A Method and System for Semantic Compliance Review and Risk Origin Tracing of Network Configuration Changes Based on Large Model

Abstract

This invention discloses a method and system for semantic compliance review and risk tracing of network configuration changes based on a large-scale model. By constructing a policy compliance knowledge graph of the communication bearer network, business intent, policy rules, and compliance constraints are structurally represented. Natural language service change requests are received and parsed into structured business intent using a large-scale language model. Based on retrieval-enhanced generation technology, a policy context subgraph is retrieved from the knowledge graph and input into the large-scale language model for logical compliance reasoning, yielding compliance judgment results and policy rules. This results in the construction of a decision tracing evidence chain containing the original request, parsed intent, reasoning basis, and violation rules. Pre-decision decisions are executed based on the judgment results; if violations are found, the process is blocked and the evidence chain is output. This invention elevates configuration change review from network performance verification to the semantic compliance understanding level, enabling proactive risk prevention and white-box decision-making, significantly improving the security and auditability of communication network operation and maintenance.

Description

Technical Field

[0001] This invention belongs to the field of communication network operation and maintenance management technology, and in particular relates to a method and system for semantic compliance review and risk tracing of network configuration changes based on a large model. Background Technology

[0002] With the rapid development of cloud computing, 5G, computing power networks, and next-generation digital infrastructure, communication bearer networks, including IP backbone networks, transmission networks, data center networks, and computing power scheduling networks, are growing in scale and becoming increasingly complex in topology and strategies. They have become the core support for the development of the national digital economy and the stable operation of key industries. To adapt to business needs, optimize computing power scheduling, repair faults, or ensure security, networks require frequent configuration changes. These changes typically involve complex addition, deletion, and modification operations on numerous network elements such as routers, switches, firewalls, and computing power scheduling nodes using command-line CLIs or scripts. Their correctness and compliance directly affect the stability, data security, and network service quality of the nation's critical information infrastructure, and are also crucial to the business continuity and regulatory compliance requirements of key industries such as finance, government, and energy. Currently, the industry primarily relies on the following technical paths to ensure the security and compliance of network configuration changes: 1. Verification technology based on digital twins and simulation: This is the current mainstream solution. It constructs a digital twin consistent with the physical network in a virtual environment, and simulates the proposed configuration change within the twin to assess the impact of the change on network traffic, latency, reliability, and other performance indicators. This technology can effectively detect "misconfigurations" that may cause network congestion or outages. However, its review dimension focuses on network layer connectivity and performance, achieving only result-level verification. It cannot reach the compliance judgment of business intent and policy semantics, making it difficult to meet the high-level requirements of current regulatory and security levels.

[0003] 2. Automated checks based on static rule bases: By predefining a series of compliance rules such as password complexity and ACL entry format, automated scanning and comparison are performed before configuration is issued. This method is more efficient than purely manual checks, but its rules are often at the grammatical level or simple pattern matching, and cannot understand the business intent and high-level policy semantics behind the configuration commands. For example, it can check whether the syntax of a BGP route configuration is correct, but it cannot determine whether the release of the route policy violates the interconnection protocol with partners or the company's internal security red lines, and it cannot adapt to regulatory compliance requirements such as cross-border financial data and security of critical information systems.

[0004] 3. Change process management and post-event audit: The change process is solidified through the work order system, and auditing is conducted by comparing the configuration backup after the change. This method focuses on process control and post-event traceability, but lacks the ability to intercept substantive compliance in advance and intelligently. When the audit finds violations, the network may already be in an insecure state, critical data may be at risk of leakage, or business losses may have already occurred. It cannot achieve the prevention and control of risks in advance and does not meet the core requirements of the current security protection of critical information infrastructure.

[0005] In summary, existing technical systems share a common core deficiency: they primarily focus on the syntactic correctness and network impact of configuration changes, but severely lack a deep understanding of the "semantic compliance" of changes and the ability to conduct prior review. This makes them ill-suited to the rigid demands of digital transformation in key national industries and the security of critical information infrastructure. Specifically, this manifests in the following ways: 1. Inability to understand higher-level business intentions and strategies: The inability to translate the natural language intent of "opening a high-priority MPLS leased line for cross-border financial business" into a specific set of configuration commands, and to simultaneously determine whether the operation meets the semantic constraints of regulatory compliance requirements of the financial industry and cross-border data transmission standards, is out of step with the current compliance control needs in the fields of big data and computing power networks.

[0006] Second, the inability to leverage network-specific knowledge for risk assessment: The review process is disconnected from the rich operational knowledge unique to communication bearer networks, such as historical failure cases, known defects in equipment versions, important customer SLA terms, and best practices for routing security. This results in a lack of depth and specificity in risk warnings, making it impossible to achieve precise and intelligent risk prevention and control.

[0007] Third, the ability to trace the source remains at the state level: Existing log and audit systems can only record "who executed which command on which device at what time" and "differences in configuration files before and after the change," but cannot trace which business requirement the change command originated from, or which specific compliance policy was based on or violated during the generation and review process. The decision-making chain is not transparent, making it difficult to achieve true accountability and root cause analysis, which does not meet the industry requirements of controllable and traceable key core technologies.

[0008] Therefore, a method and system for semantic compliance review and risk tracing of network configuration changes based on a large model is needed to solve the above problems. Summary of the Invention

[0009] The technical problem to be solved by this invention is to provide a method and system for semantic compliance review and risk tracing of network configuration changes based on a large model. By constructing a knowledge graph of policy compliance of the communication bearer network as the domain knowledge base, and by deeply coupling the retrieval-enhanced generation RAG framework with the large-scale language model LLM, accurate reasoning under knowledge constraints is achieved. The risk control point is fundamentally moved forward from the traditional post-configuration verification to the stage of understanding business intent, and the decision-making process is made white-boxed by outputting a structured traceability evidence chain.

[0010] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows: A method for semantic compliance review and risk attribution of network configuration changes based on a large model includes the following steps: S1, Construction and maintenance of domain knowledge infrastructure: Collect multi-source heterogeneous communication bearer network domain data, and construct a policy compliance knowledge graph based on the domain data; the policy compliance knowledge graph represents the business intent, policy rules and compliance constraints that network configuration changes should follow in the form of a graph structure; S2, Intelligent Analysis and Review of Business Intent: The system receives business change requests described in natural language, performs semantic parsing of the requests using a large language model to obtain structured business intents, retrieves policy context subgraphs related to the semantics of the structured business intents from the policy compliance knowledge graph based on retrieval enhancement generation technology, and inputs the structured business intents and policy context subgraphs into the large language model for logical compliance reasoning to obtain compliance judgment results and the specific policy rules triggered. S3, Traceable Structured Result Generation and Pre-Decision Execution: Based on structured business intent, policy context subgraphs, and specific policy rules that trigger the decision, a verifiable chain of evidence for decision tracing is constructed. Based on the compliance determination results, a pre-decision is executed. If the decision is deemed non-compliant, the change process is blocked and the chain of evidence for decision tracing is output.

[0011] Preferably, in step S1, the construction and maintenance of the domain knowledge infrastructure includes the collection and preprocessing of multi-source heterogeneous domain data, specifically including: During data collection, the system collects raw data from the following sources: Unstructured documents: International / industry technical standards, such as IETF RFC, ITU-T recommendations, operator service level agreement (SLA) contract texts, cybersecurity regulations and internal security red line documents; Semi-structured data: network device configuration templates, routing policy files, access control list (ACL) rule bases, and historical change order records; Structured data: Configuration management database (CMDB), network topology information, and service catalog; Data preprocessing includes format parsing, text extraction, and semantic paragraph segmentation of unstructured documents, and the creation of a text corpus with associated metadata, such as document source, chapter, and effective date.

[0012] Preferably, in step S1, the construction and maintenance of the domain knowledge infrastructure includes joint extraction of entities and relations based on domain-fine-tuned LLM, specifically including: Model fine-tuning: LoRA, a parameter-efficient fine-tuning technique, is used to adapt the basic LLM to the domain using manually annotated communication bearer network strategy corpus; the annotated corpus consists of triples in the form of [entity, relation, entity]; for example, [financial customer, restricted by, must be encrypted]. Knowledge extraction: The preprocessed text corpus is input into a fine-tuned domain LLM, and a joint task of sequence labeling and relation classification is performed to extract a set of triples representing policy constraints in batches. .

[0013] Preferably, in step S1, the construction and maintenance of the domain knowledge infrastructure includes the construction, storage, and vectorization of the policy compliance knowledge graph, specifically including: Graph pattern definition and storage: Define the graph pattern: Vertex types include, but are not limited to, policy subjects, constraints, operation objects, and legal clauses; edge type definitions include, but are not limited to, prohibited, mandatory, dependent, and conflict semantic relationships. The triplet data is persistently stored in a graph database to form an attribute graph. , where A is the set of attributes that record metadata such as the original text and confidence level; Graph Vectorization Embedding: Utilizing graph embedding algorithms, preferably TransE or GraphSAGE, vertices and edges in the graph are mapped into low-dimensional dense vectors, i.e., the embedding function is learned. The resulting vectors are stored in a vector database, forming a domain knowledge vector library that supports efficient semantic retrieval.

[0014] Preferably, in step S2, the intelligent parsing and review of business intent includes the parsing and standardization of natural language business intent, specifically including: Input: Receive the natural language change request text submitted by the user. For example: "Open a 100M high-priority MPLS leased line to the data center for cross-border financial business"; Semantic parsing: LLM parsing functions fine-tuned by domain ,right Perform semantic understanding and output standardized business intent description objects. , It includes the following structured parts: Intent type: Identify and summarize the core operational purpose of the request, such as "activate a high-priority dedicated line"; Entity set: A list of key objects extracted from the request text, such as ["Cross-border financial business", "Data center", "MPLS leased line"]; Relationship set: The main semantic relationships between the identified entities, such as ["serving"]. Business parameters: Detailed business and technical indicators encapsulated in key-value pairs, such as {"bandwidth":"100M", "service level":"financial"}; Furthermore, this standardized object provides clear and structured input for subsequent compliance reviews.

[0015] Intent vectorization: using an encoder to... Convert to query vector .

[0016] Preferably, in step S2, the intelligent parsing and review of business intent includes knowledge retrieval-enhanced context acquisition, specifically including: Semantic retrieval: based on query vectors Perform an approximate nearest neighbor search in the domain knowledge vector library to recall the policy vertices and edges that are most relevant to the current intent semantics; Subgraph construction: Based on the recalled vertices and edges, in the graph database Perform a one- or two-hop extended query to obtain a strategy context subgraph rich in logical constraints. , It contains all the possible criteria for evaluation. The relevant rules and relationships regarding compliance.

[0017] Preferably, in step S2, the intelligent parsing and review of business intent includes logical compliance reasoning and judgment based on enhanced context, specifically including: Hint Project: Subgraph The triples and their associated original text attributes in the LLM prompt word template are injected in a structured format to form the knowledge-enhanced prompt context Prompt_context; Thought chain reasoning: Together with Prompt_context, it takes LLM as input and instructions as input, acting as a compliance expert. It performs chain-of-thought reasoning based on given exact rules and outputs natural language analysis containing the final conclusion and reasoning basis. Formal determination: The system parses the LLM output, extracts the compliance status, and bases it on... The logical relationships in the code are formally verified, ultimately generating a deterministic judgment result tuple (Judgement, V_triggered); V_triggered is... The specific policy rule vertex sequence that causes Judgement to output compliance or violation is given. When Judgement is violation, V_triggered is not empty.

[0018] Preferably, in step S3, the generation of traceable structured results and the execution of pre-decision decisions include the generation and structured output of verifiable traceable evidence chains, specifically including: Evidence Chain Construction: The system automatically generates a decision tracing evidence chain Trace. An evidence chain Trace is a structured data object formed by encapsulating the following key information: Request Unique Identifier: A unique identifier assigned by the system to the current review request; Original request text: The original natural language change request submitted by the user; Parsed business intent: A standardized business intent description object generated after semantic parsing; Relevant strategy knowledge subgraph: information on relevant strategy rules retrieved and used from the knowledge graph during the compliance reasoning process; Triggered rule vertex set: The set of specific knowledge graph rule vertices that directly lead to compliance or non-compliance conclusions during the review and judgment process; By integrating the above key information, the system constructs a complete and traceable record of the decision-making process, forming the final chain of evidence for tracing the source. Historical Case Connections: Calculation The feature vectors are used to retrieve the top-K semantically similar past cases C_historical from the historical case library as risk evidence; Structured Result Encapsulation: Generate the final structured review result object R. The encapsulation logic of object R is as follows: If the judgment is compliant, the result object will mainly contain a compliance status identifier, while the violation-related fields will be empty; If the judgment is non-compliant, the result object will include a non-compliance status identifier, the specific rule set V_triggered that triggered the judgment, the complete decision-making traceability evidence chain Trace, and the associated retrieved set of similar historical cases C_historical.

[0019] Preferably, in step S3, the traceable structured result generation and pre-decision execution include pre-decision and process execution based on white-box results, specifically including: Mandatory Decision Point: The action to be executed is defined as a mandatory module invocation in the network automation process, and the mandatory module is located strictly before the configuration generation engine; Deterministic decision-making logic: Based on the structured result R, the system executes deterministic and unavoidable business process decisions, specifically: If deemed compliant, the system will automatically allow the current business change intention and securely transmit it to the subsequent network configuration automatic generation stage to continue the subsequent automated process; If a non-compliance is determined, the system will immediately terminate the current change process and automatically generate detailed alarm information based on the review results. The alarm information includes complete decision-making traceability evidence (Trace) and the specific rule location (V_triggered) of the violation, and will be automatically pushed to the relevant operation and maintenance management system, work order system, and security personnel, thereby achieving immediate risk blocking and transparent reporting.

[0020] Preferably, a network configuration change semantic compliance review and risk tracing system based on a large model is provided for executing the network configuration change semantic compliance review and risk tracing method based on a large model. The system includes: The knowledge construction module is used to collect multi-source heterogeneous data from the communication bearer network domain, and to construct and maintain a policy compliance knowledge graph containing business intent, policy rules, and compliance constraints, as well as its vectorized representation. The intent parsing module is used to receive business change requests described in natural language and parse them into structured business intents using a large language model; The review reasoning module is used to retrieve policy context subgraphs related to structured business intents from the policy compliance knowledge graph based on retrieval enhancement generation technology, and to perform logical compliance reasoning on structured business intents by combining large language models with policy context subgraphs, and output compliance judgment results and specific policy rules triggered. The source tracing decision module is used to construct a verifiable chain of evidence for decision tracing based on the review and reasoning process, and to execute pre-emptive blocking or release process decisions based on the compliance judgment results. When the judgment result is non-compliant, the chain of evidence for decision tracing is encapsulated into a structured data object and used as the basis for mandatory blocking decisions, driving the automated operation and maintenance process to switch to manual review or automatic rejection.

[0021] Preferably, the review reasoning module further includes: The retrieval enhancement unit is used to vectorize structured business intents, perform semantic retrieval in the domain knowledge vector library, and expand the strategy context subgraph in the graph database. The reasoning unit is used to combine the policy context subgraph with the large language model through prompting engineering, perform thought chain reasoning, and parse the model output to generate formalized compliance judgment results.

[0022] The beneficial effects of this invention are as follows: 1. This invention establishes the construction and embedding of a domain-specific compliance knowledge graph: This invention is not a general knowledge base, but rather a structured semantic knowledge network built for communication bearer networks such as IP / MPLS backbone networks and transmission networks; its nodes include network resource objects, policy entities, and service intent templates. Edge relationship definitions constrain, unlike the device models and traffic simulation models required for existing digital twin technologies. This knowledge graph models business and management policy rules, providing a reasoning basis for semantic layer review.

[0023] 2. This invention establishes a multi-level review and tracing reasoning mechanism: Level 1: Intent Compliance Mapping: After parsing natural language instructions into structured intents, the large language model does not directly generate configurations. Instead, it first performs subgraph matching and logical satisfaction checks with the compliance knowledge graph. Level 2: Configuration Semantic Association Review: For specific configuration commands that have been generated or are yet to be issued, the system back-maps them to policy nodes in the knowledge graph to check whether their parameters violate established policies. This is fundamentally different from a rule engine that only checks command syntax. Source Tracing Output: When a violation is detected, the system automatically generates an interpretable violation determination path graph, clearly showing the complete logical chain from the original input to the specific knowledge graph rule node that triggers it, as well as the original text of the violated clause.

[0024] 3. This invention sets up closed-loop integration and intervention points: This system, as an independent semantic review layer, can be embedded into existing automated operation and maintenance processes. Its optimal intervention point is after change order parsing and before digital twin simulation or configuration distribution. Review results can be directly fed back to the change order system, driving process redirection. This synergizes with the performance warnings output by the simulation system in terms of decision-making sequence: first determining "whether it can be done," then "whether it can be done well." This fundamentally shifts the focus of security protection from traditional feature-matching-based boundary defense to intrinsic security immunity targeting the network core, based on behavioral intent perception and continuous adaptive learning. It achieves a paradigm shift in the detection of advanced covert threats from static and lagging to dynamic and proactive. It fundamentally moves risk prevention from post-event verification to pre-event blocking, and through a locationable and verifiable white-box traceability evidence chain, it makes the automated decision-making process transparent and auditable, solving the core problem of the difficulty in preventing and assigning responsibility for human strategic errors in communication bearer network changes.

[0025] 4. By introducing a review mechanism that couples domain compliance knowledge graphs with large language models, this invention fundamentally elevates the review dimension of configuration changes from the network connectivity and performance simulation that are emphasized in existing technologies to the semantic understanding and reasoning level of business intent and policy compliance. It also makes the review decision-making process explainable and traceable, thereby substantially shifting the risk control checkpoint from post-audit and result verification to pre-blocking. Attached Figure Description

[0026] Figure 1 This is a flowchart of the present invention. Detailed Implementation

[0027] Example 1: like Figure 1 As shown, the method for semantic compliance review and risk tracing of network configuration changes based on a large model includes the following steps: S1, Construction and maintenance of domain knowledge infrastructure: Collect multi-source heterogeneous communication bearer network domain data, and construct a policy compliance knowledge graph based on the domain data; the policy compliance knowledge graph represents the business intent, policy rules and compliance constraints that network configuration changes should follow in the form of a graph structure; S2, Intelligent Analysis and Review of Business Intent: The system receives business change requests described in natural language, performs semantic parsing of the requests using a large language model to obtain structured business intents, retrieves policy context subgraphs related to the semantics of the structured business intents from the policy compliance knowledge graph based on retrieval enhancement generation technology, and inputs the structured business intents and policy context subgraphs into the large language model for logical compliance reasoning to obtain compliance judgment results and the specific policy rules triggered. S3, Traceable Structured Result Generation and Pre-Decision Execution: Based on structured business intent, policy context subgraphs, and specific policy rules that trigger the decision, a verifiable chain of evidence for decision tracing is constructed. Based on the compliance determination results, a pre-decision is executed. If the decision is deemed non-compliant, the change process is blocked and the chain of evidence for decision tracing is output.

[0028] Preferably, in step S1, the construction and maintenance of the domain knowledge infrastructure includes the collection and preprocessing of multi-source heterogeneous domain data, specifically including: During data collection, the system collects raw data from the following sources: Unstructured documents: International / industry technical standards, such as IETF RFC, ITU-T recommendations, operator service level agreement (SLA) contract texts, cybersecurity regulations and internal security red line documents; Semi-structured data: network device configuration templates, routing policy files, access control list (ACL) rule bases, and historical change order records; Structured data: Configuration management database (CMDB), network topology information, and service catalog; Data preprocessing includes format parsing, text extraction, and semantic paragraph segmentation of unstructured documents, and the creation of a text corpus with associated metadata, such as document source, chapter, and effective date.

[0029] Preferably, in step S1, the construction and maintenance of the domain knowledge infrastructure includes joint extraction of entities and relations based on domain-fine-tuned LLM, specifically including: Model fine-tuning: LoRA, a parameter-efficient fine-tuning technique, is used to adapt the basic LLM to the domain using manually annotated communication bearer network strategy corpus; the annotated corpus consists of triples in the form of [entity, relation, entity]; for example, [financial customer, restricted by, must be encrypted]. Knowledge extraction: The preprocessed text corpus is input into a fine-tuned domain LLM, and a joint task of sequence labeling and relation classification is performed to extract a set of triples representing policy constraints in batches. .

[0030] Preferably, in step S1, the construction and maintenance of the domain knowledge infrastructure includes the construction, storage, and vectorization of the policy compliance knowledge graph, specifically including: Graph pattern definition and storage: Define the graph pattern: Vertex types include, but are not limited to, policy subjects, constraints, operation objects, and legal clauses; edge type definitions include, but are not limited to, prohibited, mandatory, dependent, and conflict semantic relationships. The triplet data is persistently stored in a graph database to form an attribute graph. , where A is the set of attributes that record metadata such as the original text and confidence level; Graph Vectorization Embedding: Utilizing graph embedding algorithms, preferably TransE or GraphSAGE, vertices and edges in the graph are mapped into low-dimensional dense vectors, i.e., the embedding function is learned. The resulting vectors are stored in a vector database, forming a domain knowledge vector library that supports efficient semantic retrieval.

[0031] Preferably, in step S2, the intelligent parsing and review of business intent includes the parsing and standardization of natural language business intent, specifically including: Input: Receive the natural language change request text submitted by the user. For example: "Open a 100M high-priority MPLS leased line to the data center for cross-border financial business"; Semantic parsing: LLM parsing functions fine-tuned by domain ,right Perform semantic understanding and output standardized business intent description objects. , It includes the following structured parts: Intent type: Identify and summarize the core operational purpose of the request, such as "activate a high-priority dedicated line"; Entity set: A list of key objects extracted from the request text, such as ["Cross-border financial business", "Data center", "MPLS leased line"]; Relationship set: The main semantic relationships between the identified entities, such as ["serving"]. Business parameters: Detailed business and technical indicators encapsulated in key-value pairs, such as {"bandwidth":"100M", "service level":"financial"}; Furthermore, this standardized object provides clear and structured input for subsequent compliance reviews.

[0032] Intent vectorization: using an encoder to... Convert to query vector .

[0033] Preferably, in step S2, the intelligent parsing and review of business intent includes knowledge retrieval-enhanced context acquisition, specifically including: Semantic retrieval: based on query vectors Perform an approximate nearest neighbor search in the domain knowledge vector library to recall the policy vertices and edges that are most relevant to the current intent semantics; Subgraph construction: Based on the recalled vertices and edges, in the graph database Perform a one- or two-hop extended query to obtain a strategy context subgraph rich in logical constraints. , It contains all the possible criteria for evaluation. The relevant rules and relationships regarding compliance.

[0034] Preferably, in step S2, the intelligent parsing and review of business intent includes logical compliance reasoning and judgment based on enhanced context, specifically including: Hint Project: Subgraph The triples and their associated original text attributes in the LLM prompt word template are injected in a structured format to form the knowledge-enhanced prompt context Prompt_context; Thought chain reasoning: Together with Prompt_context, it takes LLM as input and instructions as input, acting as a compliance expert. It performs chain-of-thought reasoning based on given exact rules and outputs natural language analysis containing the final conclusion and reasoning basis. Formal determination: The system parses the LLM output, extracts the compliance status, and bases it on... The logical relationships in the code are formally verified, ultimately generating a deterministic judgment result tuple (Judgement, V_triggered); V_triggered is... The specific policy rule vertex sequence that causes Judgement to output compliance or violation is given. When Judgement is violation, V_triggered is not empty.

[0035] Preferably, in step S3, the generation of traceable structured results and the execution of pre-decision decisions include the generation and structured output of verifiable traceable evidence chains, specifically including: Evidence Chain Construction: The system automatically generates a decision tracing evidence chain Trace. An evidence chain Trace is a structured data object formed by encapsulating the following key information: Request Unique Identifier: A unique identifier assigned by the system to the current review request; Original request text: The original natural language change request submitted by the user; Parsed business intent: A standardized business intent description object generated after semantic parsing; Relevant strategy knowledge subgraph: information on relevant strategy rules retrieved and used from the knowledge graph during the compliance reasoning process; Triggered rule vertex set: The set of specific knowledge graph rule vertices that directly lead to compliance or non-compliance conclusions during the review and judgment process; By integrating the above key information, the system constructs a complete and traceable record of the decision-making process, forming the final chain of evidence for tracing the source. Historical Case Connections: Calculation The feature vectors are used to retrieve the top-K semantically similar past cases C_historical from the historical case library as risk evidence; Structured Result Encapsulation: Generate the final structured review result object R. The encapsulation logic of object R is as follows: If the judgment is compliant, the result object will mainly contain a compliance status identifier, while the violation-related fields will be empty; If the judgment is non-compliant, the result object will include a non-compliance status identifier, the specific rule set V_triggered that triggered the judgment, the complete decision-making traceability evidence chain Trace, and the associated retrieved set of similar historical cases C_historical.

[0036] Preferably, in step S3, the traceable structured result generation and pre-decision execution include pre-decision and process execution based on white-box results, specifically including: Mandatory Decision Point: The action to be executed is defined as a mandatory module invocation in the network automation process, and the mandatory module is located strictly before the configuration generation engine; Deterministic decision-making logic: Based on the structured result R, the system executes deterministic and unavoidable business process decisions, specifically: If deemed compliant, the system will automatically allow the current business change intention and securely transmit it to the subsequent network configuration automatic generation stage to continue the subsequent automated process; If a non-compliance is determined, the system will immediately terminate the current change process and automatically generate detailed alarm information based on the review results. The alarm information includes complete decision-making traceability evidence (Trace) and the specific rule location (V_triggered) of the violation, and will be automatically pushed to the relevant operation and maintenance management system, work order system, and security personnel, thereby achieving immediate risk blocking and transparent reporting.

[0037] Preferably, a network configuration change semantic compliance review and risk tracing system based on a large model is provided for executing the network configuration change semantic compliance review and risk tracing method based on a large model. The system includes: The knowledge construction module is used to collect multi-source heterogeneous data from the communication bearer network domain, and to construct and maintain a policy compliance knowledge graph containing business intent, policy rules, and compliance constraints, as well as its vectorized representation. The intent parsing module is used to receive business change requests described in natural language and parse them into structured business intents using a large language model; The review reasoning module is used to retrieve policy context subgraphs related to structured business intents from the policy compliance knowledge graph based on retrieval enhancement generation technology, and to perform logical compliance reasoning on structured business intents by combining large language models with policy context subgraphs, and output compliance judgment results and specific policy rules triggered. The source tracing decision module is used to construct a verifiable chain of evidence for decision tracing based on the review and reasoning process, and to execute pre-emptive blocking or release process decisions based on the compliance judgment results. When the judgment result is non-compliant, the chain of evidence for decision tracing is encapsulated into a structured data object and used as the basis for mandatory blocking decisions, driving the automated operation and maintenance process to switch to manual review or automatic rejection.

[0038] Preferably, the review reasoning module further includes: The retrieval enhancement unit is used to vectorize structured business intents, perform semantic retrieval in the domain knowledge vector library, and expand the strategy context subgraph in the graph database. The reasoning unit is used to combine the policy context subgraph with the large language model through prompting engineering, perform thought chain reasoning, and parse the model output to generate formalized compliance judgment results.

[0039] Example 2: This embodiment takes the service change request of "opening a 100Mbps high-priority MPLS leased line from Shanghai to Frankfurt for cross-border financial business, requiring an end-to-end latency of ≤100ms" as an example to fully demonstrate the implementation process of the technical solution of the present invention.

[0040] Phase 1: Building Domain Knowledge Infrastructure - Offline 1. Data Acquisition and Preprocessing: Data source: The "Group Network Security Technical Specification v3.2" (PDF) includes "Article 8.3: All network channels carrying financial and government business must enable asymmetric encryption and integrity verification between the origin and destination points." The SLA contract with "European Financial Cloud" (Word) includes "Annex II: Transmission Indicators".

[0041] 1.1 End-to-end network latency should be ≤150ms.

[0042] 1.2 Monthly network availability should not be lower than 99.99%. The "International Internet Access Control Rules" (internal Wiki) include "Principle 3: When data flows across borders, the department initiating the business must submit a joint approval form from the legal and security departments, number: ICC-2023-01." Network Resource Database (CMDB): Structured data that records information such as device type, interconnection port, and autonomous system (AS) to which “Shanghai-POP-09” and “Frankfurt-DC-03” belong.

[0043] Preprocessing: The full text of the Technical Specifications was extracted using a PDF parsing library and structured into chapters, articles, and clauses. Meta tags were added to each paragraph, such as [Document=Network Security Specifications, Chapter=8.3, Type=Mandatory Clause].

[0044] Convert the table content (such as latency, availability) in the SLA contract into key-value pairs of text: "metric: value".

[0045] Take snapshots of the internal Wiki pages, preserving links and version numbers.

[0046] 2. Knowledge Extraction and Graph Construction: Model fine-tuning: Base model: ChatGLM3-6B.

[0047] Fine-tuning method: LoRA (Low-Rank Adaptation) is used, with rank r=8.

[0048] Training data: 5000 manually labeled policy statements in the communication domain, formatted as [text fragment, {(header entity, relation, tail entity)}]. For example, "Asymmetric encryption must be enabled" is labeled as (financial business traffic, must be used, asymmetric encryption).

[0049] Loss function: The standard cross-entropy loss is used to optimize the joint loss of the three sub-tasks: head entity recognition, relation classification, and tail entity recognition.

[0050] Batch extraction: Input the preprocessed text segments into the fine-tuned model in batches. The model successfully extracted the triplet from Article 8.3 of the Technical Specification: (Financial and Government Affairs Business Channel, must be enabled, asymmetric encryption and integrity verification).

[0051] SLA contract extraction: (European Financial Cloud Dedicated Line, guarantee indicators include end-to-end latency ≤150ms), (European Financial Cloud Dedicated Line, guarantee indicators include monthly availability ≥99.99%).

[0052] Extraction of management details: (For cross-border data flow business, the prerequisite is the submission of the joint approval form ICC-2023-01).

[0053] Map storage: Use the Neo4j graph database.

[0054] Create vertices: v1, the tag is mandatory, with attributes {id:'v1', text:'Asymmetric encryption and integrity verification must be enabled', source:'Cybersecurity Specification 8.3'}.

[0055] v2, tag performance metrics, attributes {id:'v2', text:'End-to-end latency ≤150ms', source:'SLA contract Annex II 1.1'}.

[0056] v3, Tag Process Rules, Attributes {id:'v3', text:'Requires submission of joint approval form ICC-2023-01', source:'Management Rules Principle Three'}.

[0057] Create relationship edges: (v1)-[APPLIES_TO]->(Financial Business).

[0058] (v2)-[APPLIES_TO]->(International Leased Line).

[0059] (v3)-[TRIGGERED_BY]->(cross-border data flow).

[0060] 3. Graph vectorization: Embedding model: The Sentence-BERT model was selected, which is specifically optimized for sentence-level semantic similarity calculation.

[0061] Vector generation: Input the text attribute of each vertex (such as "asymmetric encryption and integrity verification must be enabled") into the model to obtain a 768-dimensional vector representation. .

[0062] Storage: Store the vector pairs (vertex id, 768-dimensional vector) into the Milvus vector database and create a dedicated collection, policy_knowledge_collection.

[0063] Phase Two: Online Intelligent Review and Reasoning - Online: 4. Intent parsing: Input: The operations and maintenance personnel fill in the following in the work order system: "Business requirements: Open an MPLS leased line from Shanghai (POP-09) to Frankfurt (DC-03) for the 'Cross-border Digital Euro Settlement' project, with a bandwidth of 100M, requiring high priority and ensuring low latency." Parsing Model: Calls an API dedicated to intent parsing, which is backed by an LLaMA-7B model finely tuned by P-Tuningv2.

[0064] Structured output The object contains: The request identifier is "REQ-2023-001"; Intent type: "Open international high-performance leased line"; The list of entities identified from the request (such as the business "cross-border digital euro settlement", the source site "Shanghai-POP-09", the destination site "Frankfurt-DC-03", the service type "MPLS leased line", etc.). Business parameters (such as bandwidth "100M", priority "high", performance requirement "low latency", whether it is cross-border "yes", business category "finance", etc.); The resolution confidence level is 0.96.

[0065] 5. Enhanced knowledge retrieval: Query vector construction: Key semantic information (such as "finance", "cross-border", "dedicated line", "low latency") is concatenated into query text and encoded into query vector q using the same Sentence-BERT model.

[0066] Vector retrieval: Perform a similarity search in Milvus's policy_knowledge_collection, setting the threshold top_k=5. The retrieval results return a list of vertex IDs most similar to q: [v1,v3,v2,...].

[0067] Subgraph Expansion: In Neo4j, starting from vertices v1, v2, and v3, extend the policy context subgraph by one hop along relational edges such as APPLIES_TO and TRIGGERED_BY to obtain the complete policy context subgraph. . It includes not only these three vertices and their attributes, but also their relationships with conceptual nodes such as "financial business" and "international leased line".

[0068] 6. Compliance Reasoning: Hint Project: Construct the following mind chain hint template: You are a communications network compliance review expert; please strictly adhere to the following known policy terms in your judgments and do not introduce external knowledge.

[0069] Known strategy terms: 1. [Term v1]: {v1.text} 2. [Term v2]: {v2.text} 3. [Term v3]: {v3.text} Business intent to be reviewed: { JSON string} Review task: Please deduce the reasoning step by step: 1. Analyze the business attributes (financial, cross-border, etc.) and technical parameters of the intent.

[0070] 2. Verify one by one whether the intent satisfies or violates the above clauses.

[0071] Model reasoning: Input the constructed prompts into the review-specific model.

[0072] The model returns step-by-step inference: "The intended business category is 'finance' and involves 'cross-border data flows'." "According to Clause v1, financial transaction channels 'must enable asymmetric encryption and integrity verification,' but no encryption requirements are mentioned in the intent parameters. This violates v1." "According to Clause v3, cross-border data flow transactions 'require the submission of a joint approval form ICC-2023-01'. This approval form number is not provided in the intent. This violates v3." "Term v2 is a performance metric related to latency and does not affect the current compliance determination." "Conclusion: Non-compliant. Terms violated: v1, v3." Result formatting: The system analyzes the model response and generates deterministic output: (Judgement=NonCompliant,V_triggered=['v1','v3']).

[0073] Phase Three: White-box Decision Making and Source Tracing - Online: 7. Generate traceability chain and make decisions: Constructing a Trace of Evidence: The system automatically generates a structured trace of evidence document. This document records the following aspects of the review: The unique tracking identifier is "TRACE-REQ-2023-001"; The decision result was "REJECTED"; Timestamp "2023-10-27T14:30:05Z"; The original request text snapshot reads: "Business requirements: To open an MPLS leased line from Shanghai (POP-09) to Frankfurt (DC-03) for the 'Cross-border Digital Euro Settlement' project..."; The structured intent after parsing ; Examine the knowledge subgraph information of the strategies used; The specific list of rules that triggers the violation includes the original text, source, and description of evidence for each rule, such as "Asymmetric encryption and integrity verification must be enabled, according to Article 8.3 of the Group Network Security Technical Specification v3.2, where the 'encryption method' field is missing in the intent parameters." The complete inference process text of a large language model; The semantically similar case retrieved from the historical case database is "CASE-2022-045: Security incidents in similar cross-border financial transactions caused by lack of encryption configuration".

[0074] Implement pre-emptive intervention: The compliance engine calls the EnforceDecision(Trace) function.

[0075] Function logic: Since the decision is "REJECTED", immediately return an HTTP 403 Forbidden response to the ticket system, and attach the Trace as the response body.

[0076] Result: The ticket system automatically set the ticket status to "Rejected: Compliance review failed" and highlighted it. Simultaneously, the violation_evidence and source_document data from the trace were prominently displayed to the ticket creator, with copies sent to their supervisor and the security department.

[0077] This embodiment demonstrates in detail: Specific technologies for knowledge construction: a complete pipeline from unstructured documents to vectorized knowledge graphs, involving model fine-tuning, information extraction, and the combined use of graph databases and vector databases.

[0078] Examining the precise process of reasoning: How to seamlessly integrate natural language intent, vectorized retrieval, knowledge-enhanced prompting engineering, and LLM's thought chain reasoning to arrive at interpretable decisions.

[0079] Engineering implementation of white-box decision-making: How to encapsulate review results into a standardized data structure containing complete input, context, reasoning path and evidence, and use this to drive the hard blocking of automated business processes, so as to achieve absolute forward risk prevention and control and complete transparency of decision-making.

Claims

1. A method for semantic compliance review and risk tracing of network configuration changes based on a large model, characterized in that: Includes the following steps: S1, Construction and maintenance of domain knowledge infrastructure: Collect multi-source heterogeneous communication bearer network domain data, and construct a policy compliance knowledge graph based on the domain data; the policy compliance knowledge graph represents the business intent, policy rules and compliance constraints that network configuration changes should follow in the form of a graph structure; S2, Intelligent Analysis and Review of Business Intent: Receive business change requests described in natural language, use a large language model to perform semantic parsing on the business change requests, and obtain structured business intent; Based on retrieval enhancement generation technology, policy context subgraphs related to structured business intent semantics are retrieved from the policy compliance knowledge graph; the structured business intent and policy context subgraphs are input into a large language model for logical compliance reasoning to obtain compliance judgment results and the specific policy rules triggered. S3, Traceable Structured Result Generation and Pre-Decision Execution: Based on structured business intent, policy context subgraphs, and specific policy rules that trigger the decision, a verifiable chain of evidence for decision tracing is constructed. Based on the compliance determination results, a pre-decision is executed. If the decision is deemed non-compliant, the change process is blocked and the chain of evidence for decision tracing is output.

2. The method for semantic compliance review and risk tracing of network configuration changes based on a large model as described in claim 1, characterized in that, In step S1, the construction and maintenance of the domain knowledge infrastructure includes the collection and preprocessing of multi-source heterogeneous domain data, specifically including: During data collection, the system collects raw data from the following sources: Unstructured documents: international / industry technical standards, operator service level agreement (SLA) contract texts, cybersecurity regulations and internal security red line documents; Semi-structured data: network device configuration templates, routing policy files, access control list (ACL) rule bases, and historical change order records; Structured data: Configuration management database (CMDB), network topology information, and service catalog; Data preprocessing includes format parsing, text extraction, and semantic paragraph segmentation of unstructured documents to build a text corpus with associated metadata.

3. The method for semantic compliance review and risk tracing of network configuration changes based on a large model as described in claim 2, characterized in that, In step S1, the construction and maintenance of the domain knowledge infrastructure includes joint extraction of entities and relations based on domain-fine-tuned LLM, specifically including: Model fine-tuning: Efficient parameter fine-tuning techniques are employed, and the basic LLM is adapted using manually annotated communication bearer network strategy corpus; the annotated corpus consists of triples in the form of [entity, relation, entity]; Knowledge extraction: The preprocessed text corpus is input into a fine-tuned domain LLM, and a joint task of sequence labeling and relation classification is performed to extract a set of triples representing policy constraints in batches. .

4. The method for semantic compliance review and risk tracing of network configuration changes based on a large model as described in claim 3, characterized in that, In step S1, the construction and maintenance of the domain knowledge infrastructure includes the construction, storage, and vectorization of the policy compliance knowledge graph, specifically including: Graph pattern definition and storage: Define the graph pattern: Vertex types include, but are not limited to, policy subjects, constraints, operation objects, and legal clauses; edge type definitions include, but are not limited to, prohibited, mandatory, dependent, and conflict semantic relationships. The triplet data is persistently stored in a graph database to form an attribute graph. , where A is the set of attributes that record metadata such as the original text and confidence level; Graph Vectorization Embedding: Using graph embedding algorithms, vertices and edges in a graph are mapped to low-dimensional dense vectors, i.e., the embedding function is learned. The resulting vectors are stored in a vector database, forming a domain knowledge vector library that supports efficient semantic retrieval.

5. The method for semantic compliance review and risk tracing of network configuration changes based on a large model as described in claim 1, characterized in that, In step S2, the intelligent parsing and review of business intent includes the parsing and standardization of natural language business intent, specifically including: Input: Receive the natural language change request text submitted by the user. ; Semantic parsing: LLM parsing functions fine-tuned by domain ,right Perform semantic understanding and output standardized business intent description objects. , It includes the following structured parts: Intent type: Identify and summarize the core operational purpose of the request; Entity collection: A list of key objects extracted from the request text; Relation set: The main semantic relationships between the identified entities; Business parameters: Detailed business and technical indicators encapsulated in key-value pairs; Intent vectorization: using an encoder to... Convert to query vector .

6. The method for semantic compliance review and risk tracing of network configuration changes based on a large model as described in claim 5, characterized in that, In step S2, the intelligent parsing and review of business intent includes knowledge retrieval-enhanced context acquisition, specifically including: Semantic retrieval: based on query vectors Perform an approximate nearest neighbor search in the domain knowledge vector library to recall the policy vertices and edges that are most relevant to the current intent semantics; Subgraph construction: Based on the recalled vertices and edges, in the graph database Perform a one- or two-hop extended query to obtain a strategy context subgraph rich in logical constraints. , It contains all the possible criteria for evaluation. The relevant rules and relationships regarding compliance.

7. The method for semantic compliance review and risk tracing of network configuration changes based on a large model as described in claim 6, characterized in that, In step S2, the intelligent parsing and review of business intent includes logical compliance reasoning and judgment based on enhanced context, specifically including: Hint Project: Subgraph The triples and their associated original text attributes in the LLM prompt word template are injected in a structured format to form the knowledge-enhanced prompt context Prompt_context; Thought chain reasoning: Together with Prompt_context, it inputs LLM and commands, acting as a compliance expert. Based on the given exact rules, it performs step-by-step reasoning and outputs natural language analysis containing the final conclusion and reasoning basis. Formal determination: The system parses the LLM output, extracts the compliance status, and bases it on... The logical relationships in the code are formally verified, ultimately generating a deterministic judgment result tuple (Judgement, V_triggered), where V_triggered is... The output of Judgement is a sequence of specific policy rule vertices that result in whether Judgement is compliant or non-compliant. When Judgement is non-compliant, V_triggered is not empty.

8. The method for semantic compliance review and risk tracing of network configuration changes based on a large model as described in claim 1, characterized in that, In step S3, the generation of traceable structured results and the execution of pre-decision decisions include the generation and structured output of verifiable traceable evidence chains, specifically including: Evidence Chain Construction: The system automatically generates a decision tracing evidence chain Trace. An evidence chain Trace is a structured data object formed by encapsulating the following key information: Request Unique Identifier: A unique identifier assigned by the system to the current review request; Original request text: The original natural language change request submitted by the user; Parsed business intent: A standardized business intent description object generated after semantic parsing; Relevant strategy knowledge subgraph: information on relevant strategy rules retrieved and used from the knowledge graph during the compliance reasoning process; Triggered rule vertex set: The set of specific knowledge graph rule vertices that directly lead to compliance or non-compliance conclusions during the review and judgment process; By integrating the above key information, the system constructs a complete and traceable record of the decision-making process, forming the final chain of evidence for tracing the source. Historical Case Connections: Calculation The feature vectors are used to retrieve the top-K semantically similar past cases C_historical from the historical case library as risk evidence; Structured Result Encapsulation: Generate the final structured review result object R. The encapsulation logic of object R is as follows: If the judgment is compliant, the result object will mainly contain a compliance status identifier, while the violation-related fields will be empty; If the judgment is non-compliant, the result object will include a non-compliance status identifier, the specific rule set V_triggered that triggered the judgment, the complete decision-making traceability evidence chain Trace, and the associated retrieved set of similar historical cases C_historical.

9. The method for semantic compliance review and risk tracing of network configuration changes based on a large model as described in claim 8, characterized in that, In step S3, the generation of traceable structured results and the execution of pre-decision decisions include pre-decision decisions and process execution based on white-box results, specifically including: Mandatory Decision Point: The action to be executed is defined as a mandatory module invocation in the network automation process, and the mandatory module is located strictly before the configuration generation engine; Deterministic decision-making logic: Based on the structured result R, the system executes deterministic and unavoidable business process decisions, specifically: If deemed compliant, the system will automatically allow the current business change intention and securely transmit it to the subsequent network configuration automatic generation stage to continue the subsequent automated process; If a non-compliance is determined, the system will immediately terminate the current change process and automatically generate detailed alarm information based on the review results. The alarm information includes complete decision-making traceability evidence (Trace) and the specific rule location (V_triggered) of the violation, and will be automatically pushed to the relevant operation and maintenance management system, work order system, and security personnel, thereby achieving immediate risk blocking and transparent reporting.

10. A network configuration change semantic compliance review and risk tracing system based on a large model, used to execute the network configuration change semantic compliance review and risk tracing method based on a large model as described in any one of claims 1-9, characterized in that, The system includes: The knowledge construction module is used to collect multi-source heterogeneous data from the communication bearer network domain, and to construct and maintain a policy compliance knowledge graph containing business intent, policy rules, and compliance constraints, as well as its vectorized representation. The intent parsing module is used to receive business change requests described in natural language and parse them into structured business intents using a large language model; The review reasoning module is used to retrieve policy context subgraphs related to structured business intents from the policy compliance knowledge graph based on retrieval enhancement generation technology, and to perform logical compliance reasoning on structured business intents by combining large language models with policy context subgraphs, and output compliance judgment results and specific policy rules triggered. The source tracing decision module is used to construct a verifiable chain of evidence for decision tracing based on the review and reasoning process, and to execute pre-emptive blocking or release process decisions based on the compliance judgment results. When the judgment result is non-compliant, the chain of evidence for decision tracing is encapsulated into a structured data object and used as the basis for mandatory blocking decisions, driving the automated operation and maintenance process to switch to manual review or automatic rejection. The review reasoning module further includes: The retrieval enhancement unit is used to vectorize structured business intents, perform semantic retrieval in the domain knowledge vector library, and expand the strategy context subgraph in the graph database. The reasoning unit is used to combine the policy context subgraph with the large language model through prompting engineering, perform thought chain reasoning, and parse the model output to generate formalized compliance judgment results.

Images