Network security evaluation report checking method and system based on AI semantic analysis

Abstract

The application provides a network security evaluation report checking method and system based on AI semantic analysis, which includes obtaining a to-be-checked report, analyzing and extracting structured data nodes of asset information, vulnerability description, risk level and repair suggestion; for the vulnerability description node, a semantic analysis model is used to extract a technical parameter set and generate a first semantic vector, an expected repair dependency graph is constructed based on this, and a model confidence is used to weight the reasoning path; a second semantic vector is generated for the repair suggestion node, the technical parameter set is used as a constraint to inversely deduce the technical influence range of the actual repair measure, the matching degree of the vector and the structure and parameters of the expected repair dependency graph is calculated, and a risk adjustment coefficient is generated; the risk benchmark score is calculated by combining the asset business importance weight and the vulnerability CVSS score, and the corrected risk score is corrected by the risk adjustment coefficient; based on the deviation degree of the corrected risk score and the risk level marked in the report, a checking conclusion is generated.

Description

Technical Field

[0001] This application belongs to the field of information security, and in particular relates to a method and system for verifying network security evaluation reports based on AI semantic analysis. Background Technology

[0002] In the field of cybersecurity, cybersecurity assessments ensure the secure and stable operation of information systems. In practice, the generation and verification of assessment reports rely on the manual analysis and experience of security engineers. Different engineers may interpret the risk level and remediation plan for the same vulnerability differently, leading to inconsistent report quality and risk assessment results that may deviate from reality. Furthermore, manual report verification is inefficient and prone to overlooking crucial logical inconsistencies due to oversight. Risk assessment models, such as general vulnerability scoring systems, while providing a standardized framework for measuring vulnerability severity, calculate static risk scores. These models typically use the business importance of assets as a simple weighting factor when calculating risk, but neglect the quality of the "remediation recommendations" provided in the report. A high-quality remediation recommendation can reduce actual risk; conversely, a vague, erroneous, or impractical remediation recommendation makes the vulnerability unmanageable in the short term, and the potential risk is not reduced or may even be underestimated. Existing technologies lack a mechanism to represent the logical consistency between the assessed remediation recommendations and the vulnerability description, and to revise the initial risk score based on the assessment results. This makes risk ratings unable to reflect the true security situation, thus affecting the scientific nature of security decisions. Summary of the Invention

[0003] This invention proposes a method for verifying cybersecurity assessment reports based on AI semantic analysis. This method addresses the problem that existing technologies neglect the quality of the "remediation suggestions" factor provided in the reports, and that risk ratings fail to reflect the true security situation. The method includes:

[0004] Obtain the network security assessment report to be verified, and parse the report to extract structured data nodes including asset information, vulnerability descriptions, risk levels, and remediation suggestions; For the vulnerability description node, a set of technical parameters of the node is extracted using a semantic analysis model and a first semantic vector is generated. Based on the set of technical parameters and the first semantic vector, an expected repair dependency graph is constructed by forward deduction, and the reasoning path in the graph is weighted using the confidence level output by the semantic analysis model. For the repair suggestion node, a second semantic vector is generated, and the technical impact range of an actual repair measure is derived in reverse using the technical parameter set as context constraints; the structure and parameter matching degree between the expected repair dependency graph and the technical impact range is calculated, and a risk adjustment coefficient is generated based on the matching degree, wherein the risk adjustment coefficient increases as the matching degree decreases; By combining the business importance weight of the asset information and the CVSS score corresponding to the vulnerability description, a risk baseline score is calculated, and the baseline score is corrected using the risk adjustment coefficient to obtain a corrected risk score. Based on the degree of deviation between the corrected risk score and the risk level marked in the report, a verification conclusion for the network security assessment report is generated.

[0005] Furthermore, this invention also relates to a network security assessment report verification system based on AI semantic analysis, comprising the following modules: The extraction module is used to obtain the network security assessment report to be verified, and parse the report to extract structured data nodes including asset information, vulnerability descriptions, risk levels, and remediation suggestions; The weighting module is used to extract the technical parameter set of the vulnerability description node using a semantic analysis model and generate a first semantic vector. Based on the technical parameter set and the first semantic vector, a expected repair dependency graph is constructed by forward deduction, and the reasoning path in the graph is weighted using the confidence level output by the semantic analysis model. The calculation module is used to generate a second semantic vector for the repair suggestion node, and use the technical parameter set as a context constraint to reverse deduce the technical impact range of an actual repair measure; calculate the structural and parameter matching degree between the expected repair dependency graph and the technical impact range, and generate a risk adjustment coefficient based on the matching degree, wherein the risk adjustment coefficient increases as the matching degree decreases; The generation module is used to calculate a risk baseline score by combining the business importance weight of the asset information and the CVSS score corresponding to the vulnerability description, and to correct the baseline score using the risk adjustment coefficient to obtain a corrected risk score; based on the degree of deviation between the corrected risk score and the risk level marked in the report, a verification conclusion for the network security assessment report is generated.

[0006] This invention utilizes an AI semantic analysis model to deeply analyze the logical relationship between vulnerability descriptions and remediation recommendations. By constructing a dependency graph of expected remediation through forward derivation and generating the technical impact scope of actual remediation measures through backward derivation, and by calculating the matching degree between the two, an objective assessment of the remediation recommendations is achieved. Based on the risk adjustment coefficient generated from this matching degree, the risk baseline score can be reasonably corrected, linking the quality of the remediation recommendations to the risk assessment results. This improves the reliability of report verification and provides a more comprehensive perspective and objective verification conclusions for measuring security risks. Attached Figure Description

[0007] Figure 1 A flowchart of the first embodiment; Figure 2This is a diagram illustrating report analysis and data extraction. Figure 3 This is a diagram illustrating the matching degree and risk adjustment coefficient. Figure 4 This is a schematic diagram of the corrected risk score calculation process. Detailed Implementation

[0008] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0009] The term "multiple" in this application refers to two or more. Furthermore, it should be understood that the terms "first," "second," etc., used in the description of this application are used only for descriptive purposes and should not be construed as indicating or implying relative importance, nor as indicating or implying order.

[0010] In the first embodiment, the present invention proposes a method for verifying network security assessment reports based on AI semantic analysis, such as... Figure 1 ,include: S1, obtain the network security assessment report to be verified, and parse the report to extract structured data nodes including asset information, vulnerability descriptions, risk levels, and remediation suggestions; The system receives user-uploaded assessment report files in PDF, DOCX, or XML formats via an interface. It then uses an optical character recognition (OCR) module to process scanned PDFs, converting them into editable text. A named entity recognition model, pre-trained on a large corpus of cybersecurity reports, is used to extract entities from the entire report. This model can identify and label asset information, such as IP address 192.168.1.10 and server name WebServer01; vulnerability descriptions, such as Apache Struts2 remote code execution vulnerability and CVE-2017-5638; risk levels, such as high, medium, and low text labels; and remediation suggestions, such as upgrading the Struts2 framework to version 2.3.32 or 2.5.10.1. The extracted entity information is organized into structured data nodes in JSON format, organized by vulnerability, such as... Figure 2 .

[0011] S2, for the vulnerability description node, use a semantic analysis model to extract the node's technical parameter set and generate a first semantic vector. Based on the technical parameter set and the first semantic vector, construct an expected repair dependency graph by forward deduction, and use the confidence level output by the semantic analysis model to weight the inference path in the graph. The extracted vulnerability description text, such as the Apache Struts2 remote code execution vulnerability CVE-2017-5638, is input into the semantic analysis model. The semantic analysis model preferably employs a BERT model with a multi-task learning architecture. The model uses a shared BERT encoder as the bottom layer, with the top layer concurrently accessing the Named Entity Recognition (NER) header and semantic mapping header. When the vulnerability description is input into the model, the shared encoder transforms the text into a high-dimensional context embedding vector. The NER header, composed of CRF or fully connected layers, uses the vector of each token in the sequence for annotation and decoding, identifying and outputting a set of technical parameters, such as entities: Windows, Port445. Simultaneously, the semantic mapping header directly extracts the [CLS] marker vector at the beginning of the sequence or an aggregated vector processed by a pooling layer, using it as the first semantic vector representing the overall vulnerability semantics.

[0012] In another embodiment, the model outputs two parts: first, a set of technical parameters, a collection of key-value pairs containing the component name ApacheStruts2, the vulnerability type remote code execution, and the vulnerability number CVE-2017-5638; second, a first semantic vector representing the core semantics of this description. Starting with the core component and vulnerability number in the technical parameter set, forward reasoning is performed within the built-in cybersecurity knowledge graph. For example, starting from the CVE-2017-5638 node, following the remediation relationship edges, two nodes can be found: official patch versions 2.3.32 and 2.5.10.1. The path from the vulnerability to the patch constitutes a simple expected remediation dependency graph. The model assigns a confidence score to each technical parameter when extracting it, such as a component name confidence score of 0.98. In one embodiment, this score is used as the weight of the corresponding reasoning path in the graph.

[0013] In an optional embodiment, the extraction of the node technical parameter set using a semantic analysis model includes: The vulnerability description node is input into a pre-trained language model based on the BERT architecture; The Named Entity Recognition (NER) layer of the model is used to identify and extract preset technical entity types from the text. The technical entity types include operating system version, application software name, port number, and protocol type. The extracted set of technical entities is used as the set of technical parameters.

[0014] Specifically, a vulnerability description text is taken as input. For example, consider an Apache Tomcat 9.0.30 server running on CentOS 7.6, whose AJP protocol exposed on port 8009 contains the Ghost Cat vulnerability CVE-2020-1938. After word segmentation, this text is fed into a BERT model based on a Transformer encoder structure. This model consists of multiple stacked bidirectional self-attention layers, capable of detecting deep contextual relationships within the text.

[0015] At the top layer of the BERT model is a classification layer specifically designed for named entity recognition. This layer is typically a linear layer followed by a Conditional Random Field (CRF) layer. The high-dimensional vector representation of each word in the BERT output is input to this classification layer. The CRF layer learns the transition probabilities between labels, thereby optimizing the label prediction results for the entire sequence. The model predicts a label for each word in the input text; for example, it labels CentOS 7.6 as the operating system version, Apache Tomcat 9.0.30 as the application name, 8009 as the port number, and AJP as the protocol type. All identified entities and types are integrated into a structured set of technical parameters, such as {Operating System Version: CentOS 7.6, Application Name: Apache Tomcat 9.0.30, Port Number: 8009, Protocol Type: AJP}.

[0016] In an optional embodiment, the forward derivation constructs a desired repair dependency graph, including: Each parameter in the set of technical parameters is used as the initial node of the graph; The system queries a pre-built vulnerability knowledge base to retrieve vulnerability patching items, configuration modifications, and software upgrade packages related to the initial node, and uses the retrieval results as intermediate and target nodes in the graph. Based on the dependencies defined in the knowledge base, construct a directed edge from the initial node to the target node; The confidence level output by the semantic analysis model when identifying the initial node is used as the initial basis for calculating the path weight.

[0017] For example, the parameters Apache Tomcat 9.0.30 and CentOS 7.6 extracted in the previous step are used as the initial nodes of the graph. A query is initiated to a pre-built vulnerability knowledge base stored in the form of a graph database. The knowledge base contains software versions, vulnerabilities, patches, configuration items, and their dependencies and fixes.

[0018] For Apache Tomcat 9.0.30 nodes, queries will retrieve relevant remediation paths, such as an intermediate node upgraded to version 9.0.31, which then connects to a target node where vulnerability CVE-2020-1938 has been patched. Meanwhile, for CentOS 7.6 nodes, queries may find another remediation path: an intermediate node disabling the AJP protocol, which also connects to a target node where the vulnerability has been patched. Based on the pre-defined remediations and dependencies in the knowledge base, directed edges are created from the initial node to intermediate nodes and then to the target node. When the NER model extracts the initial node, the output confidence score is used. Specifically, in the output stage of the NER model, a classifier consisting of a fully connected layer and a Softmax function generates a probability distribution for each token in the input sequence about all possible labels. When the decoding algorithm determines that a continuous sequence of tokens constitutes a complete technical entity, i.e., the initial node, it extracts the maximum probability that each token in the sequence is predicted as the current label, and calculates the arithmetic mean or geometric mean of these probability values. This yields a value representing the entity recognition accuracy, which is used as the confidence score of the initial node to measure the reliability of the extracted information and as the initial basis for subsequent knowledge graph inference path weights. For example, the confidence score of Apache Tomcat 9.0.30 is 0.95, used as the initial value for calculating graph path weights, representing the degree of certainty of the starting point of the repair path. Optionally, the confidence score can be output using a classification head in the semantic analysis model.

[0019] S3, For the repair suggestion node, generate a second semantic vector, and use the technical parameter set as context constraints to reverse deduce and generate a technical impact range of an actual repair measure; calculate the structural and parameter matching degree between the expected repair dependency graph and the technical impact range, and generate a risk adjustment coefficient based on the matching degree, wherein the risk adjustment coefficient increases as the matching degree decreases; The remediation suggestion text extracted from the report, such as upgrading the Struts2 framework to the latest version, is input into the same semantic analysis model to generate a second semantic vector representing the core operation of the suggestion. Simultaneously, the model parses out key operations in the suggestion, such as action upgrade and the target component, the Struts2 framework. Using the aforementioned set of technical parameters as background knowledge as constraints, reverse reasoning is performed in the knowledge graph. Starting from the operation node described in the Struts2 framework upgrade, the model reverse-engineers which vulnerabilities this operation can resolve. Contextual constraints include: if the asset information shows the operating system as Windows, then the suggestion to update using the yum command will be considered an invalid path. Reverse reasoning yields one or more vulnerability nodes, which constitute the technical impact scope that the remediation suggestion can cover.

[0020] Further structural matching is performed by comparing the target node set of the expected remediation dependency graph (i.e., the correct patch version) with the source node of the actual remediation measures' technical impact scope (i.e., the vulnerability that the report recommends to fix). For example, if the expected remediation target is CVE-2017-5638, and the remediable vulnerability derived from the remediation recommendations is also CVE-2017-5638, then the structural matching degree is high. Parameter matching is then performed by calculating the cosine similarity between the first and second semantic vectors to represent the semantic correlation between the vulnerability description and the remediation recommendations. The structural matching score and the parameter matching score are weighted and summed to obtain a matching degree M between 0 and 1. The formula for calculating the risk adjustment coefficient K is, for example, as follows. When the matching degree M is 1, K is 1, and the risk is not adjusted; when the matching degree M is 0, K is 2, and the risk is doubled, thus achieving the goal of increasing the risk adjustment coefficient as the matching degree decreases. Figure 3 .

[0021] In an optional embodiment, the reverse derivation generates a technical impact scope of an actual remedial measure, including: Perform syntactic analysis on the text of the repair suggestion node to extract the verb-object structure; The extracted verbs are mapped to a predefined repair operation library, which contains four standard operations: "install", "update", "disable", and "configure". The object is mapped to a specific technical component. Based on the context constraints of the technical parameter set, the relationships between technical components are queried. The direct and indirect effects of each standard operation on the associated technical components are determined, forming a set of nodes and edges representing the scope of the technical influence.

[0022] Specifically, the analysis of the remediation recommendations in the evaluation report, such as suggesting updating the Apache Tomcat component to version 9.0.31 or higher, employs a deep learning-based dependency parsing model to parse the sentence and identify the core verb-object pair, namely, updating the Apache Tomcat component.

[0023] The Apache Tomcat component is identified as the technology component to be operated on. This information is used to query the Configuration Management Database (CMDB) or asset inventory to determine the potential impact of the operation. The query is combined with context, such as which server the component runs on. Database returns show that the Apache Tomcat instance hosts three web applications: a customer relationship management system, an online ordering system, and an internal forum. Therefore, the update operation will affect these three systems. Based on this, a technology impact scope graph is constructed, containing a central node updating Apache Tomcat, with three directed edges pointing to nodes representing the three web applications. The edge attributes can be labeled as impacting business continuity.

[0024] To represent the similarity of the two graphs in three dimensions, in an optional embodiment, calculating the structural and parameter matching degree between the expected repair dependency graph and the technology impact range includes: Calculate the cosine similarity between the first semantic vector and the second semantic vector to obtain the semantic matching score. ; The Jaccard similarity coefficient is used to calculate the overlap of node sets in two graphs, thus obtaining the node matching score. ; Traverse all paths in the expected repair dependency graph, check if any nodes and edges on the paths are within the scope of the technical impact, and calculate the ratio of the number of matching paths to the total number of paths to obtain the structural matching score. ; The matching degree M is calculated using a weighted summation formula: , .

[0025] To calculate the semantic matching score, a sentence embedding model such as Sentence-BERT is used to encode the text descriptions of all nodes in the dependency graph to be repaired and average them into a single vector. Similarly, the node text of the technology impact map is encoded into vectors. The cosine similarity of the two vectors is calculated to obtain... For example, if This represents fixing the Tomcat vulnerability. This indicates that updating Tomcat affects business applications, and the similarity may be 0.8.

[0026] To calculate the node matching score, the node sets of the two graphs are extracted. After normalization, for example, upgrading to version 9.0.31 and updating Apache Tomcat are considered equivalent, the Jaccard similarity coefficient of the two node sets is calculated. If the expected graph node set is {A,B,C} and the affected graph node set is {A,D,E}, then... To calculate the structure matching score, check if paths in the expected remediation graph, such as from Apache Tomcat 9.0.30 to the point where the vulnerability has been patched, exist in the impact scope graph. If the impact scope graph only shows the operations and affected assets, but does not include the remediation results, the matching path is 0. It is 0. If , , The scores are 0.3, 0.3, and 0.4 respectively, and the total matching degree M is calculated as 0.3.

[0027] To transform the matching score, which measures the logical consistency of the report, into a coefficient that influences risk assessment, in an optional embodiment, generating a risk adjustment coefficient based on the matching score includes: The risk adjustment factor C is calculated using the formula: C = 1 + (1 - M)K, where M is the matching degree and K is the benchmark amplification factor.

[0028] A constant parameter, the baseline amplification factor K, is preset, preferably 2.0. This value is determined based on expert experience and historical data analysis, and defines the amplification penalty for the original risk score in the worst case, i.e., when the matching degree is zero.

[0029] Using the calculated matching degree M, for example, M=0.3, substitute it into the given formula to calculate the risk adjustment factor C. The calculation is: C=2.4. Because there is a significant difference between the detected expected remediation logic and the actual remediation measures, the original risk score needs to be amplified by 2.4 times. If the matching degree M is 1, indicating a perfect match, then C will equal 1, and no adjustment will be made to the risk score.

[0030] S4. Combining the business importance weight of the asset information and the CVSS score corresponding to the vulnerability description, calculate the risk baseline score, and correct the baseline score using the risk adjustment coefficient to obtain the corrected risk score; based on the degree of deviation between the corrected risk score and the risk level marked in the report, generate a verification conclusion for the network security assessment report.

[0031] The business importance weight W of the current asset is obtained from the asset information management database; for example, 5 for core business systems and 3 for general systems. Simultaneously, the CVSS score S is extracted from the vulnerability description node; for example, the base CVSS score for CVE-2017-5638 is 10.0. The risk baseline score B is calculated using the formula B = W × S, for example, B = 50. The risk adjustment coefficient K calculated above is used to correct the baseline score, resulting in the corrected risk score R, calculated using the formula R = B × K. If the calculated matching degree M is 0.5, then K = 1.25, and the corrected risk score R = 62.5. Figure 4 .

[0032] Define a mapping rule between risk scores and risk levels. For example, 0 to 39 is low risk, 40 to 69 is medium risk, and 70 to 100 is high risk. Based on this rule, the calculated corrected risk score R, such as 62.5, is mapped to medium risk. The calculated risk level is compared with the risk level (e.g., high risk) marked in the report for that vulnerability. If they match, the verification conclusion is "verification passed," indicating an accurate risk assessment. If the calculated level is higher than the reported level (e.g., high risk calculated but medium risk reported), the verification conclusion is "verification failed," suggesting the report may have underestimated the actual risk due to poor remediation recommendations. The verification conclusion will indicate the vulnerability entries with logical discrepancies and their reasons.

[0033] In an optional embodiment, the calculation of the risk baseline score and the correction of the baseline score using the risk adjustment coefficient to obtain the corrected risk score includes: The business importance weight of the asset information is mapped to a value from 1 to 5, where 5 represents the highest importance; Calculate the risk benchmark score using the formula. : ; The corrected risk score is calculated using the formula. : , where C is the risk adjustment coefficient.

[0034] Obtain the CVSS score, a common vulnerability scoring system, for example, the Ghost Cat vulnerability has a CVSS score of 9.8. Simultaneously, obtain the business importance level of the affected servers from the asset information database and map it to a numerical value from 1 to 5. Assume the server carries core business operations, with an importance weight of 5. Substitute these values ​​into the formula to calculate the risk baseline score: The baseline score is corrected using the risk adjustment factor C=2.4 calculated above to reflect logical consistency issues in the report. The corrected risk score is calculated as follows: Since the calculated result exceeded the upper limit of 100 for risk score, the corrected risk score was set at 100. The results indicate that although the baseline score was already high, logical flaws in the report resulted in the issue being assessed as having the highest risk level.

[0035] In an optional embodiment, generating a verification conclusion for the cybersecurity assessment report based on the degree of deviation between the corrected risk score and the risk level marked in the report includes: The “high”, “medium” and “low” risk levels marked in the report are mapped to numerical ranges, with high risk corresponding to [70, 100], medium risk corresponding to [40, 69], and low risk corresponding to [0, 39]. When the corrected risk score If the risk level falls within the range indicated in the report, the conclusion is "verification passed"; when If the risk level falls within an adjacent interval to the interval marked in the report, the conclusion is "There is a deviation, and a review is recommended"; when If the risk level range indicated in the report crosses one or more ranges, the conclusion is "verification failed, a major logical error exists".

[0036] An internal mapping rule is defined, assigning high-risk, medium-risk, and low-risk levels to specific numerical ranges: high risk is 70 points or above, medium risk is 40 to 69 points, and low risk is 39 points or below. Assume the original assessment report labels this Ghost Cat vulnerability as medium risk. According to the mapping rule, the score range for medium risk is 40 to 69. The corrected risk score calculated after the entire analysis process... The score is 100. This score of 100 falls within the high-risk range of 70 to 100. The calculated high-risk level is compared with the medium-risk level marked in the report. Because there are no other levels between high-risk and medium-risk, they are adjacent. Therefore, according to the judgment rule, when the calculated result falls within the adjacent range of the level marked in the report, the output verification conclusion is that there is a deviation, and a review is recommended. If the report is marked as low-risk, then the calculated high-risk result is separated from the low-risk result by one level, as described in the medium-risk category, and the conclusion will be that the verification fails and there is a major logical error. In another optional embodiment, if the matching degree is lower than a preset threshold, regardless of whether the score range matches, an abnormal warning of 'repair suggestion mismatch' or a downgrade conclusion is generated.

[0037] In the second embodiment, the present invention also proposes a network security assessment report verification system based on AI semantic analysis, comprising the following modules: The extraction module is used to obtain the network security assessment report to be verified, and parse the report to extract structured data nodes including asset information, vulnerability descriptions, risk levels, and remediation suggestions; The weighting module is used to extract the technical parameter set of the vulnerability description node using a semantic analysis model and generate a first semantic vector. Based on the technical parameter set and the first semantic vector, a expected repair dependency graph is constructed by forward deduction, and the reasoning path in the graph is weighted using the confidence level output by the semantic analysis model. The calculation module is used to generate a second semantic vector for the repair suggestion node, and use the technical parameter set as a context constraint to reverse deduce the technical impact range of an actual repair measure; calculate the structural and parameter matching degree between the expected repair dependency graph and the technical impact range, and generate a risk adjustment coefficient based on the matching degree, wherein the risk adjustment coefficient increases as the matching degree decreases; The generation module is used to calculate a risk baseline score by combining the business importance weight of the asset information and the CVSS score corresponding to the vulnerability description, and to correct the baseline score using the risk adjustment coefficient to obtain a corrected risk score; based on the degree of deviation between the corrected risk score and the risk level marked in the report, a verification conclusion for the network security assessment report is generated.

[0038] In an optional embodiment, the extraction of the node technical parameter set using a semantic analysis model includes: The vulnerability description node is input into a pre-trained language model based on the BERT architecture; The Named Entity Recognition (NER) layer of the model is used to identify and extract preset technical entity types from the text. The technical entity types include operating system version, application software name, port number, and protocol type. The extracted set of technical entities is used as the set of technical parameters.

[0039] In an optional embodiment, the forward derivation constructs a desired repair dependency graph, including: Each parameter in the set of technical parameters is used as the initial node of the graph; The system queries a pre-built vulnerability knowledge base to retrieve vulnerability patching items, configuration modifications, and software upgrade packages related to the initial node, and uses the retrieval results as intermediate and target nodes in the graph. Based on the dependencies defined in the knowledge base, construct a directed edge from the initial node to the target node; The confidence level output by the semantic analysis model when identifying the initial node is used as the initial basis for calculating the path weight.

[0040] In an optional embodiment, the reverse derivation generates a technical impact scope of an actual remedial measure, including: Perform syntactic analysis on the text of the repair suggestion node to extract the verb-object structure; The extracted verbs are mapped to a predefined repair operation library, which contains four standard operations: "install", "update", "disable", and "configure". The object is mapped to a specific technical component. Based on the context constraints of the technical parameter set, the relationships between technical components are queried. The direct and indirect effects of each standard operation on the associated technical components are determined, forming a set of nodes and edges representing the scope of the technical influence.

[0041] In an optional embodiment, calculating the structural and parameter matching degree between the expected repair dependency graph and the technology impact range includes: Calculate the cosine similarity between the first semantic vector and the second semantic vector to obtain the semantic matching score. ; The Jaccard similarity coefficient is used to calculate the overlap of node sets in two graphs, thus obtaining the node matching score. ; Traverse all paths in the expected repair dependency graph, check if any nodes and edges on the paths are within the scope of the technical impact, and calculate the ratio of the number of matching paths to the total number of paths to obtain the structural matching score. ; The matching degree M is calculated using a weighted summation formula: .

[0042] In an optional embodiment, generating a risk adjustment coefficient based on the matching degree includes: The risk adjustment factor C is calculated using the formula: C = 1 + (1 - M)K, where M is the matching degree and K is the benchmark amplification factor.

[0043] In an optional embodiment, the calculation of the risk baseline score and the correction of the baseline score using the risk adjustment coefficient to obtain the corrected risk score includes: The business importance weight of the asset information is mapped to a value from 1 to 5, where 5 represents the highest importance; Calculate the risk benchmark score using the formula. : ; The corrected risk score is calculated using the formula. : , where C is the risk adjustment coefficient.

[0044] In an optional embodiment, generating a verification conclusion for the cybersecurity assessment report based on the degree of deviation between the corrected risk score and the risk level marked in the report includes: The “high”, “medium” and “low” risk levels marked in the report are mapped to numerical ranges, with high risk corresponding to [70, 100], medium risk corresponding to [40, 69], and low risk corresponding to [0, 39]. When the corrected risk score If the risk level falls within the range indicated in the report, the conclusion is "verification passed"; when If the risk level falls within an adjacent interval to the interval marked in the report, the conclusion is "There is a deviation, and a review is recommended"; when If the risk level range indicated in the report crosses one or more ranges, the conclusion is "verification failed, a major logical error exists".

[0045] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments in this specification are not limited to the described order of actions, because according to the embodiments in this specification, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to the embodiments in this specification.

[0046] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0047] The preferred embodiments disclosed above are merely illustrative of this specification. The optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the embodiments described herein. These embodiments are selected and specifically described in this specification to better explain the principles and practical applications of the embodiments, thereby enabling those skilled in the art to better understand and utilize this specification. This specification is limited only by the claims and their full scope and equivalents.

Claims

1. A method for verifying cybersecurity assessment reports based on AI semantic analysis, characterized in that, Includes the following steps: Obtain the network security assessment report to be verified, and parse the report to extract structured data nodes including asset information, vulnerability descriptions, risk levels, and remediation suggestions; For the vulnerability description node, a set of technical parameters of the node is extracted using a semantic analysis model and a first semantic vector is generated. Based on the set of technical parameters and the first semantic vector, an expected repair dependency graph is constructed by forward deduction, and the reasoning path in the graph is weighted using the confidence level output by the semantic analysis model. For the repair suggestion node, a second semantic vector is generated, and the technical impact range of an actual repair measure is derived in reverse using the technical parameter set as context constraints; the structure and parameter matching degree between the expected repair dependency graph and the technical impact range is calculated, and a risk adjustment coefficient is generated based on the matching degree, wherein the risk adjustment coefficient increases as the matching degree decreases; By combining the business importance weight of the asset information and the CVSS score corresponding to the vulnerability description, a risk baseline score is calculated, and the baseline score is corrected using the risk adjustment coefficient to obtain a corrected risk score. Based on the degree of deviation between the corrected risk score and the risk level marked in the report, a verification conclusion for the network security assessment report is generated.

2. The method according to claim 1, characterized in that, The extraction of the node technical parameter set using a semantic analysis model includes: The vulnerability description node is input into a pre-trained language model based on the BERT architecture; The Named Entity Recognition (NER) layer of the model is used to identify and extract preset technical entity types from the text. The technical entity types include operating system version, application software name, port number, and protocol type. The extracted set of technical entities is used as the set of technical parameters.

3. The method according to claim 1, characterized in that, The forward derivation constructs an expected repair dependency graph, including: Each parameter in the set of technical parameters is used as the initial node of the graph; The system queries a pre-built vulnerability knowledge base to retrieve vulnerability patching items, configuration modifications, and software upgrade packages related to the initial node, and uses the retrieval results as intermediate and target nodes in the graph. Based on the dependencies defined in the knowledge base, construct a directed edge from the initial node to the target node; The confidence level output by the semantic analysis model when identifying the initial node is used as the initial basis for calculating the path weight.

4. The method according to claim 1, characterized in that, The reverse derivation generates the technical impact scope of an actual remedial measure, including: Perform syntactic analysis on the text of the repair suggestion node to extract the verb-object structure; The extracted verbs are mapped to a predefined repair operation library, which contains four standard operations: "install", "update", "disable", and "configure". The object is mapped to a specific technical component. Based on the context constraints of the technical parameter set, the relationships between technical components are queried. The direct and indirect effects of each standard operation on the associated technical components are determined, forming a set of nodes and edges representing the scope of the technical influence.

5. The method according to claim 1, characterized in that, The calculation of the structural and parameter matching degree between the expected repair dependency graph and the technology impact range includes: Calculate the cosine similarity between the first semantic vector and the second semantic vector to obtain the semantic matching score. ; The Jaccard similarity coefficient is used to calculate the overlap of node sets in two graphs, thus obtaining the node matching score. ; Traverse all paths in the expected repair dependency graph, check if any nodes and edges on the paths are within the scope of the technical impact, and calculate the ratio of the number of matching paths to the total number of paths to obtain the structural matching score. ; The matching degree M is calculated using a weighted summation formula.

6. The method according to claim 5, characterized in that, The generation of a risk adjustment coefficient based on the matching degree includes: The risk adjustment factor C is calculated using the formula: C = 1 + (1 - M)K, where M is the matching degree and K is the benchmark amplification factor.

7. The method according to claim 1, characterized in that, The calculation of the risk baseline score, and the correction of the baseline score using the risk adjustment coefficient to obtain the corrected risk score, includes: The business importance weight of the asset information is mapped to a value from 1 to 5, where 5 represents the highest importance; Calculate the risk benchmark score using the formula. : ; The corrected risk score is calculated using the formula. : , where C is the risk adjustment coefficient.

8. The method according to claim 1 or 7, characterized in that, The step of generating a verification conclusion for the cybersecurity assessment report based on the degree of deviation between the corrected risk score and the risk level marked in the report includes: The "high", "medium" and "low" risk levels marked in the report are mapped to numerical ranges, with high risk corresponding to [70, 100], medium risk corresponding to [40, 69], and low risk corresponding to [0, 39]. When the corrected risk score If the result falls within the range corresponding to the risk level indicated in the report, the conclusion is "verification passed"; when If the risk level falls within an adjacent interval to the interval marked in the report, the conclusion is "There is a deviation, and a review is recommended"; when If the risk level range indicated in the report crosses one or more ranges, the conclusion is "Verification failed, a major logical error exists".

9. A network security assessment report verification system based on AI semantic analysis, characterized in that, Includes the following modules: The extraction module is used to obtain the network security assessment report to be verified, and parse the report to extract structured data nodes including asset information, vulnerability descriptions, risk levels, and remediation suggestions; The weighting module is used to extract the technical parameter set of the vulnerability description node using a semantic analysis model and generate a first semantic vector. Based on the technical parameter set and the first semantic vector, a expected repair dependency graph is constructed by forward deduction, and the reasoning path in the graph is weighted using the confidence level output by the semantic analysis model. The calculation module is used to generate a second semantic vector for the repair suggestion node, and use the technical parameter set as a context constraint to reverse deduce the technical impact range of an actual repair measure; calculate the structural and parameter matching degree between the expected repair dependency graph and the technical impact range, and generate a risk adjustment coefficient based on the matching degree, wherein the risk adjustment coefficient increases as the matching degree decreases; The generation module is used to calculate a risk baseline score by combining the business importance weight of the asset information and the CVSS score corresponding to the vulnerability description, and to correct the baseline score using the risk adjustment coefficient to obtain a corrected risk score; based on the degree of deviation between the corrected risk score and the risk level marked in the report, a verification conclusion for the network security assessment report is generated.

10. The system according to claim 9, characterized in that, The extraction of the node technical parameter set using a semantic analysis model includes: The vulnerability description node is input into a pre-trained language model based on the BERT architecture; The Named Entity Recognition (NER) layer of the model is used to identify and extract preset technical entity types from the text. The technical entity types include operating system version, application software name, port number, and protocol type. The extracted set of technical entities is used as the set of technical parameters.

Images