelligence data with contradiction tags. Specifically, this includes: performing a full analysis of the contradiction detection results, extracting all contradiction identifiers, corresponding contradiction types, involved intelligence statement identifiers, and contradiction intensity scores; establishing a one-to-one correspondence between intelligence statement identifiers and contradiction information; for each intelligence statement identifier involving a contradiction, accurately locating the corresponding intelligence data in the intelligence knowledge graph, and adding a corresponding contradiction tag to that intelligence. The contradiction tags correspond one-to-one with the detected contradiction types. If an intelligence involves multiple contradiction types, then add contradiction tags of all corresponding types. The tagging format is a standardized label format that can be quickly recognized and resolved by the computer. The analysis involves using the contradiction type and intensity score corresponding to each intelligence report as metadata, which is then appended to designated fields of the intelligence data. This metadata is tightly bound to the intelligence itself and cannot be separated. If a piece of intelligence involves multiple contradictions, all contradiction types and their corresponding intensity scores are appended as metadata. The metadata is standardized to ensure a consistent format that can be directly read and analyzed in subsequent processes. After adding contradiction tags and metadata to all intelligence reports involving contradictions, this data is then uniformly organized, retaining the original content, source identifier, and collection time of the intelligence. This results in intelligence data with contradiction tags. This data must ensure that the contradiction information of each intelligence report is accurately labeled, the metadata is complete, there are no labeling errors, and no missing metadata, providing direct data support for credibility calculation and contradiction resolution.

[0029] In a preferred embodiment of the present invention, step 3 above, which involves calculating an initial credibility score for each intelligence data item marked with contradictions based on source authority and evidence support, and fusing credibility scores among multiple intelligence sources using an iterative credibility propagation algorithm to obtain a fused credibility score, may include: In this embodiment of the invention, step 330 involves extracting all intelligence entries and their relationships in the knowledge graph from the intelligence data marked with contradictions, thus obtaining a set of intelligence to be processed. Specifically, this includes: performing full data parsing on the generated intelligence data marked with contradictions, extracting all intelligence entries contained within the data, retaining the complete original content of each intelligence entry, contradiction marker metadata, unique intelligence identifier, source identifier, collection time, and all other basic information to ensure no intelligence entries are omitted or information is missing; and using the intelligence knowledge graph as the basis for association, accurately retrieving each intelligence entry from the knowledge graph based on its unique identifier. The system records all corresponding node information and the semantic relationships between the node and other intelligence entries in the knowledge graph, including all types of semantic relationships such as relationships between the same entity / event, relationships with complementary attributes, and relationships supported by evidence. It also records the direction of the relationship and the core information of the entity / event corresponding to the relationship. Each intelligence entry is bound to all the relationships retrieved in the knowledge graph, forming a corresponding data unit of intelligence entry-relationship. This ensures that the relationships of each intelligence entry can be accurately traced and are not mismatched. All intelligence entry data units that have completed the relationship binding are uniformly organized and summarized to form an intelligence set to be processed.

[0030] Step 331: For each piece of intelligence in the intelligence set to be processed, obtain the authority score of the corresponding intelligence source for each piece of intelligence, thus obtaining the source authority score for each piece of intelligence. Specifically, this includes: pre-establishing an intelligence source authority scoring system, and for all sources providing intelligence, calculating a normalized authority score for each intelligence source based on the source type (e.g., official security platforms, third-party intelligence providers, open-source intelligence sites, manual analysis channels, etc.), historical accuracy (the percentage of verified correct intelligence provided by the intelligence source in the past), and institutional credibility (the industry recognition, qualification level, reputation, etc. of the institution to which the intelligence source belongs). The score result is limited to a numerical range of 0-1, with a higher value representing a higher level of authority for the intelligence source. The system is robust, assigning a unique source identifier to each intelligence source. A standardized intelligence source authority rating table is established, mapping source identifiers to authority ratings. For each intelligence item in the dataset, its source identifier is extracted. Based on this identifier, a precise match is performed in the pre-defined intelligence source authority rating table. The normalized authority rating value corresponding to the source identifier is retrieved. This retrieved authority rating value is then bound to the corresponding intelligence item, serving as the source authority rating for that intelligence item. After matching the source authority ratings of all intelligence items, a source authority rating is obtained for each intelligence item. This rating corresponds one-to-one with the intelligence item, with no mismatches, and is a normalized value within the 0-1 range.

[0031] Step 332: For each piece of intelligence in the intelligence set to be processed, count the number of independent pieces of evidence supporting each piece of intelligence, and normalize the count to obtain the normalized number of pieces of evidence for each piece of intelligence. Specifically, this includes: for each piece of intelligence in the intelligence set to be processed, using its core factual information, such as entity attributes, event relationships, and time values, as the retrieval criteria, performing a full search in multi-source intelligence data, filtering out other intelligence entries that can effectively support the core facts of the intelligence, and the filtered supporting intelligence entries must come from different intelligence sources, that is, meet the independent evidence requirement, exclude duplicate evidence from the same intelligence source, avoid duplicate counting, and count the number of independent supporting intelligence entries that meet the requirements to obtain the number of independent pieces of evidence corresponding to each piece of intelligence. The quantity is a non-negative integer. Intelligence without supporting evidence has an independent evidence count of 0. The independent evidence count for all intelligence entries is normalized using a linear normalization method, mapping all independent evidence counts to a 0-1 range. Specifically, the independent evidence count for a single intelligence entry is divided by the largest independent evidence count among all intelligence entries. If the independent evidence count for all intelligence entries is 0, the normalization result is uniformly recorded as 0, ensuring that the normalized values ​​are all within the 0-1 range and reflect the differences in the degree of evidence support for different intelligence entries. The normalized values ​​are then bound to the corresponding intelligence entry as the normalized evidence count for that intelligence entry. After completing the statistics and normalization of all intelligence entries, the normalized evidence count for each intelligence entry is obtained.

[0032] Step 333: Based on the source authority score and the amount of normalized evidence for each piece of intelligence, calculate the initial credibility score for each piece of intelligence using a weighted summation method; specifically, this includes: pre-setting two weighting coefficients, namely the weighting coefficient for source authority. Weighting coefficients for the normalized amount of evidence And the two weight coefficients satisfy + The constraint condition is 1. and The values ​​are all in the range of 0-1 and can be flexibly set according to the needs of actual intelligence analysis scenarios. This is used to balance the impact of source authority and evidence support on initial credibility. For each piece of intelligence, its corresponding source authority score and normalized evidence quantity are retrieved, and the initial credibility is calculated using a preset formula: ,in Assign an initial credibility score to this intelligence report. Rate the authority of the source of this intelligence. This represents the normalized evidence count for this intelligence; the specific calculation process involves using weighting coefficients. Multiply by the source authority score to obtain a weighted score for source authority, and then use the weighting coefficients. Multiply by the normalized number of evidences to obtain a weighted score for evidence support. Then add the two weighted scores together to get the initial credibility score of the intelligence. The initial credibility calculation is completed for all intelligence items in the intelligence set to be processed in the above calculation method. All initial credibility scores are values ​​in the range of 0-1. The calculated initial credibility scores are uniquely bound to the corresponding intelligence items to obtain the initial credibility score of each intelligence.

[0033] Step 334: Based on the semantic relationships between intelligence entries in the intelligence knowledge graph, intelligence entries with initial credibility scores are used as nodes, semantic relationships are used as edges, and weights are assigned to each edge according to the relationship type and strength to construct a credibility propagation network. Specifically, this includes: using all intelligence entries with initial credibility scores in the intelligence set to be processed as network nodes, each intelligence entry corresponding to a unique node in the credibility propagation network; assigning a unique identifier consistent with the intelligence entry to each node; attaching the node's initial credibility score as the node's initial attribute value to the corresponding node; using the semantic relationships between intelligence entries in the intelligence knowledge graph as a basis, using each type of semantic relationship between intelligence entries as an edge connecting the corresponding nodes in the credibility propagation network; if there is a semantic relationship between two intelligence entries, an edge is established between the corresponding two nodes, with the direction of the edge consistent with the logical direction of the semantic relationship; no edge is established between nodes without semantic relationships, ensuring a one-to-one correspondence between edges and semantic relationships between intelligence entries; and assigning edge weights to each edge in the credibility propagation network. The edge weights range from 0 to 1. Higher values ​​indicate stronger semantic association between the intelligence items corresponding to the two nodes. The weights are set based on the association type and strength between the intelligence items. Higher edge weights are assigned to associations supported by core facts or strongly related to the same entity / event. Lower edge weights are assigned to associations that are indirect or weakly related. For associations without actual semantic support, the edge weight is set to 0. The specific values ​​of the edge weights can be set based on domain experience and association analysis results. The association type and weight are set for each edge record. All nodes, edges, and edge weights are integrated to form a complete weighted directed network, namely the credibility propagation network. This network can reflect the semantic association and strength between intelligence items, and each node has an initial credibility score attribute, providing a complete network topology for iterative credibility propagation.

[0034] Step 335: Starting with the initial credibility score, an iterative algorithm is used to propagate and update the credibility of nodes in the credibility propagation network. In each iteration, the credibility update value of each node is calculated by combining the node's credibility from the previous round with the weighted sum of the credibility of all its neighboring nodes. Specifically, this includes: using the initial credibility score calculated in step 333 as the initial credibility value of all nodes in the credibility propagation network, denoted as... ,in This value serves as the unique identifier for the node, and is used as the starting point for iterative calculations. The initial value for the iteration round is set to k=0, and the damping factor is pre-defined. This factor is a value in the range of 0-1, preferably between 0.6 and 0.8. It is used to retain the node's own credibility memory and balance the impact of the node's own credibility and the credibility propagated by neighboring nodes on the node's updated value. The first round of iteration calculation is initiated, with iteration number k=k+1, for each node in the credibility propagation network. The credibility value is updated and calculated using a pre-defined iterative credibility propagation formula, which is as follows: ,in For nodes The credibility update value after the (k+1)th iteration. For nodes The credibility value of the k-th iteration. For nodes The set of all neighboring nodes (i.e., nodes with the node) (All nodes directly connected by an edge). For nodes with neighboring nodes Edge weights between them For neighboring nodes The reliability value of the kth iteration; the specific calculation process is as follows: First, using the damping factor... Multiply by node Credibility score of the previous round The first step is to obtain the retention score of the node's own credibility; the second step is to traverse the nodes. All neighboring nodes Use edge weights in sequence Multiply by neighboring nodes credibility value of the previous round Get each neighbor node pair The propagation weighted score is then summed with the propagation weighted scores of all neighboring nodes to obtain the credibility weighted sum of the neighboring nodes; the third step is to subtract the damping factor from 1. The propagation weight coefficient is obtained, and then this coefficient is multiplied by the weighted sum of the credibility of neighboring nodes to obtain the comprehensive score of neighboring node propagation; the fourth step is to add the node's own credibility retention score to the comprehensive score of neighboring node propagation to obtain the node's own credibility retention score. Credibility update value in this iteration Following the above calculation method, the current round of credibility update calculation for all nodes in the credibility propagation network is completed, ensuring that the update value of each node is calculated based on the node credibility of the previous round and the weighted sum of the neighbor nodes, with no node omissions and no calculation errors. After completing one round of iteration, all nodes obtain the corresponding credibility update value.

[0035] Step 336: Repeat the iterative update until the maximum change in credibility of all nodes is less than the preset convergence threshold, or the preset maximum number of iterations is reached, then stop the iteration to obtain the final credibility score of each intelligence fusion; specifically, this includes: pre-setting two iteration termination conditions, the first being the convergence threshold. The first value is a very small positive number, preferably 0.001, used to determine whether the node's credibility tends to stabilize; the second is the maximum number of iterations. This value is a positive integer, preferably 50, to avoid infinite iteration. Iteration stops when either of the two termination conditions is met. After each iteration in step 335, the credibility change value of all nodes in the credibility propagation network is calculated, which is the absolute difference between the current credibility update value and the previous credibility value for each node. The formula is: Then, select the maximum value from all the confidence changes of the nodes, and denote it as... The maximum value of the confidence change obtained from the screening. With the preset convergence threshold Compare the results and check whether the current iteration round has reached the preset maximum number of iterations. ,like < This indicates that the confidence values ​​of all nodes have stabilized and the convergence condition has been met, so the iterative calculation should be stopped immediately; if the current iteration reaches... Even if the convergence condition is not met, the iterative calculation is stopped immediately. If neither condition is met, the process returns to step 335 to continue the next round of iterative update calculation until either termination condition is met. After the iterative calculation stops, the final credibility value of all nodes in the credibility propagation network is extracted. This value is the final credibility score of the corresponding intelligence item after credibility fusion among multiple intelligence sources. The final credibility score is uniquely bound to the corresponding intelligence item to complete the credibility fusion calculation of all intelligence items and obtain the final credibility score of each intelligence fusion. This score is a quantitative value in the range of 0-1, which can comprehensively reflect the overall credibility of the intelligence's own source, evidence support, and multi-source intelligence correlation support.

[0036] By extracting all entries and their relationships from intelligence with contradictory markers and forming a set to be processed, the integrity and relevance of the credibility calculation data are ensured. A normalized authority scoring system is established based on the objective attributes of the intelligence source, realizing a quantitative assessment of the source authority and matching a source authority score to each piece of intelligence.

[0037] In a preferred embodiment of the present invention, step 4 above, which involves automatically resolving or marking contradictory information based on the fused credibility score and intelligence data with contradiction markers according to preset multi-level resolution rules to obtain integrated intelligence, may include: In this embodiment of the invention, step 440 involves forming a set of contradictory intelligence statements by comprehensively considering the credibility score after fusion, the number of supporting sources, and the intelligence acquisition time. Specifically, this includes: performing a full analysis of the intelligence data marked with contradictions; grouping multiple intelligence statements describing the same entity / event that conflict with each other based on the contradiction mark metadata, using the same contradiction point as the core classification criterion; grouping intelligence statements with contradictions in the same attribute of the same entity / the same element of the same event into one group, and avoiding mixing intelligence statements with different contradiction points, ensuring that each group of intelligence statements revolves around a single contradiction point without cross-contradiction; and extracting three types of core judgment information for each intelligence statement in each group and completing information binding. The first type is the fused credibility score, i.e., the final credibility of the intelligence obtained in step 336. The data is quantified, retaining the original, accurate values ​​without rounding or simplification. The second category is the number of supporting sources, i.e., the number of different independent intelligence sources supporting the core fact of the intelligence, which is a non-negative integer, directly retrieving the number of original independent evidence counted in step 332. The third category is the intelligence acquisition time, i.e., the actual collection time of the intelligence, in standard UTC timestamp format, ensuring the comparability of time information. The basic information of each set of contradictory intelligence statements is integrated with the above three categories of core judgment information, assigning a unique contradiction set identifier to each set of contradictory intelligence, marking the entity / event information and contradiction type corresponding to the contradiction set, while retaining the unique intelligence identifier, source identifier, original content and other basic information for each piece of intelligence in the group, forming a structured contradictory intelligence data unit. All structured contradictory intelligence data units built around a single contradiction point are uniformly summarized and organized to form a set of contradictory intelligence to be resolved.

[0038] Step 441: Following the priority order of majority consensus, timeliness, and authority, the resolution rules are applied sequentially to automatically resolve the conflicting intelligence set, yielding preliminary resolution results. If intelligence satisfies the majority consensus rule, it is used as the preliminary resolution result. If the majority consensus rule cannot be applied, the latest intelligence is selected as the preliminary resolution result using the timeliness priority rule. If they still cannot be distinguished, the intelligence with the highest credibility score is used as the preliminary resolution result. If the above rules fail to yield a preliminary resolution result, the rule resolution is deemed to have failed. Specifically, for each conflicting intelligence data unit in the conflicting intelligence set to be resolved, i.e., a set of conflicting intelligence corresponding to a single conflicting point, the resolution rules are applied sequentially according to the fixed priority order of majority consensus, timeliness priority, and authority priority. If the previous rule yields a valid resolution result, the application of subsequent rules is terminated. The resolution judgment of the next rule is only initiated when the previous rule cannot be applied. The rule application is without skipping steps or reversing, ensuring the standardization of the resolution logic.

[0039] Two core decision thresholds for majority consensus rules are pre-defined, the first being the minimum number of supporting sources. The first value is a positive integer, preferably 3, representing the minimum number of independent supporting sources required for the intelligence; the second is the credibility ratio coefficient. This value is a number between 0 and 1, with a preferred value of 0.7, representing that the credibility of the intelligence should be higher than the average credibility within the group by a multiple. For the current conflict intelligence group, the number of supporting sources for each intelligence statement within the group is counted. Each piece of intelligence With preset threshold By comparing and selecting those with a number of supporting sources greater than or equal to [the specified number], [the desired number of sources can be identified]. The intelligence that is most supported is denoted as the majority support candidate intelligence; if no majority support candidate intelligence is found, then all intelligence is considered as... All less than If the majority consensus rule is not applicable, the timeliness priority rule is activated; if a majority of supporting candidate intelligence is selected, the average credibility score of all intelligence fusion within the conflicting intelligence group is calculated. The calculation method is to sum the credibility scores of all intelligence within the group, and then divide the sum by the total number of intelligence within the group to obtain an accurate average credibility value.

[0040] For each candidate intelligence piece that receives majority support, calculate its credibility score. Compared with average credibility product value Then, score the actual credibility of the candidate intelligence. and To make a comparison, if > If the intelligence meets all the conditions of the majority consensus rule, then the intelligence with the most supporting sources is selected. If the number of supporting sources is the same, the intelligence with the highest credibility score is selected as the initial resolution result, and the application of all subsequent rules is terminated. If the majority of the selected supporting candidate intelligence does not meet the credibility requirements, then the majority consensus rule is determined to be inapplicable, and the timeliness priority rule is activated.

[0041] The median percentage of credibility of pre-set timeliness priority rules , this value is a numerical value in the range of 0 - 1, preferably taking the value of 0.8, representing the multiple by which the credibility of the candidate intelligence needs to be higher than the median credibility within the group; at the same time, an ellipse focus and eccentricity calculation algorithm is introduced to quantitatively screen the effectiveness of the intelligence acquisition time. Through this algorithm, a time effectiveness evaluation framework is constructed to identify the intelligence with time effectiveness advantages. The specific construction and calculation process is as follows: based on the standard UTC timestamps of all the intelligence within the current conflicting intelligence group as the basic data, set the time axis as the horizontal axis, map the acquisition times of all the intelligence to the time axis, and extract the earliest acquisition time within the group and the latest acquisition time , take and as the two foci F1 and F2 of the ellipse. The distance between the two foci on the time axis is the focal length 2c of the ellipse. The calculation method is to subtract the earliest acquisition time from the latest acquisition time , that is, 2c = - . Half of the focal length c = ( - ) / 2; calculate the average value of the acquisition times of all the intelligence within the group, and take as the core reference point on the ellipse. Take the sum of the distances from the two foci F1 and F2 to as the major axis length 2a of the ellipse, that is, 2a = ∣ - ∣ + ∣ - ∣. Half of the major axis a = (∣ - ∣ + ∣ - ∣) / 2; calculate the eccentricity e of the ellipse. The eccentricity formula is e = c / a. The value range of the eccentricity e is 0 < e < 1. The closer the e value is to 0, the more concentrated the intelligence acquisition times within the group are. The closer the e value is to 1, the more dispersed the intelligence acquisition times within the group are; set the eccentricity determination threshold (preferably taking the value of 0.6). If the calculated eccentricity e ≤ , it is determined that the time distribution within the group is concentrated, and directly take the intelligence with the latest acquisition time as the time-effective candidate intelligence; if e > , it is determined that the time distribution within the group is dispersed,剔除 the abnormal time intelligence outside the ellipse on the time axis, and then select the intelligence with the latest acquisition time from the remaining intelligence as the time-effective candidate intelligence; if there are multiple pieces of intelligence with the same latest acquisition time, then list all these pieces of intelligence as time-effective candidate intelligence.

[0042] Calculate the median of the credibility scores after fusing all the intelligence within the current conflicting intelligence group.The calculation method involves sorting the credibility scores of all intelligence within a group from lowest to highest. If the number of intelligence items in the group is odd, the median is taken as the middle value after sorting; if it is even, the median is taken as the average of the two middle values ​​after sorting. The product of the median and the percentage coefficient is then calculated. For each timely candidate intelligence report, its actual credibility is scored. and To make a comparison, if ≥ If the intelligence meets the timeliness priority rule, it is considered the initial resolution result, and the application of subsequent rules is terminated. If multiple timeliness candidate intelligences meet the conditions, the intelligence with the highest credibility score is selected as the initial resolution result. If the credibility scores of all timeliness candidate intelligences are lower than a certain threshold, the intelligence with the highest credibility score is selected as the initial resolution result. If the time-priority rule is not applicable, the authority-priority rule will be invoked.

[0043] For all intelligence statements within the current conflict intelligence group, extract the final credibility score of each intelligence fusion, sort all scores from highest to lowest, and select the intelligence with the highest credibility score as the authoritative candidate intelligence. If there is only one authoritative candidate intelligence with the highest credibility score, directly use it as the preliminary resolution result. If there are multiple intelligences with the same highest credibility score, i.e., the scores are tied for first place and there is no unique highest value intelligence, then the authority priority rule cannot be applied. If after applying the majority consistency, timeliness priority, and authority priority rules in sequence, none of them can select intelligence that meets the conditions and obtain an effective preliminary resolution result, then the conflict intelligence group rule resolution is directly determined to have failed, and no preliminary resolution result is output.

[0044] Step 442: Based on the preliminary resolution results, a judgment is made. If the credibility of all contradictory intelligence is lower than the preset threshold, or cannot be resolved by the above rules, the relevant intelligence is marked as questionable and obtained for manual review; otherwise, the preliminary resolution results are adopted as the resolution decision; and the knowledge graph is updated according to the resolution decision to generate integrated intelligence; specifically, this includes: pre-setting an absolute credibility threshold. This value is a number in the range of 0-1, with a preferred value of 0.2, representing the minimum credibility value for basic intelligence. It serves as the core criterion for determining whether intelligence has reference value. For each group of contradictory intelligence in the set to be resolved, a dual judgment is performed. The first judgment is a rule resolution result judgment, determining whether a valid preliminary resolution result has been obtained. If step 441 determines that rule resolution has failed, a doubtful flag is directly triggered. The second judgment is an overall credibility judgment. If a preliminary resolution result has been obtained, the credibility score of all intelligence within the contradictory intelligence group is further calculated. If the credibility scores of all intelligence are lower than the preset value... If the overall reference value of the intelligence group is extremely low, a doubtful flag is triggered; if none of the above doubtful conditions are triggered, a valid preliminary resolution result is obtained and not all intelligence within the group has a credibility level lower than [a certain threshold]. If the initial resolution result is adopted as the final resolution decision for the conflict point, then for the conflict intelligence group that triggered the doubt flag, a standardized doubt flag is added to all intelligence in the group, along with metadata about the reason for the doubt. The complete information of the intelligence in the group, including the original content, credibility score, number of supporting sources, acquisition time, and conflict type, is packaged and organized to form a manual review checklist. Each doubt item in the checklist corresponds to a unique conflict set identifier, ensuring accurate traceability and verification during manual review. For the conflict intelligence group that adopts the resolution decision, the intelligence knowledge graph is updated in real time according to the final resolution result. The adopted intelligence statement is used as the authority value of the corresponding attribute / element of the entity / event, and updated to the corresponding node and triple in the knowledge graph, marking the resolution basis for the authority value. Metadata such as credibility scores and adoption rules are included. For other rejected conflict intelligence statements within the group, their historical records in the knowledge graph are retained, and standardized tags for refuted or lower conflict versions are added to mark the contradictions with the authority value, ensuring the historical traceability of the knowledge graph and the consistency of current information. The processing results of all conflict intelligence groups are integrated, and the core information of the knowledge graph updated after all adoption and resolution decisions is extracted to form a high-credibility core fact base, which includes accurate information such as entity attributes, event elements, and relationships between entities after resolution. The manual review checklist is integrated with the core fact base, and a resolution process summary is added (marking the resolution rules, decision basis, and credibility assessment results applied to each contradiction point), ultimately forming a structured and standardized integrated intelligence.

[0045] By grouping conflict intelligence according to the same point of conflict and integrating three core judgment information categories—credibility, supporting source, and acquisition time—the system achieves the classification and standardized processing of conflict resolution targets, avoiding interference across conflict points. By setting three-level resolution rules with fixed priorities, the system achieves intelligent and hierarchical automatic resolution of conflict intelligence.

[0046] In a preferred embodiment of the present invention, step 5 above, which integrates intelligence and actual verification information as feedback, dynamically optimizes the structured processing parameters, the threshold for contradiction judgment rules, and the weights of the credibility calculation and fusion model to form a closed-loop optimization mechanism, may include: In this embodiment of the invention, step 550 involves extracting all intelligence resolution cases that have been manually reviewed or confirmed as correct, and intelligence resolution cases confirmed as incorrect, from the integrated intelligence and actual verification information to obtain a positive sample case set and a negative sample case set. Specifically, this includes: performing a full analysis of the integrated intelligence, extracting the processing results of all contradictory intelligence, including the adoption results after automatic resolution and the judgment results after manual review; simultaneously extracting complete information corresponding to each case, covering all metadata such as the contradiction type, involved intelligence items, rules applied in the resolution, credibility score, number of supporting sources, intelligence acquisition time, and resolution decision basis, ensuring no missing case information; collecting actual verification information corresponding to the integrated intelligence, which is the objective factual result obtained through offline verification, actual scenario verification, and confirmation by authoritative institutions; matching the actual verification information with the resolution cases in the integrated intelligence one by one to determine the actual judgment result of each resolution case, i.e., whether the resolution decision of the case is consistent with objective facts. Based on the actual judgment results and the conclusions of manual review, all resolution cases are classified and screened. The first category is positive sample cases, which are intelligence resolution cases that have been confirmed to be correct by manual review or whose automatic resolution results are consistent with the actual verification information. These cases represent the effectiveness of resolution decisions and rule application. The second category is negative sample cases, which are intelligence resolution cases that have been confirmed to be incorrect by manual review or whose automatic resolution results contradict the actual verification information. These cases represent deviations in resolution decisions or rule application. Each positive and negative sample case is assigned a unique sample identifier, and core feature tags are labeled for each case, including the type of contradiction judgment rule, credibility calculation parameters, type of resolution rule application, and intelligence source type, to ensure that sample features are traceable. All positive sample cases are summarized and organized to form a positive sample case set, and all negative sample cases are summarized and organized to form a negative sample case set. Both sets contain complete case information and feature tags, with no case omissions and no tag mismatches.

[0047] Step 551: Based on the accuracy statistics of each intelligence source in the positive and negative sample case sets when providing information, dynamically update the intelligence source authority score corresponding to each intelligence, obtaining the updated intelligence source authority score. Specifically, this includes: performing a full traversal of the positive and negative sample case sets; for each case, extracting all intelligence source identifiers involved, and determining whether the intelligence content provided by each intelligence source in that case is an objective fact, i.e., whether it is consistent with the actual verified information; establishing a correspondence between intelligence source identifiers and case fact matching results; and for each intelligence source, calculating its total number of participations in all sample cases. The number of times facts are correctly provided The total number of participations is the total number of times the intelligence source appears in both positive and negative sample cases. The number of times facts are correctly provided is the number of cases where the intelligence content provided by the intelligence source is consistent with the actual verified information. During the statistical process, it is ensured that there is no duplicate counting and no omissions in the counts. The actual accuracy P of each intelligence source is calculated by using the number of times facts are correctly provided by that intelligence source. Divide by total number of participations That is, P= / If a source's total participation count is 0, its original authority rating is retained and not updated. If the total participation count is greater than 0, the rating is updated based on the actual accuracy rate. Then, the source's original authority rating is retrieved. The score is a normalized value in the 0-1 range. The original score is dynamically updated based on the actual accuracy P, using the following formula: = × + ×P, where The updated authority rating for this intelligence source. These are the weighting coefficients of the original scores. The weighting coefficients for the actual accuracy, and satisfying the following conditions: + =1, and The value can be a number between 0 and 1, and can be set according to the richness of historical data from the intelligence source; the richer the historical data, the higher the value. The higher the value, the more important the new intelligence principle. The higher the value, the better; the specific calculation process uses weighting coefficients. Multiply by the original authoritative rating This yields a weighted score based on the original ratings; using weighting coefficients... Multiply by the actual accuracy rate P to obtain a weighted score for the actual accuracy rate; add the two weighted scores together to get the updated authority score for the intelligence source. To ensure the updated score remains a normalized value within the 0-1 range, after calculating the authority scores for all intelligence sources, the intelligence source identifier will be updated to reflect the new authority score. By binding them one by one, an updated intelligence source authority rating table is formed, and the updated authority rating of the intelligence source corresponding to each piece of intelligence is obtained.

[0048] Step 552: Based on the case data in the positive and negative sample case sets, dynamically adjust the thresholds of the four preset conflict judgment rules to obtain optimized conflict judgment rule thresholds. Specifically, this includes: classifying and decomposing the positive and negative sample case sets according to four conflict judgment rule types: time conflict, numerical conflict, attribute conflict, and relationship conflict. The sample cases are then divided into four sub-sample sets, each corresponding to one type of conflict judgment rule, ensuring that the optimization of each rule is supported by dedicated sample data. For each sub-sample set corresponding to a conflict judgment rule, extract the original conflict judgment data and judgment results involved in the case. For time conflicts, extract the time attribute values ​​of the intelligence and the original time conflict threshold. 1. Whether the contradiction determination result is accurate; for numerical contradictions, the numerical attribute values ​​of the extracted intelligence and the original relative error threshold. 1. Whether the contradiction determination result is accurate; for attribute contradictions, extract attribute value pairs and the original attribute semantic conflict table. 1. Whether the contradiction determination result is accurate; for relational contradictions, extract the relationship pairs between entities and the original relationship opposition table. Whether the contradiction determination result is accurate, and the time contradiction threshold. Numerical contradiction threshold These quantitative thresholds are dynamically adjusted. Based on positive sample cases, the maximum and average values ​​of time difference and relative error are statistically analyzed for cases with accurate judgments. Based on negative sample cases, the critical values ​​of time difference and relative error are statistically analyzed for cases with incorrect judgments. Combining the statistical results of the two types of samples, the original threshold is fine-tuned. The adjustment principle is that if the threshold is too high in negative samples, resulting in missed contradictions, the threshold is lowered; if the threshold is too low, resulting in misjudgments, the threshold is raised. The adjusted threshold is still a reasonable value that is domain-appropriate, ensuring the accuracy of contradiction judgment.

[0049] Next, regarding the attribute semantic conflict table Relationship Opposition Table These rule tables are dynamically optimized. Accurately judged attribute conflict pairs and relation opposition pairs are extracted from positive sample cases, and their priority is retained and strengthened. Incorrectly judged entries are extracted from negative sample cases; if a case is missed, the corresponding attribute value pair or relation pair is added to the rule table; if a case is misjudged, the corresponding entry is deleted. Simultaneously, entries in the rule table are categorized and labeled, and conflict / opposition intensity scores are added to improve the accuracy of the rule table. After adjusting the thresholds for the four types of conflict judgment rules and optimizing the rule table, the adjusted time conflict thresholds are applied. Numerical contradiction threshold and the optimized attribute semantic conflict table Relationship Opposition Table The results are summarized to obtain the optimized threshold for conflict determination rules, ensuring that the threshold for each type of rule is adapted to the determination requirements of actual cases.

[0050] Step 553: Based on the case data in the positive and negative sample case sets, retrain or fine-tune the weight coefficients involved in the initial credibility calculation formula to obtain the optimized initial credibility calculation weights; specifically, this includes: retrieving the initial credibility calculation formula... It is clarified that the weight coefficients to be optimized in the formula are weight coefficients from authoritative sources. Weighting coefficients for the normalized amount of evidence And the original coefficients satisfy + =1, this constraint is retained during the optimization process. The positive and negative sample case sets are used as training data. The optimization objective is the matching degree between the initial credibility calculation result and the actual credibility level. A higher matching degree indicates a more reasonable weight coefficient. The actual credibility level is determined by the actual verification information of the case; that is, if the intelligence content is consistent with objective facts, the actual credibility level is 1, and if inconsistent, it is 0. If the number of sample cases reaches a preset large-scale training threshold, the weight coefficients are retrained. The source authority rating and the number of normalized evidence in each case are used as input features, and the actual credibility level is used as the label to construct a regression training model. The weight coefficients are then adjusted using gradient descent. and Iterative training is performed, and in each round of training, the mean square error between the initial confidence prediction and the actual confidence level is calculated. The error is then adjusted through backpropagation. and The value of is maintained until the mean squared error is less than the preset convergence threshold, and this value is always maintained during the training process. + =1, the specific training calculation process is as follows: first set and The initial iteration value is the original coefficient value; then use Multiply by the source's authority rating, plus Multiply by the normalized number of evidences to obtain the initial confidence prediction; then calculate the mean squared error between the predicted value and the actual confidence level, which is the sum of the squares of (predicted value - actual value) of all cases divided by the total number of cases; then, based on the gradient direction of the mean squared error, adjust... and Make minor adjustments, and the desired performance is still achieved. + =1; Repeat the above steps until the mean squared error converges; If the number of sample cases does not reach the threshold for large-scale training, fine-tune the weight coefficients. Based on positive sample cases, statistically analyze the contribution of source authority and evidence support to the initial credibility in cases with accurate judgments. Based on negative sample cases, statistically analyze the deviation direction of the weight coefficients in cases with incorrect judgments. If an excessively large number of sources leads to an overemphasis on source authority and results in incorrect judgments, then the size should be appropriately reduced. ,improve Conversely, increase appropriately. ,reduce The fine-tuning range is controlled within 0.05-0.2 to ensure the rationality of the coefficient adjustment. After retraining or fine-tuning, the optimized weight coefficients are obtained. and And satisfy This optimized initial credibility calculation weight is used to replace the original coefficient in subsequent initial credibility calculations.

[0051] Step 554: Based on the case data in the positive and negative sample case sets, retrain or fine-tune the edge weights involved in the credibility propagation network to obtain the optimized credibility propagation network edge weights; specifically, this includes: retrieving the construction rules of the credibility propagation network and determining the edge weights to be optimized in the network. This weight is a value in the range of 0-1, representing the intelligence node. and The semantic association strength and the rationality of edge weights directly affect the accuracy of credibility propagation. This study analyzes the positive and negative sample case sets, extracting the intelligence node pairs involved in each case, the semantic association types between nodes, and the matching between the credibility propagation result and the actual credibility level. A correspondence between intelligence node pairs, edge weights, and propagation result matching degree is established; a higher matching degree indicates a more reasonable edge weight for that node pair. Node pairs are classified according to semantic association types, including strong associations of the same entity, weak associations of event attributes, and evidence-supported associations. Each association type corresponds to a set of edge weights, ensuring consistent optimization standards for edge weights of the same association type. For the edge weights of each association type, retraining or fine-tuning methods are selected based on the number of sample cases. If the number of samples is sufficient, a supervised training model is constructed with the propagation result matching degree as the optimization objective. The association features between nodes are used as input, and the edge weights corresponding to the final propagation result are used as labels to adjust the edge weights. Iterative training is performed, during which a loss function is used to calculate the error of the propagation results. The edge weights are adjusted through backpropagation of the error until the loss function converges. If the number of samples is insufficient, the edge weights that propagate accurately in positive samples are used as a benchmark, and the edge weights that propagate incorrectly in negative samples are fine-tuned. If excessively large edge weights lead to over-propagation of credibility, the edge weights are appropriately reduced; if insufficiently small edge weights lead to under-propagation of credibility, the edge weights are appropriately increased. After fine-tuning, the weights remain within the 0-1 range. After optimizing the edge weights for all semantic association types, the optimized edge weights are... By binding each edge weight to the corresponding intelligence node pair and semantic association type, an updated edge weight table is formed, resulting in the optimized credibility propagation network edge weights, which provides accurate weight basis for the subsequent construction of the credibility propagation network.

[0052] Step 555: Based on the case data in the positive and negative sample case sets, perform incremental learning or periodic retraining on the named entity recognition model and relation extraction model involved in the natural language processing pipeline to obtain optimized feature extraction model parameters. Specifically, this includes: performing deep analysis on the positive and negative sample case sets to extract the original intelligence text, identified entity information, and extracted relation information involved in the cases. Simultaneously, combined with actual verification information, label entries with correct entity recognition, entries with incorrect entity recognition (missed or false positives), entries with correct relation extraction, and entries with incorrect relation extraction (missed or false positives), forming dedicated training parameters for the named entity recognition model and relation extraction model. Training samples are used to label each sample with entity and relation labels, ensuring the labels are consistent with objective facts. For the named entity recognition model and relation extraction model, incremental learning or periodic retraining is chosen based on the scale of new sample cases. Incremental learning is used for small batches of new samples, while periodic retraining is used for large batches of accumulated samples. Both methods aim to improve the model's feature extraction accuracy. Incremental learning is implemented by keeping the original model parameters unchanged, adding the labeled new sample cases to the model's training set, freezing the model's lower-level feature extraction layer, and fine-tuning only the top-level classification layer. During training, the accuracy of entity recognition and relation extraction is prioritized. The accuracy rate is used as the evaluation metric. Stochastic gradient descent is employed to adjust the parameters of the top-level classification layer until the accuracy no longer improves. This ensures the model adapts to new intelligence features while retaining its original learning capabilities. The specific incremental learning calculation process is as follows: First, the original intelligence text of the new samples is input into the model, and feature vectors are obtained through the bottom-level feature extraction layer. Then, the feature vectors are input into the top-level classification layer to obtain prediction results for entity recognition and relationship extraction. Next, the cross-entropy loss between the prediction results and the labeled tags is calculated. The parameters of the top-level classification layer are then adjusted based on the loss value, while the bottom-level parameters remain unchanged. These steps are repeated until the cross-entropy loss converges and the accuracy reaches the target. Periodic retraining is then performed, involving all labeled sample cases (original...) The training set and newly added sample cases are mixed to form a new training set for the model. The named entity recognition model and relation extraction model are fully retrained. All parameters from the bottom feature extraction layer to the top classification layer participate in the iterative update. During the training process, batch training and early stopping mechanisms are used to avoid model overfitting. The accuracy of the model on the validation set is used as the convergence criterion until the accuracy reaches the preset standard. After completing incremental learning or periodic retraining, all parameters of the model after training are extracted, including the weights and biases of the feature extraction layer, the matrix parameters and activation function parameters of the classification layer, etc. They are summarized and organized to obtain the optimized feature extraction model parameters, which replace the original model parameters and are applied to the subsequent natural language processing pipeline.

[0053] Step 556 involves applying the intelligence source authority score, contradiction judgment rule threshold, initial credibility calculation weight, credibility propagation network edge weight, and feature extraction model parameters to the new round of multi-source intelligence processing, forming a closed-loop optimization mechanism from intelligence input to intelligence output. Specifically, this includes: unifying and integrating the updated intelligence source authority score obtained in step 551, the optimized contradiction judgment rule threshold obtained in step 552, the optimized initial credibility calculation weight obtained in step 553, the optimized credibility propagation network edge weight obtained in step 554, and the optimized feature extraction model parameters obtained in step 555 to form a full set of optimized parameters. Each parameter is labeled with its applicable scenario, optimization basis, and sample support to ensure the traceability of parameter application. The full set of optimized parameters is then bound to each core link of the multi-source intelligence processing flow to achieve practical application. The optimized feature extraction model parameters are deployed to the natural language processing pipeline in the structured processing stage for named entity recognition and relation extraction. The updated intelligence source authority score and optimized initial credibility calculation weights are deployed to the credibility calculation stage for initial credibility calculation. Optimized credibility propagation network edge weights are deployed to the credibility fusion stage for credibility propagation network construction. Optimized contradiction judgment rule thresholds are deployed to the contradiction detection stage for contradiction judgment in multi-source intelligence. A new round of multi-source intelligence processing is initiated, inputting newly collected multi-source intelligence data into the processing system. The system automatically calls the full optimized parameter set and processes the data according to the process of structured processing, contradiction detection, credibility calculation and fusion, contradiction resolution, and integrated intelligence output. This ensures that the optimized parameters are effectively applied in each stage, with no parameter omissions or mismatches. The output results of the new processing stage are tracked, and intelligence and corresponding actual verification information are collected and integrated. Steps 550 to 555 are repeated to extract a new set of sample cases. Continuous dynamic optimization of various parameters and models is performed, forming a cyclical mechanism of parameter optimization, process application, result feedback, and further optimization. Finally, through the above cyclical operation, an end-to-end closed-loop optimization mechanism is constructed, from multi-source intelligence input to integrated intelligence output, then to result feedback and parameter optimization, and finally feeding back into a new round of intelligence processing.

[0054] By extracting positive and negative sample cases from integrated intelligence and actual verification information and forming a standardized set, the bias of subjective optimization is avoided. The actual accuracy rate of the intelligence source in the sample cases is used as the core basis to dynamically update the authority score of the intelligence source, making the score more in line with the actual performance of the intelligence source and improving the objectivity and accuracy of the source authority assessment.

[0055] Embodiments of the present invention also provide a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method described above. All implementations in the above method embodiments are applicable to this embodiment and can achieve the same technical effects.

[0056] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for contradiction detection and credibility fusion based on multi-source intelligence, characterized in that, The method includes: Step 1: The collected multi-source intelligence data is structured and the entity, attribute, relationship and time information is extracted and converted into a standard triple format to construct an intelligence knowledge graph; Step 2: Semantically align multiple pieces of intelligence describing the same entity or event in the intelligence knowledge graph, and perform contradiction detection based on preset contradiction judgment rules to obtain intelligence data with contradiction tags. Step 3: For intelligence data marked with contradictions, calculate the initial credibility of each intelligence based on the authority of the source and the degree of evidence support, and perform credibility fusion among multiple intelligence sources through an iterative credibility propagation algorithm to obtain the fused credibility score. Step 4: Based on the fused credibility score and the intelligence data marked with contradictions, the contradictory information is automatically resolved or marked according to the preset multi-level resolution rules to obtain integrated intelligence. Step 5 involves using integrated intelligence and actual verification information as feedback to dynamically optimize structured processing parameters, contradiction judgment rule thresholds, and the weights of credibility calculation and fusion models, forming a closed-loop optimization mechanism.

2. The method for contradiction detection and credibility fusion based on multi-source intelligence according to claim 1, characterized in that, The collected multi-source intelligence data is structured, and entity, attribute, relationship, and time information are extracted and converted into a standard triple format to construct an intelligence knowledge graph, including: The raw intelligence data is obtained in real time or periodically from multiple intelligence sources through a preset data acquisition interface to obtain the raw dataset. The original dataset is cleaned to remove redundant, erroneous, or irrelevant information, and the data format is uniformly preprocessed to obtain cleaned data. The cleaned data is processed using a natural language processing pipeline to perform named entity recognition, extracting a set of entities including attackers, victims, geographic locations, malware, and time points. Relationships are extracted from each entity in the entity set to identify semantic relationships between entities, resulting in a relation set. Time expressions appearing in the cleaned data are parsed, and all time information is normalized to a standard timestamp format using a time parser, resulting in a time information set. The entity set, relation set, and time information set are integrated, and each piece of intelligence information is transformed into a unified triplet form to obtain a triplet set. The triple set is stored in a graph database to construct an intelligence knowledge graph with entities as nodes and relationships as edges.

3. The method for contradiction detection and credibility fusion based on multi-source intelligence according to claim 2, characterized in that, The semantic relations include attack, exploit, location, and membership type; the triples include a subject entity, a predicate, and an object entity or attribute value.

4. The method for contradiction detection and credibility fusion based on multi-source intelligence according to claim 3, characterized in that, Semantic alignment is performed on multiple pieces of intelligence describing the same entity or event in the intelligence knowledge graph, and contradiction detection is performed based on preset contradiction judgment rules to obtain intelligence data with contradiction tags, including: Extract all entity nodes and their corresponding triples from the intelligence knowledge graph to obtain the original entity data to be aligned. By calculating the semantic similarity of entity names, context attributes and relation embedding vectors, identify different entity references that may point to the same real-world entity and obtain candidate alignment entity pairs. Entities with similarity exceeding a preset alignment threshold in candidate alignment entity pairs are merged, and multiple nodes pointing to the same entity are unified into a single entity identifier to complete entity semantic alignment and obtain an aligned entity set. Based on the aligned entity set, for each entity or event node, all intelligence triples related to that entity or event are retrieved from the intelligence knowledge graph to form a set of multiple intelligence statements for the same entity or event to be detected. Iterate through each piece of intelligence in the intelligence statement set, and sequentially call the preset time contradiction judgment rule, numerical contradiction judgment rule, attribute contradiction judgment rule and relationship contradiction judgment rule to compare and analyze the time attribute, numerical attribute, category attribute and relationship type of each piece of intelligence to determine whether there is a conflict between them. During the comparison process, if a contradiction is detected, the type of contradiction, the identifier of the intelligence statement involved, and the strength score of the contradiction are recorded to obtain the contradiction detection result. Based on the contradiction detection results, a corresponding contradiction mark is added to each piece of intelligence containing contradictions, and the contradiction type and intensity score are attached to the intelligence as metadata, ultimately resulting in intelligence data with contradiction marks.

5. The method for contradiction detection and credibility fusion based on multi-source intelligence according to claim 4, characterized in that, For intelligence data marked with contradictions, an initial credibility score is calculated for each intelligence piece based on source authority and evidence support. Then, an iterative credibility propagation algorithm is used to fuse the credibility scores across multiple sources, resulting in a fused credibility score, including: Extract all intelligence entries and their relationships in the knowledge graph from the intelligence data marked with contradictions to obtain the intelligence set to be processed; For each piece of intelligence in the intelligence set to be processed, obtain the authority score of the corresponding intelligence source for each piece of intelligence, and obtain the source authority score for each piece of intelligence. For each piece of intelligence in the intelligence set to be processed, the number of independent pieces of evidence supporting each piece of intelligence is counted, and the counted number is normalized to obtain the normalized number of pieces of evidence for each piece of intelligence. Based on the source authority score and the amount of normalized evidence for each piece of intelligence, an initial credibility score is calculated for each piece of intelligence by weighted summation. Based on the semantic associations between intelligence entries in the intelligence knowledge graph, intelligence entries with initial credibility scores are used as nodes, semantic associations are used as edges, and weights are assigned to each edge according to the association type and strength to construct a credibility propagation network. Starting with the initial credibility score, an iterative algorithm is used to propagate and update the credibility of nodes in the credibility propagation network. In each iteration, the credibility update value of each node is calculated by combining the credibility of the node in the previous round with the credibility of all its neighboring nodes. Repeatedly iterate and update until the maximum change in credibility of all nodes is less than the preset convergence threshold, or until the preset maximum number of iterations is reached, then stop iterating to obtain the final credibility score of each intelligence fusion.

6. The method for contradiction detection and credibility fusion based on multi-source intelligence according to claim 5, characterized in that, The authority rating is either pre-set or dynamically updated based on the type of intelligence source, previous accuracy, and institutional credibility.

7. The method for contradiction detection and credibility fusion based on multi-source intelligence according to claim 6, characterized in that, Based on the fused credibility score and intelligence data marked with contradictions, contradictory information is automatically resolved or marked according to preset multi-level resolution rules to obtain integrated intelligence, including: For multiple intelligence statements marked as contradictory, a set of contradictory intelligence statements to be resolved is formed by combining the credibility score of the merged intelligence statements, the number of supporting sources, and the intelligence acquisition time. Following the priority order of majority consensus, timeliness, and authority, the conflicting intelligence sets are automatically resolved using the resolution rules in sequence to obtain preliminary resolution results. If there is intelligence that satisfies the majority consensus rule, it is used as the preliminary resolution result. If the majority consensus rule cannot be applied, the latest intelligence is selected as the preliminary resolution result using the timeliness priority rule. If it is still impossible to distinguish between them, the intelligence with the highest credibility score is used as the preliminary resolution result. If the above rules cannot obtain a preliminary resolution result, the rule resolution is deemed to have failed. Based on the preliminary resolution results, if the credibility of all contradictory intelligence is lower than the preset threshold, or cannot be resolved by the above rules, the relevant intelligence will be marked as questionable and submitted for manual review; otherwise, the preliminary resolution results will be adopted as the resolution decision; and the knowledge graph will be updated according to the resolution decision to generate integrated intelligence.

8. The method for contradiction detection and credibility fusion based on multi-source intelligence according to claim 7, characterized in that, By integrating intelligence and actual verification information as feedback, the structured processing parameters, contradiction judgment rule thresholds, and the weights of the credibility calculation and fusion model are dynamically optimized to form a closed-loop optimization mechanism, including: From the integrated intelligence and actual verification information, extract all intelligence resolution cases that have been manually reviewed or confirmed as correct and intelligence resolution cases that have been confirmed as incorrect, to obtain a positive sample case set and a negative sample case set. Based on the accuracy statistics of each intelligence source in providing information in the positive sample case set and the negative sample case set, the intelligence source authority score corresponding to each intelligence is dynamically updated to obtain the updated intelligence source authority score. Based on the case data in the positive sample case set and the negative sample case set, the thresholds of the four types of contradiction judgment rules are dynamically adjusted to obtain the optimized contradiction judgment rule thresholds. Based on the case data in the positive and negative sample case sets, the weight coefficients involved in the initial credibility calculation formula are retrained or fine-tuned to obtain the optimized initial credibility calculation weights. Based on the case data in the positive and negative sample case sets, the edge weights involved in the credibility propagation network are retrained or fine-tuned to obtain the optimized credibility propagation network edge weights. Based on the case data in the positive and negative sample case sets, incremental learning or periodic retraining is performed on the named entity recognition model and relation extraction model involved in the natural language processing pipeline to obtain optimized feature extraction model parameters. By applying intelligence source authority scores, contradiction judgment rule thresholds, initial credibility calculation weights, credibility propagation network edge weights, and feature extraction model parameters to a new round of multi-source intelligence processing, a closed-loop optimization mechanism from intelligence input to intelligence output is formed.

9. The method for contradiction detection and credibility fusion based on multi-source intelligence according to claim 8, characterized in that, The adjustments include the time difference threshold in time contradiction detection, the relative error threshold in numerical contradiction detection, the attribute semantic conflict table, and the relation opposition table.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a program that, when executed by a processor, implements the method as described in any one of claims 1 to 9.

Images