Data security knowledge automatic optimization method based on semantic audit feedback

Abstract

The application discloses a data security knowledge automatic optimization method based on semantic audit feedback. In view of the problem that a security semantic knowledge base cannot cover all access scenes in advance in actual operation, the application proposes to automatically identify a knowledge gap scene that cannot be covered by an inference engine from a semantic audit log, generate a knowledge expansion suggestion based on an existing inference rule analog derivation, write the knowledge expansion suggestion into the security semantic knowledge base after manual auditing, formalized consistency checking and historical log playback verification, continuously track knowledge coverage rate improvement effect, and form a knowledge optimization closed loop driven by semantic audit feedback. The application enables the coverage rate of the security semantic knowledge base to be naturally improved along with system operation, and knowledge accumulation forms a positive flywheel effect.

Description

Technical Field

[0001] This invention belongs to the interdisciplinary field of data security and knowledge engineering, specifically involving automatic expansion technology of security semantic knowledge base based on runtime semantic audit log feedback, and continuous optimization technology of security semantic knowledge base coverage. Background Technology

[0002] The security semantic knowledge base is a core component of the data security semantic weaving system. In actual deployment, the inference rule set of the security semantic knowledge base is defined based on known business scenarios when the system is built, and cannot pre-cover all combinations of access scenarios that will occur in actual operation. When the inference engine encounters a new scenario from which a clear policy cannot be derived, manual intervention is required.

[0003] Existing knowledge update technologies in the field of knowledge engineering have the following limitations: General machine learning knowledge update methods: extract knowledge based on statistical regularities, but do not guarantee that the extracted knowledge meets the formal logical consistency required by the secure semantic knowledge base, and may introduce new rules that contradict existing reasoning rules; Manual knowledge update methods rely entirely on knowledge engineers to manually identify knowledge gaps and write new rules, lacking a mechanism to automatically identify gaps from operational data, resulting in a lag in knowledge updates. Ontology learning technologies learn ontology concepts from text or data, but they do not address the specific knowledge gap type of "access scenarios that the inference engine cannot cover," and do not match the specific needs of data security access control scenarios. The common limitation of the above technologies is that none of them use the "real-time operational feedback of the secure semantic reasoning engine" as a data source for knowledge gap identification, nor do they design a suggestion generation mechanism that combines the identification results with the analogy and derivation of existing reasoning rules. Summary of the Invention

[0004] The purpose of this invention is to provide an automatic optimization method for data security knowledge based on semantic audit feedback, and to establish a complete closed-loop mechanism for the continuous expansion of the security semantic knowledge base from runtime semantic audit logs.

[0005] The core technical concept of this invention is as follows: using records of manual intervention triggered by the inference engine in the semantic audit log as the data source for knowledge gap identification; extracting the ternary semantic context features of the gap scenario; retrieving the closest existing inference rules as the basis for analogical derivation; writing it into the knowledge base after formal consistency verification and historical log playback verification; and continuously tracking the improvement effect of knowledge coverage to form a knowledge optimization closed loop.

[0006] The main technical effects of this invention are as follows: Automated knowledge gap identification: This transforms knowledge engineers from manually inspecting knowledge gaps to reviewing suggestions automatically discovered by the system, changing the work mode from proactive searching to passive confirmation, thus significantly improving efficiency; Recommendations for quality assurance: It is recommended to generate analogical derivations based on existing reasoning rules, maintain structural consistency with the existing conceptual system, and undergo formal consistency checks to avoid introducing logical contradictions; Knowledge accumulation creates a flywheel effect: as the running time goes on, the knowledge coverage continues to increase, the frequency of human intervention triggered by the inference engine gradually decreases, and the quality of system knowledge presents a self-reinforcing positive cycle; Source traceability: The trigger source of each new inference rule is recorded, supporting auditing and rollback. Attached Figure Description

[0007] Figure 1 This is the overall flowchart of the present invention, showing the complete closed-loop process of knowledge gap identification, suggestion generation, manual review, and knowledge dissemination. Figure 1 This illustrates the knowledge optimization closed loop and knowledge flywheel effect formed by steps S1 to S4 of the present invention. Figure 1 The top section shows the sequential relationship of the four steps: Step S1 (Ontology Knowledge Gap Identification) scans the semantic audit logs for entries that trigger manual intervention by the inference engine, extracts ternary semantic context features, retrieves the closest existing inference rules, and summarizes the knowledge gap report; Step S2 (Knowledge Extension Suggestion Generation) generates suggested new ontology class definitions and inference rules based on the gap report using analogy derivation, and pushes them to the review queue; Step S3 (Manual Review and Knowledge Verification) includes knowledge engineer review, formal consistency check, and historical log playback verification; Step S4 (Knowledge Publication and Effect Tracking) writes the verified knowledge extension content into the secure semantic knowledge base and tracks the coverage improvement effect. Figure 1 The bottom arrows indicate that step S1 is retried from the actual operational feedback of step S4 (effect tracking, uncovered scenarios), forming a knowledge optimization closed loop for continuous improvement. Figure 1 The lower part shows the three stages of the knowledge flywheel: the initial stage, with many knowledge gaps, many suggestions, and a high amount of manual work, and knowledge is accumulated rapidly; the growth stage, with increased coverage, fewer gaps, less manual work, and improved knowledge quality; and the mature stage, with high coverage, very few gaps, maintenance costs approaching zero, and the system approaching self-evolution.

[0008] Figure 2 The diagram illustrates the knowledge gap identification mechanism, showing the process of extracting gap scenario features from semantic audit logs. Figure 2 The process of identifying knowledge gaps in step S1 and generating knowledge expansion suggestions in step S2 is shown. Figure 2The left side shows four categories of entries in the semantic audit log and their identification targets: ordinary allowed events (rule hit), conditional allowed events (rule hit), events requiring manual judgment (rule not hit, marked with a warning symbol, the identification target of step S1), and ordinary rejected events (rule hit). Step S1 identifies events marked as requiring manual judgment, extracts their ternary semantic context features, and generates a gap report. Figure 2 The middle section shows the gap scenario analysis (taking ContractResearcher role accessing ClinicalDataset as an example): Gap scenario semantic description (data type class is ClinicalDataset, role class is ContractResearcher, destination class is ResearchAccess); the closest existing rule (the strategy of ExternalResearcher accessing ClinicalDataset, with the highest similarity); recommended extension direction (ContractResearcher is a subclass of ExternalResearcher, and additionally requires ManagerApproval). Figure 2 The right side shows the knowledge expansion suggestions (step S2): It is recommended to add a new class definition (ContractResearcher SubClassOf ExternalResearcher, inheriting all applicable strategies); it is recommended to add a new inference rule (ContractResearcher AND Level2Data AND ResearchAccess triggers ManagerApproval obligation); and an explanation of the association with existing rules (based on the extension of existing rules of ExternalResearcher, with consistent design patterns, existing rules are not affected).

[0009] Figure 3 This is a flowchart of the knowledge audit and verification process, illustrating the steps involved in formal consistency checks and historical log playback verification. Figure 3 The detailed processing flow of steps S3 and S4 is shown. Figure 3The left side shows the sequence of the five steps: Step 1, Knowledge Engineer Review (reviewing system-generated suggestions, confirming modifications or rejections, with a target workload of approximately 0.5 hours, significantly reduced compared to the 8 hours required for design from scratch); Step 2, Formal Consistency Verification (performing consistency checks on approved suggestions, preferably using the same inference engine as the security semantic knowledge base, confirming that the new rules do not logically contradict existing rules); Step 3, Historical Log Replay Verification (simulating the effect of the new rules on historical semantic audit logs, confirming that they correctly cover the original knowledge gap scenarios, and counting the number of scenarios covered by the new rules); Step 4, Shadow Mode Comparison Verification (claim 4, the new and old rules run simultaneously, automatically calculating the consistency rate, and submitting discrepancy cases for review by knowledge engineers); Step 5, Knowledge Publication and Effect Tracking (writing to the security semantic knowledge base, triggering cache invalidation, recording the source and reviewer, and continuously tracking the actual coverage effect). Figure 3 The right side shows the core quality assurance measures: formal verification to prevent the introduction of logical contradictions; historical playback to confirm the effect before re-release; shadow mode for risk-free verification; traceable knowledge sources and audit records; and quantitative statistical analysis of effects to support quality assessment. Detailed Implementation

[0010] The technical solution of the present invention will be further described below with reference to the accompanying drawings and specific embodiments. Example 1: Identification and Expansion of Basic Knowledge Gaps

[0011] This embodiment describes the basic implementation of the present invention in a data reuse scenario.

[0012] Implementation of step S1 (claim 1 S1): The system analyzes the semantic audit logs daily, extracting entries whose decision type requires manual intervention. Three entries were found today: ContractResearcher role accessing ClinicalDataset resources (target: ResearchAccess), PartTimeAnalyst role accessing FinancialReport resources (target: AnalysisAccess), and ExternalAuditor role accessing SystemLog resources (target: AuditAccess). For each record, the system extracts ternary semantic context features and retrieves the closest inference rule from the knowledge base. Taking the first record as an example, the closest rule found is: access control policy for ResearchUser role accessing ClinicalDataset (ContractResearcher is a subclass of ResearchUser).

[0013] Implementation of step S2 (claim 1 S2): Based on the retrieved reference rules, the system generates the following suggestions: Add a new ontology class definition `ContractResearcherSubClassOf ResearchUser`; add a new inference rule `ContractResearcher AND Level2Data` for the access policy of the destination `ResearchAccess` (extending the existing rules for `ResearchUser` by adding an additional `ManagerApproval` obligation requirement). These suggestions should be pushed to the review queue in a structured format, along with the aforementioned reasoning.

[0014] Implementation of step S3 (claim 1 S3, claim 3, claim 4): The knowledge engineer reviewed the recommendations, confirmed the correctness of the subclass relationships in ContractResearcher, and accepted the changes after modifying the parameter definitions of ManagerApproval. A formal consistency check was performed on the modified recommendations (preferably using the same inference engine as the security semantic knowledge base) to confirm the absence of logical contradictions. Replay verification was performed on historical logs to confirm that the new rules correctly covered the original three gap scenarios. After running in shadow mode for two days, the consistency rate with existing rule decisions was 98.7%, and the two discrepancy cases were reviewed and found to be normal extensions of the new rules.

[0015] Implementation of step S4 (claim 1 S4, claim 5): Three new, validated rules were written into the security semantic knowledge base, triggering an update to the inference engine cache invalidation. Source tracing information was recorded. Knowledge coverage statistics were updated: after this knowledge expansion, the inference engine coverage increased from 91.2% to 94.8%. Coverage data will be included in quality benchmarks for subsequent cycles. Example 2: Comparison with existing knowledge updating technologies

[0016] This embodiment illustrates the core differences between the present invention and the prior art through comparison.

[0017] Gap identification data source General datasets or text Manual inspection Manual intervention records in semantic audit logs (precise gap signals) Suggestion generation mechanism Learning statistical patterns Manually written Derived by analogy based on existing reasoning rules (structural consistency is guaranteed). Consistency Guarantee No formal guarantee Relying on human experience Formal reasoning engine verification (mathematical guarantee of no logical contradictions) Human involvement It can be fully automated (but the quality is difficult to guarantee). All artificial Manual review is a necessary step, but it significantly reduces the workload. Knowledge Flywheel Effect No specific design No specific design Coverage quantification tracking, positive feedback drives continuous optimization Equivalent implementation method

[0018] The method described in this invention does not rely on any specific security semantic knowledge base. Any security semantic knowledge base with reasoning rule sets and formal consistency verification capabilities can be used in conjunction with this invention.

[0019] The method described in this invention does not depend on any specific inference engine. Formal consistency verification preferably uses the same inference engine as the secure semantic knowledge base, but any mechanism with equivalent consistency verification capability can implement this invention.

[0020] The method described in this invention does not depend on any specific semantic audit log storage format. Any semantic audit log containing access control decision type fields and ternary semantic context features can be used as the data source for step S1 of this invention.

[0021] Any substitutions made by those skilled in the art based on the technical solutions of this invention using the equivalent technical means described above are all within the protection scope of the claims of this invention. Figure 1 This illustrates the knowledge optimization closed loop and knowledge flywheel effect formed by steps S1 to S4 of the present invention.

Claims

1. A method for automatically optimizing data security knowledge based on semantic audit feedback, characterized in that, Includes the following steps: Step S1: Ontology Knowledge Gap Identification – Continuously analyze the runtime semantic audit logs of the security semantic knowledge base to identify knowledge gaps: (1a) Scan the access control decisions in the semantic audit logs for log entries that require manual intervention, where manual intervention refers to manual judgment triggered because the security semantic knowledge base inference engine cannot derive a clear access control policy from the existing inference rule set; (1b) Extract the ternary semantic context features of the entries requiring manual intervention, including a combination of subject semantic identity class, resource semantic class, and access purpose class; (1c) Retrieve the existing inference rules in the security semantic knowledge base that are most similar to the ternary semantic context features as a reference for knowledge expansion; (1d) Summarize and form a knowledge gap report, including the semantic description of the gap scenario, the frequency of occurrence, and the corresponding... The most similar reasoning rule reference; Step S2: Knowledge expansion suggestion generation - Based on the knowledge gap report in step S1, generate security semantic knowledge base expansion suggestions: (2a) Based on the most similar reasoning rule, generate the new ontology class definition and reasoning rule of the suggestion by analogy; (2b) The suggestion maintains the structural consistency with the existing concept system of the security semantic knowledge base, so that the suggestion class definition can be directly integrated into the existing class hierarchy system; (2c) Push the generated suggestion to the knowledge review queue, with the gap scenario semantic description, analogy reasoning basis and reference rule reference; Step S3: Manual review and knowledge verification - Manual review and technical verification of the knowledge expansion suggestions generated in step S2: (3a) Knowledge engineers review the accuracy of the suggestions and can accept, modify or reject each suggestion; (3b) Perform formal consistency checks on the approved suggestions to verify that the new class definitions and inference rules are logically consistent with the existing security semantic knowledge base; (3c) For suggestions that pass formal verification, replay them on the historical semantic audit log to confirm that the new inference rules can correctly cover the original knowledge gap scenarios. Step S4: Knowledge Release and Effect Tracking - Write the knowledge extension content verified by step S3 into the security semantic knowledge base: (4a) Write the new ontology class definition and reasoning rules into the security semantic knowledge base and trigger the inference engine cache invalidation update; (4b) Record the source traceability information of this knowledge expansion, including the semantic audit log reference that triggered the knowledge gap, the auditor identification and verification results; (4c) In the subsequent operation cycle, track the actual coverage effect of the newly added reasoning rules on the knowledge gap scenario, and use the coverage improvement as the quantitative evaluation basis of the knowledge expansion effect; (4d) Use the coverage effect data as the quality reference for the next round of step S1 identification work to form a knowledge optimization closed loop of continuous improvement.

2. The method according to claim 1, characterized in that, Step S1 also includes an active gap detection mechanism: the system periodically performs coverage analysis on the inference rule set of the security semantic knowledge base and the semantic class distribution of the current data resources, identifies potential gap scenarios where there are semantic class instances but lack corresponding inference rules, and generates preventive knowledge gap reports before actual access occurs and triggers manual intervention, so that knowledge expansion work changes from passive response to active prevention.

3. The method according to claim 1, characterized in that, The formal consistency check described in step S3 (3b) is preferably performed using the same formal reasoning engine as the secure semantic knowledge base, but it is not limited to this. Any formal verification mechanism that can verify the consistency between the newly added class definition and reasoning rules and the existing knowledge base can implement the present invention. The consistency check includes at least the following: the newly added class definition does not cause logical contradictions in the existing class hierarchy; the newly added reasoning rules do not cause conflict with the existing reasoning rules; and the combination of the newly added rules and the existing rules does not produce unexpected new inferences.

4. The method according to claim 1, characterized in that, The historical log replay verification described in step S3 (3c) also supports shadow mode: before the new inference rule is officially written into the security semantic knowledge base, it can be run in shadow mode, that is, the new and old rules are executed at the same time, and the inference result of the new rule is only recorded and does not take effect externally; the system automatically counts the decision consistency rate and difference cases of the new and old rules, which are provided for knowledge engineers to make final confirmation before the official release; the shadow mode can run for a preset time period or automatically end after reaching a preset sample size, without affecting the normal operation of online services.

5. The method according to claim 1, characterized in that, The coverage effect tracking in step S4 (4c) also includes the maintenance of quantitative indicators for the overall knowledge accumulation status: the system continuously calculates the coverage rate of the security semantic knowledge base reasoning rule set for historical access scenarios, the increase in coverage rate after each knowledge expansion, and the reduction trend of knowledge gap scenarios; the quantitative indicators naturally increase with knowledge accumulation, forming a positive incentive, and providing a quantitative decision basis for the system to migrate to a higher degree of reasoning automation.

6. The method according to claim 1, characterized in that, The method described in this invention can be used in conjunction with any secure semantic knowledge base, any inference engine, and any semantic audit log storage system. The introduction of the above external systems does not change the four core technical mechanisms protected by this invention: knowledge gap identification, suggestion generation, manual review and verification, and knowledge release tracking driven by semantic audit logs. The method of this invention is independently established at the level of the above technical mechanisms.

7. A data security knowledge automatic optimization system for implementing the method of claim 1, characterized in that, Includes the following functional modules: Knowledge Gap Identification Module: continuously analyzes semantic audit logs, extracts ternary semantic context features for scenarios requiring manual intervention, retrieves the closest existing reasoning rules, and summarizes knowledge gap reports; Knowledge expansion suggestion generation module: Based on the knowledge gap report, it generates suggested new ontology class definitions and reasoning rules by analogy and pushes them to the review queue; Knowledge audit and verification module: Provides a manual audit interface, performs formal consistency checks and historical log replay verification, supports shadow mode operation, and outputs knowledge extension content that has passed verification; The knowledge release management module writes verified knowledge extensions into the secure semantic knowledge base, triggers cache updates, records source traceability information, and maintains coverage quantification metrics.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images