Cross-border employee behavior compliance real-time supervision method and system based on large language model

Abstract

The application relates to the technical field of large language models, and provides a cross-border employee behavior compliance real-time supervision method and system based on a large language model, which comprises the following steps: performing semantic analysis on the communication content and operation logs of cross-border employees by using a large language model to determine an intention sequence and a behavior sequence; performing time sequence alignment on the intention sequence and the behavior sequence in the same time window; evaluating the matching degree between the intention and the behavior based on the alignment result by using the large language model, and combining historical behavior statistics of the cross-border employee, group behavior statistics and predefined illegal behavior patterns to perform reasoning and determine a behavior qualitative result; and triggering a supervision response for the cross-border employee according to the qualitative result. The application evaluates the matching degree between the aligned intention and the behavior by using the large language model, combines the historical behavior statistics of the employee, the behavior statistics of the group to which the employee belongs and the predefined illegal behavior pattern to qualify the behavior, and realizes real-time and accurate supervision of the behavior compliance.

Description

Technical Field

[0001] This invention relates to the field of large language model technology, and in particular to a method and system for real-time supervision of cross-border employee behavior compliance based on large language models. Background Technology

[0002] Existing methods for supervising cross-border employee conduct compliance primarily rely on traditional Data Loss Prevention (DLP) systems, which alert on abnormal behavior by setting simple thresholds such as download volume and operation frequency. These methods can only analyze operation logs in isolation and cannot correlate employee communication content (such as emails and instant messages) with operational behavior, leading to serious false positives and false negatives.

[0003] Because employee communications often contain implicit behavioral intentions (such as "need to package files to meet deadlines"), and actions are the concrete manifestation of those intentions, when employees perform numerous sensitive operations such as downloading or forwarding files, the system cannot determine whether this behavior is a work error caused by rushing to meet project deadlines or a malicious violation intended to steal information. If the threshold is set too low, a large number of normal errors will trigger alarms, increasing the burden on the security team; if the threshold is set too high, malicious behavior can be hidden. Therefore, simply relying on operation log threshold alarms cannot solve the problem of the disconnect between intention and behavior, and it is difficult to conduct real-time correlation analysis of the communication intentions and operational behaviors of cross-border employees to accurately distinguish between work errors and malicious violations. Summary of the Invention

[0004] Therefore, it is necessary to provide a real-time supervision method and system for cross-border employee behavior compliance based on a large language model to address the technical problem that existing technologies cannot correlate and analyze communication intentions and operational behaviors to accurately distinguish between work errors and malicious violations.

[0005] Firstly, a method for real-time supervision of cross-border employee behavior compliance based on a large language model is provided, comprising: using a large language model to perform semantic parsing on the communication content and operation logs of cross-border employees to determine time-stamped intent sequences and behavior sequences; placing the intent sequences and behavior sequences within the same preset time window for temporal alignment, so that each intent element corresponds to one or more behavior records within the same preset time window, the length of which is preset according to the cross-border employee's position or behavior type; using the large language model to evaluate the degree of matching between intent and behavior based on the alignment results, and combining historical behavior statistics, group behavior statistics, and predefined violation behavior patterns of cross-border employees for reasoning to determine the qualitative result of the behavior; and triggering a supervisory response matching the risk level of the qualitative result based on the qualitative result, wherein the intensity of the supervisory response increases with the increase of the risk level.

[0006] Secondly, a real-time supervision system for cross-border employee behavior compliance based on a large language model is provided. The system includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the aforementioned real-time supervision method for cross-border employee behavior compliance based on a large language model.

[0007] Thirdly, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described method for real-time supervision of cross-border employee behavior compliance based on a large language model.

[0008] Fourthly, a computer-readable storage medium is provided, which stores a computer program that, when executed by a processor, implements the steps of the above-described method for real-time supervision of cross-border employee behavior compliance based on a large language model.

[0009] The real-time supervision method for cross-border employee behavior compliance based on a large language model provided in this application semantically analyzes the communication content and operation logs of cross-border employees to form timestamped intent sequences and behavior sequences. These sequences are then aligned within the same time window, establishing a direct link between communication intent and operational behavior. This overcomes the shortcomings of traditional solutions that isolate operation log analysis and fail to incorporate intent context. Furthermore, a large language model is used to evaluate the matching degree between the aligned intent and behavior. This is combined with the employee's historical behavior statistics, the behavior statistics of their group, and predefined violation patterns for comprehensive reasoning. This allows behavior characterization to move beyond a single threshold and integrate multi-dimensional statistical characteristics of individuals and groups, as well as typical violation scenarios. When the matching degree is high and conforms to normal individual and group behavior patterns, even sensitive operations can be identified as work errors, reducing false alarms. Conversely, when the matching degree is low, deviates from normal statistics, and matches a violation pattern, even if the operation volume does not exceed the threshold, it can be identified as malicious violation, reducing false negatives. Ultimately, differentiated supervisory responses are triggered based on different behavioral qualitative results, solving the technical problem in existing technologies that cannot correlate and analyze communication intent and operational behavior to accurately distinguish between work errors and malicious violations, and realizing real-time and accurate supervision of cross-border employee behavior compliance. Attached Figure Description

[0010] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] in: Figure 1 This is a flowchart of the real-time supervision method for cross-border employee behavior compliance based on a large language model in an embodiment of the present invention; Figure 2 This is a schematic diagram of the modules of the real-time supervision system for cross-border employee behavior compliance based on a large language model in an embodiment of the present invention. Figure 3 This is a structural block diagram of the computer device in an embodiment of the present invention; Figure 4 This is a structural block diagram of a computer device in an embodiment of the present invention. Detailed Implementation

[0012] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0013] Please see Figure 1 As shown, Figure 1 A flowchart illustrating the real-time supervision method for cross-border employee behavior compliance based on a large language model provided in this invention includes the following steps: Step 01: Use a large language model to perform semantic parsing on the communication content and operation logs of cross-border employees to determine the intent sequence and behavior sequence with timestamps; Step 02: Place the intent sequence and behavior sequence within the same preset time window for temporal alignment, so that each intent element corresponds to one or more behavior records within the same preset time window. The length of the time window is preset according to the cross-border employee's position or behavior type. Step 03: Utilize the large language model to assess the degree of matching between intent and behavior based on the alignment results, and combine historical behavior statistics of cross-border employees, group behavior statistics, and predefined violation behavior patterns to infer and determine the qualitative results of the behavior; Step 04: Based on the qualitative results, trigger a supervisory response that matches the risk level of the qualitative results. The intensity of the supervisory response increases as the risk level increases.

[0014] Specifically, in step 01, the communication content can be email text, instant messaging chat logs, or meeting minutes, and the operation log can be file download records, print records, peripheral device copy records, or system access records. Large Language Models (LLMs) refer to artificial intelligence models trained on massive amounts of text that can understand and generate natural language. This system uses lightweight large language models (such as DistilBERT, TinyLLaMA, etc.) and performs quantization and GPU acceleration on the models. Simultaneously, it employs streaming processing and sliding window techniques to control the single inference latency to within 500 milliseconds to meet real-time supervision requirements.

[0015] An intent sequence is a collection of timestamped intent information arranged chronologically. Each intent message contains the action's purpose, the target audience, the recipient, the time requirement, and the emotional tone extracted from the communication text. A behavior sequence is a collection of timestamped operation records arranged chronologically, with each operation record corresponding to a specific terminal or network behavior.

[0016] In step 01, the large language model performs multilingual semantic understanding on the collected communication content, extracts the intent elements corresponding to each communication segment, generates a timestamp, and sorts the intent elements by time to form an intent sequence; at the same time, it generates an anomaly description and deviation score for each behavior in the operation log to form a behavior sequence with timestamps.

[0017] In step 02, the time window refers to the same continuous time range selected when comparing the intent sequence and the behavior sequence. The intent sequence and behavior sequence are time-aligned within the same preset time window. The purpose of time alignment is to establish a correspondence between each intent element and the behavior record within the same time interval. The length of the time window is preset based on the risk level or behavior type of the cross-border employee's position. For example, a shorter window is used for high-risk positions or sensitive operations, while a longer window is used for ordinary positions or routine operations. This adjustable window design allows the method to adapt to different work rhythms and business scenarios, avoiding the erroneous association of coincidental but unrelated behaviors, while ensuring that reasonable intent-behavior matches are not missed due to an overly narrow window. Through time alignment, accurate structured input is provided for subsequent matching degree calculations and violation characterization.

[0018] In step 03, historical behavior statistics refer to the statistical quantities obtained by summarizing the distribution of communication intentions, operation frequency, operation time patterns and the sensitivity level of the data involved in the past period of the cross-border employee; group behavior statistics refer to the average and standard deviation of the above statistical quantities of all employees in the same department or group of the employee in the same historical period; predefined violation behavior patterns refer to the combination of typical insider threat behavior characteristics set in advance.

[0019] In step 03, the large language model calculates the degree of matching between each group of intents and behaviors after alignment, and then compares the degree of matching with the employee's historical behavior statistics and group behavior statistics. At the same time, it detects whether the behavior sequence matches the predefined violation behavior pattern, and comprehensively determines the behavior qualitative result.

[0020] In step 04, the qualitative result can include work error, low-risk anomaly, or malicious violation. Supervisory response refers to the different actions taken based on different qualitative results, such as sending notifications to relevant parties, adjusting operational permissions, or initiating an investigation process. The triggering of a supervisory response is based on the automatic execution of rules or model outputs, requiring no manual intervention.

[0021] In step 04, for situations deemed normal work tasks or work errors, a low-intensity response is executed, such as logging or sending a notification; for situations deemed malicious violations, a high-intensity response is executed, such as suspending the session, freezing the account, or issuing an alert. All responses are targeted at the cross-border employee and their relevant operational permissions, ensuring the real-time nature and relevance of compliance supervision.

[0022] Qualitative results are categorized into different risk levels; for example, work errors correspond to a low-risk level, low-risk anomalies to a medium-risk level, and malicious violations to a high-risk level. Supervisory response refers to the actions triggered based on the risk level, with different levels corresponding to different handling methods. The matching relationship between risk level and supervisory response is pre-defined, ensuring that the actions accurately reflect the severity of the behavior. The intensity of the supervisory response increases with the risk level. At a low-risk level, the response intensity is lowest, only logging or sending a notification message to the employee. At a medium-risk level, the response intensity increases, sending a warning to the security administrator and requesting manual review. At a high-risk level, the response intensity is highest, automatically blocking ongoing operations, freezing employee accounts, and sending an alarm to the security operations center. This incremental design ensures that low-risk situations do not interfere with normal work, and that high-risk situations can be mitigated promptly.

[0023] The beneficial effects of this implementation method are as follows: The above steps transform unstructured communication text and operation logs into structured time-series sequences, providing a data foundation for subsequent correlation analysis. Aligning intent sequences and behavior sequences within the same time window establishes a direct correspondence between communication content and operation records, solving the problem of traditional methods failing to incorporate intent context when analyzing operation logs in isolation. Combining the matching degree with individual historical behavior statistics, group behavior statistics, and predefined violation patterns through multi-dimensional reasoning ensures that behavior characterization does not rely on a single threshold: when the matching degree is high and the behavior conforms to normal individual and group patterns, even if the operation involves sensitive data, it can be judged as a work error, avoiding a large number of false alarms; when the matching degree is low, the behavior deviates from individual and group statistical characteristics, and hits a predefined violation pattern, even if the operation volume does not reach the alarm threshold of traditional systems, it can be identified as malicious violation, avoiding missed alarms. Triggering tiered supervisory responses based on the qualitative results through these steps achieves real-time and accurate supervision of cross-border employee behavior compliance.

[0024] Figure 2 This is a schematic diagram of the modules of a real-time supervision system for cross-border employee behavior compliance based on a large language model, as described in this embodiment of the invention. The system includes an acquisition module, a large language model parsing module, and a supervision output module. The acquisition module is configured to collect the communication content and operation logs of cross-border employees in real time. The large language model parsing module is configured to align intent sequences and behavior sequences within the same preset time window, establishing a correspondence between each intent element and one or more behavior records within the same preset time window. The length of the time window is preset based on the cross-border employee's position or behavior type. The large language model is used to assess the degree of matching between intent and behavior based on the alignment results, and inferences are made by combining historical behavior statistics of cross-border employees, group behavior statistics, and predefined violation behavior patterns to determine the qualitative result of the behavior. The supervision output module is configured to trigger a supervision response matching the risk level of the qualitative result, with the intensity of the supervision response increasing as the risk level increases.

[0025] In some embodiments, step 01 above includes: Real-time collection of communication content and operation logs of cross-border employees; We utilize large language models to perform multilingual semantic understanding of communication content in order to extract five-tuples of intent related to work behavior; Store each intent quintuple along with a timestamp and employee identifier into the intent sequence; A large language model is used to generate anomaly descriptions and deviation scores for each behavior in the operation log, forming a behavior sequence with timestamps.

[0026] Specifically, real-time data collection refers to the continuous acquisition of digital traces generated by employees during cross-border work, with a collection latency of less than one second.

[0027] Communication content can include emails retrieved from a corporate email server, chat logs retrieved from an instant messaging platform (e.g., "corporate communication software A"), and meeting minutes transcribed from meeting recordings. Operation logs can include file download records (including filenames and paths), print records (including the number of pages printed), peripheral device copy records (e.g., copying to a universal serial bus device), cloud disk synchronization records (e.g., uploading to "cloud storage platform B"), and system access records (e.g., logging into a virtual private network or customer relationship management system).

[0028] Multilingual semantic understanding refers to the ability of a large language model to process text in multiple languages ​​and identify work-related elements such as actions, objects, and recipients. The intent quintuple refers to five core elements extracted from communication text: action intent (e.g., send, retrieve, delete, modify, copy), target object (e.g., technical documents, customer data, source code, financial reports), recipient (e.g., internal personnel, external personnel, public channels), time urgency (e.g., immediate, recent, specified date, no specific deadline), and sentiment polarity (e.g., positive, negative, neutral). A timestamp refers to the precise moment the behavior or intent occurred, accurate to the second or millisecond. An employee identifier is a unique account, employee number, or hash value that identifies the employee. Anomaly description is a textual explanation from the large language model for behavior that deviates from the normal pattern, such as "copying encrypted directory files via a Universal Serial Bus device outside of working hours." Deviation score is a numerical score given by the large language model, between 0 and 1, indicating the degree of difference between the behavior and the employee's historical behavior or group behavior.

[0029] The large language model first performs multilingual word segmentation and semantic parsing on each text in the communication content, identifying the action intent, target object, receiver, time urgency, and sentiment polarity, and combining them into an intent quintuple. For example, from a message "I am sending project documents to an external partner," the model extracts (action intent = send, target object = project documents, receiver = external personnel, time urgency = recent, sentiment polarity = neutral); from another message "Please back up the source code to the specified server within three days," the model extracts (action intent = backup, target object = source code, receiver = internal server, time urgency = specified date, sentiment polarity = neutral).

[0030] Each intent quintuple is appended with a timestamp of the current system time and a unique identifier for the employee (e.g., employee ID), and then appended to the intent sequence chronologically. Simultaneously, the large language model analyzes each operation log: for a record of "downloading multiple technical documents at once," the model combines the context (e.g., time, file type, target path) to generate an anomaly description "downloading a large number of technical documents in batches without urgent work instructions," and calculates a deviation score, such as 0.85 (indicating a high deviation from the baseline). These behavior records are also timestamped and employee-identified, and stored sequentially in the behavior sequence. The intent sequence and behavior sequence are stored independently but can be correlated through timestamps and identifiers.

[0031] The beneficial effects of this implementation method are as follows: Real-time collection of communication content and operation logs ensures timely supervision, enabling subsequent analysis to be based on the latest employee behavior data. Multilingual semantic understanding through a large language model can handle common multilingual communications in overseas industrial scenarios, avoiding missed or incorrect intent sampling due to language barriers. By extracting structured intent quintuples, unstructured natural language is transformed into computable feature vectors, facilitating subsequent matching with behavior sequences. By generating anomaly descriptions and deviation scores for each behavior, the degree of suspicion of the behavior is quantified, providing a numerical basis for intent-behavior association determination. The resulting timestamped intent and behavior sequences provide an ordered and traceable data foundation for temporal alignment and multi-dimensional reasoning.

[0032] In some implementations, a large language model is used to perform multilingual semantic understanding of the communication content to extract a five-tuple of intent related to work behavior, including: Identify action intent from the text of the communication content; Identify the target object, receiver, time urgency, and emotional polarity of the action intention.

[0033] Specifically, the large language model receives a piece of communication text (such as an instant message or the body of an email). The model first converts each word in the text into a vector representation through an embedding layer. Then, it uses a self-attention mechanism to capture the dependencies between words and identify the core words representing actions in the sentence. For example, for the text "Please export last quarter's sales data and send it to the audit team," the model parses the verbs "export" and "send" to identify the action intentions as "get data" and "send data." Next, the model uses dependency parsing to find the noun phrases that represent the action intentions: "sales data" as the target object and "audit team" as the receiver.

[0034] The model further retrieves time-related words from the text, such as "last quarter" or "immediately," to determine the time urgency as "recent" or "immediately." For sentiment polarity, the model uses a pre-trained sentiment classification head to comprehensively judge the overall sentiment tendency of the sentence; this example sentence is neutral. Finally, the model outputs structured data: {Action Intent: "Send," Target Object: "Sales Data," Recipient: "Audit Team," Time Urgency: "Recent," Sentiment Polarity: "Neutral"}.

[0035] In some embodiments, step 02 above includes: Centered on the timestamp of each intention quintuple, extend forward and backward by a preset time window length to form the target time window; Find one or more behavioral records that are semantically associated with the intent quintuple within the target time window; If a behavior record falls within the target time window of at least one intention quintuple, the behavior record and the intention quintuple will be associated as the same analysis unit. If a behavior record is not associated with any intention quintuple, the behavior record is treated as a behavior unit without intention interpretation.

[0036] Specifically, the intent quintuple is structured intent information extracted from the communication content, and its timestamp records the precise moment the communication occurred. The preset time window length refers to a time range pre-set by the system, such as five minutes, ten minutes, or thirty minutes. This length can be adjusted according to the employee's job risk level, departmental work rhythm, or historical data statistics.

[0037] The target time window is a continuous time period centered on the timestamp of the intent quintuple, extending forward and backward by a preset length. For example, if the timestamp is 10:00 AM and the window length is five minutes before and after, then the target time window is from 9:55 AM to 10:05 AM. A behavior record refers to a single record in the operation log, and each behavior record also has a timestamp.

[0038] Semantic relevance refers to the semantic match between the content of a behavior record (e.g., the object of a file operation, the type of action) and the elements in the intent quintuple, such as the action intent and the target object. For example, if the intent is "send a document" and the behavior record is "send an attachment to an external email address," then the two are semantically related; if the behavior record is "print a blank page," then there is no relevance. An analysis unit is a data block formed by binding related intents and behaviors together, used for subsequent matching degree evaluation. A behavior unit without intent interpretation refers to a behavior record for which no intent could be found to associate with it; this behavior record is processed as a separate unit in subsequent steps.

[0039] For each intent quintuple in the intent sequence, its timestamp is read (denoted as the first moment). The first moment is subtracted from the preset time window length to obtain the start time, and the first moment is added to the preset time window length to obtain the end time, thus forming a target time window. For example, if the preset window length is ten minutes before and after, and the timestamp of the intent quintuple is 2:00 PM, then the target time window is from 1:50 PM to 2:10 PM.

[0040] The behavioral sequence is then scanned to identify all behavioral records whose timestamps fall within the target time window. For these candidate behavioral records, their semantic relevance to the current intent quintuple is further determined. This semantic relevance assessment is performed by the large language model: the model receives the action intent and target object from the intent quintuple, and the operation type and operation object from the behavioral record, outputting a similarity score. If the score is higher than a preset threshold (e.g., 0.7), the record is considered semantically related. For example, if the intent quintuple is {Action Intent: "Send", Target Object: "Quotation", Recipient: "Customer"}, and the behavioral record is "Send the file 'Quotation_Third Edition' via email to 'X@example.com'", the model determines that the two are semantically related, with a similarity score of 0.92.

[0041] When a behavior record's time window covers multiple intent quintuples simultaneously (e.g., the time windows of two intent quintuples overlap, and the behavior record falls within the overlapping area), the behavior record is associated with all intent quintuples that satisfy the window conditions and semantic association. If a behavior record falls within the target time window but is semantically unrelated to the current intent quintuple, no association is established, and other intent quintuples are checked.

[0042] For successfully associated behavior records, they are packaged with their corresponding intent quintuples into an analysis unit, which contains intent information, behavior information, and the association identifier between the two. If a behavior record fails to establish an association with any intent quintuple after all the above checks, the behavior record is marked as a "behavior unit without intent interpretation," stored separately, and participates in subsequent matching degree evaluation (in this case, its matching degree score is set to extremely low or zero by default).

[0043] In a specific implementation, a sliding window mechanism can be set up to process each intent quintuple sequentially in chronological order, avoiding repeated scanning of the entire behavior sequence and improving processing efficiency. Simultaneously, multiple intent quintuples can be processed in parallel to support real-time supervision of large-scale employee teams.

[0044] In some embodiments, step 03 above includes: For a set of aligned intent sequences and behavior sequences, the large language model calculates the matching degree score between the two and outputs the probability value of misoperation and the probability value of malice. When the matching score is higher than the first threshold and the probability of misoperation is higher than the probability of malicious operation, it is judged as a work error; When the matching score is lower than the second threshold, the malicious probability value is higher than the misoperation probability value, and the behavior sequence deviates from the employee's historical behavior statistics or group behavior statistics, it is judged as a low-risk anomaly. When a sequence of behaviors matches a predefined pattern of violations, it is determined to be a malicious violation.

[0045] Specifically, the matching score refers to the quantitative score given by the large language model for the semantic consistency between a set of aligned intentions and behaviors, for example, between 0 and 1, with higher values ​​indicating a better match between intention and behavior. The error probability value refers to the likelihood that the set of behaviors will be judged as unintentional employee negligence, while the malicious probability value refers to the likelihood that it will be judged as intentional violation. The first threshold and the second threshold are two pre-set numerical limits. The first threshold is used to determine whether the matching degree is high enough (e.g., 0.8), and the second threshold is used to determine whether the matching degree is low enough (e.g., 0.3).

[0046] Historical behavior statistics refer to the summary statistics of an employee's communication intent distribution, operation frequency, operation time patterns, and the sensitivity level of the data involved over a past period (such as six months); group behavior statistics refer to the average and standard deviation of the above statistics for the employee's department or group of employees in the same historical period.

[0047] Deviation refers to the difference between the statistical characteristics of the current behavior sequence (such as operation time, frequency, and object sensitivity) and historical behavior statistics or group behavior statistics exceeding the preset tolerance range. Predefined violation behavior patterns refer to a combination of typical insider threat behavior characteristics set in advance, such as downloading documents in bulk before leaving the company, encrypting and packaging documents for external distribution during non-working hours, and accessing core information after contacting external competitors.

[0048] The large language model vectorizes the intent sequence and behavior sequence separately, and then calculates the cosine similarity or dot product between the two vectors as the matching score. Simultaneously, the model outputs the probability of erroneous operation and the probability of malicious operation based on the following information: the matching score, the degree of deviation from the individual employee's historical behavior statistics, the degree of deviation from the group's behavior statistics, and the matching status of the behavior sequence with predefined violation behavior patterns.

[0049] Large language models extract feature values ​​in four dimensions: 1: The matching score between the aligned intent and behavior, denoted as M, with a value range of [0,1].

[0050] Specifically, the intent text and behavior field are converted into vector representations, and then the cosine similarity or dot product between these two vectors is calculated. The result is then mapped to the [0,1] interval using a sigmoid function to obtain a matching score M. The closer M is to 1, the more semantically consistent the intent and behavior are; the closer it is to 0, the less consistent they are. For example, if the intent is "send a quotation to the customer" and the behavior record is "send an attachment to client@example.com via email", the vector similarity between the two is high, and the M output is 0.92.

[0051] 2: The deviation of the current behavior sequence from the employee's personal historical behavior statistics, denoted as D_ind, with a value range of [0,1]; The large language model pre-stores historical behavioral statistics for the employee over a predetermined time period (e.g., six months), including the mean μ_freq and standard deviation σ_freq of operation frequency, the mean μ_time and standard deviation σ_time of operation time distribution (percentage of operations during working hours), and the mean μ_sens and standard deviation σ_sens of sensitivity level of the operation object. For the current behavior sequence, the model calculates its corresponding provisional statistics: operation frequency f_cur, proportion of operations during non-working hours t_cur, and proportion of sensitive operations s_cur. Then, the Z-score for each dimension is calculated: Z_freq = |f_cur - μ_freq| / σ_freq, Z_time = |t_cur - μ_time| / σ_time, Z_sens = |s_cur - μ_sens| / σ_sens. Finally, these three Z-scores are weighted and averaged (weights can be preset, such as 1 / 3 each) and mapped to the [0,1] interval through a saturation function (e.g., 1 - e^{-Z}), resulting in D_ind. The larger the value of D_ind, the more the current behavior deviates from the individual's historical pattern.

[0052] 3: The deviation of the current behavior sequence from the behavior statistics of the department or group of employees, denoted as D_grp, with a value range of [0,1]. Group behavior statistics include statistics for the employee's department or all employees in the same group: the frequency mean μ_freq_grp and standard deviation σ_freq_grp, the time distribution mean μ_time_grp and standard deviation σ_time_grp, and the sensitivity mean μ_sens_grp and standard deviation σ_sens_grp. Similarly, the large language model calculates f_cur, t_cur, and s_cur for the current behavior sequence and calculates the Z-score relative to the group statistics: Z_freq_grp = |f_cur - μ_freq_grp| / σ_freq_grp, Z_time_grp = |t_cur - μ_time_grp| / σ_time_grp, Z_sens_grp = |s_cur - μ_sens_grp| / σ_sens_grp. These Z-scores are weighted, averaged, and mapped to the [0,1] interval to obtain D_grp. If the group standard deviation is zero, then D_grp is set to 0.5 or processed according to preset rules.

[0053] 4: Whether the predefined violation pattern was hit, denoted as H, with a value of 0 (miss) or 1 (hit).

[0054] The large language model internally stores several rules for violation behavior patterns, each represented as a feature vector. For example, the feature vector for the "pre-departure data accumulation pattern" is [departure sensitive period identifier = 1, batch download identifier = 1, external sensitive data identifier = 1]; the feature vector for the "pre-competition preparation pattern" is [headhunter keyword appearance = 1, core data access identifier = 1]. For the current behavior sequence, the model first extracts its corresponding feature vector, including: whether the employee is in the departure process (through the human resources system interface or communication keywords), whether the behavior sequence contains batch downloads (the number of downloads exceeds a set threshold), whether it is encrypted and packaged, whether it is externally sent to a non-company domain, whether there is an attempt to escalate privileges, etc. Then, the feature vector is multiplied by the rule vector of each violation pattern or the Hamming distance is calculated. If the similarity with any rule vector exceeds a preset matching threshold (e.g., 0.8), it is considered a match, H = 1; otherwise, H = 0.

[0055] The large language model concatenates the four feature values ​​into a four-dimensional vector [M, D_ind, D_grp, H]. This vector is mapped to two raw scores (logits) through a linear transformation layer (fully connected layer), corresponding to the "work error" and "malicious violation" classes, respectively. Then, the Softmax function is used to transform the two raw scores into probability distributions: P_mistake = exp(z_mistake) / (exp(z_mistake) + exp(z_malicious)) P_malicious = exp(z_malicious) / (exp(z_mistake) + exp(z_malicious)) Here, P_mistake is the probability of a mistake, and P_malicious is the probability of malicious intent; the sum of the two is 1. The large language model directly outputs these two probability values.

[0056] If the matching score is higher than the first threshold (e.g., 0.85) and the probability of misoperation is greater than the probability of malicious operation, it indicates that the intent and behavior are highly consistent, and the model considers the possibility of error to be higher, thus classifying it as a work mistake. For example, if an employee explicitly states "backup the database" in a communication, and the operation log also shows that the backup command was executed, the model will output a high matching score and a high probability of misoperation based on this.

[0057] If the matching score is below the second threshold (e.g., 0.25), and the probability of malicious operation is greater than the probability of accidental operation, while the statistical characteristics of the behavior sequence (e.g., the operation time is late at night, the operation object is sensitive data) significantly deviate from the employee's own historical behavior or the general behavior pattern of employees in the same group, then it is judged as a low-risk anomaly. In this case, the intent and behavior are disconnected, but a clear violation script has not yet been matched.

[0058] Regardless of the matching score, if the characteristics of the behavioral sequence match any predefined violation pattern (e.g., uploading encrypted files to a personal cloud drive for several consecutive days outside of work hours), it is directly judged as a malicious violation. This judgment logic does not rely on thresholds but is based on the result of pattern matching. The above three judgment conditions are checked in sequence. If multiple conditions are met simultaneously, the condition that is hit first takes precedence (e.g., first check whether it matches the violation pattern, then check whether it is a work error or a low-risk anomaly).

[0059] In some implementations, predefined violation patterns include: pre-departure data accumulation pattern, pre-competition preparation pattern, batch encrypted external transmission pattern during non-working hours, and data theft pattern that bypasses access controls.

[0060] Specifically, pre-departure data accumulation patterns may include: employees downloading a large number of non-work-related files, copying them to mobile storage devices, and uploading them to personal cloud drives within a period of time before their departure (e.g., two weeks), and the communication content lacks reasonable project handover instructions.

[0061] Pre-competition preparation mode may include: after employees come into contact with external competitors (such as receiving a headhunter's contact or participating in a competitor's interview), they perform sensitive operations such as accessing the company's core intellectual property and exporting customer data in batches, and the communication content implies the intention to switch jobs or leak secrets.

[0062] The non-working-hour batch encryption and outgoing mode can include: compressing and encrypting a large number of files and sending them to external recipients via personal email, instant messaging tools or external cloud storage during non-working hours (such as late at night or weekends), and the communication content lacks any explanation of overtime or urgent tasks.

[0063] Data theft patterns that bypass access controls can include: employees attempting or successfully bypassing permission restrictions (such as using someone else's account, disabling security software, or accessing the database through unauthorized interfaces) to obtain data they are not authorized to access, accompanied by abnormal system access log records.

[0064] The large language model transforms the sequence of behaviors to be evaluated into feature vectors, including dimensions such as operation time, operation type, target object sensitivity, whether the file is encrypted, whether the transmission target is an external address, and whether privilege escalation is involved. The model then matches and calculates these features against each predefined violation pattern.

[0065] For the pre-departure data accumulation model, the model checks whether the employee is in a sensitive period for leaving the company (judged by keywords such as "resignation" and "handover" appearing in the human resources system status or communications). At the same time, it checks whether the behavior sequence contains features such as batch downloading and frequent copying to universal serial bus devices. If both are met, it is determined that the data has been hit.

[0066] For the pre-competition preparation mode, the model scans the communication content for words related to headhunters, interviews, and competitors, and combines this with the behavior sequence to see if there are operations such as accessing the core document library or exporting customer lists. If there is an implicit intention to switch jobs and access to sensitive data, the model is considered to have hit the target. For the non-working-hour batch encrypted outbound sending mode, the model determines whether the operation time is outside the company's defined normal working hours, and whether the behavior sequence includes calls to compression software, encryption operations, or outbound sending to email addresses or cloud storage outside the company's domain. If the conditions are met, the model is considered to have hit the target.

[0067] For data theft patterns that bypass access controls, the model checks the operation logs for events such as failed privilege escalation records, login using other people's accounts, access to unauthorized directories, and triggering security software alerts. Once any predefined violation pattern is matched, regardless of the matching score, it is determined to be a malicious violation, without needing to check other conditions.

[0068] In some embodiments, step 04 above includes: If the assessment result is a work error, a compliance reminder message will be sent to the cross-border employee, and a notice of concern will be sent to the cross-border employee's direct supervisor. If the qualitative result is a low-risk anomaly, an alert is sent to the security administrator. The alert includes a description of the abnormal behavior and a preliminary interpretation generated by the large language model. If the determination result is malicious violation, the system will automatically block the operations being performed by the cross-border employee, freeze the cross-border employee's account, and send an alert to the security operations center.

[0069] Specifically, if the assessment indicates a work error, the method automatically generates a compliance alert message, which is sent to the employee via corporate email or instant messaging. The message body specifies the action that triggered the alert, the time, and compliance recommendations, such as, "You performed a batch document download operation at 10 PM tonight. Please confirm whether it was necessary for a project deadline. If it is not an urgent task, we suggest using a batch download method instead." Simultaneously, a notification is sent to the employee's direct supervisor, containing only the employee's name, a summary of the operation, and suggested points of attention; this does not escalate to a security incident.

[0070] If the qualitative result indicates a low-risk anomaly, the method sends an alert to the security administrator. This alert consists of two parts: the first part is a structured description of the abnormal behavior, such as "Employee A downloaded 50 technical documents late at night on June 11, 2026"; the second part is a preliminary interpretation generated by the large language model, such as "This employee has not mentioned relevant project requirements in recent communications, and this behavior deviates from their personal historical operating pattern, but no violation scripts were found, so manual review is recommended."

[0071] If the qualitative assessment indicates a malicious violation, the method immediately executes an automatic blocking operation, canceling all currently executing file read / write, network transmission, or permission change commands. The employee's account is then frozen, preventing any new logins or operations. Finally, an alert is sent to the Security Operations Center, including the event level (high), employee identifier, operation summary, and the location of the pre-generated full evidence chain storage, prompting the Security Operations Center to initiate an investigation. These three response methods are mutually exclusive; only one response corresponding to the qualitative assessment is triggered at a time, and the execution order of different responses is based on priority.

[0072] In some implementations, the method further includes: Based on the large language model, an evidence chain is generated by taking the original communication text that generates the intent analysis, the extracted intent quintuple, the corresponding operation log records and anomaly descriptions, and the judgment criteria of the large language model. The judgment criteria include the matching degree score, the historical behavior statistical deviation, the group behavior statistical deviation, and the hit violation behavior pattern. Use the chain of evidence as initial material for internal investigations or cross-border legal action.

[0073] Specifically, the chain of evidence refers to a set of interconnected and traceable digital materials used to prove the entire process of an employee's behavior, from communication intent to actual action, and the basis for determining violation. The original communication text refers to the original content of the email body, instant messaging chat log, or meeting minutes that triggered the supervisory response, without any modification. The intent quintuple is a structured set of elements extracted from the communication text, including the action intent, target object, recipient, time urgency, and emotional polarity. The operation log records refer to employee actions aligned with the intent within the time window, such as downloading files, printing, copying peripherals, and accessing systems.

[0074] Anomaly descriptions refer to the textual explanations by which the large language model indicates that the operational behavior deviates from the normal pattern. The judgment criteria include four aspects: matching score (a quantitative score of semantic consistency between intent and behavior), historical behavior statistical deviation (the degree of difference between the current behavior and the employee's past behavior statistics), group behavior statistical deviation (the degree of difference between the current behavior and the behavior statistics of employees in the same group), and the detected violation behavior pattern (e.g., the data accumulation pattern before departure). Internal investigation refers to the internal review conducted by the company on suspected violations. Cross-border legal accountability refers to the process of pursuing the responsibility of employees for data breaches or other violations committed across jurisdictions, in accordance with relevant laws and regulations.

[0075] For example, if the original communication content is "I will send the database backup to my personal email," the model extracts the intent quintuple as (action intent = send, target object = database backup, recipient = external personal email, time urgency = immediate, sentiment polarity = neutral). Then, it retrieves operation log records aligned with this intent, such as "Within one minute of sending the message, the employee sent an attachment named 'backup.sql' to an external domain address via the company email," and simultaneously retrieves pre-generated exception descriptions, such as "This behavior occurred outside of working hours, and the employee has never sent an external database backup before." Next, the model collects judgment criteria: matching degree score (e.g., 0.92, indicating a high degree of consistency between intent and behavior), historical behavior statistical deviation (e.g., 0.85, indicating a significant deviation from the individual baseline), group behavior statistical deviation (e.g., 0.78, indicating a deviation from the behavior of colleagues in the same group), and the detected violation behavior pattern (e.g., "pre-competition preparation pattern," because the term "headhunter" appeared in the communication). The model organizes all the above information into a structured document according to chronological order and logical relationships, adding a timestamp and employee identifier.

[0076] In some implementations, the historical behavior statistics of cross-border employees include: the distribution of cross-border employees' communication intentions, operation frequency, operation time distribution, and sensitivity distribution of the operation objects within a preset time period.

[0077] Group behavior statistics include the average and standard deviation of the communication intent distribution, operation frequency, operation time distribution, and sensitivity distribution of the operation objects of cross-border employees within the same preset time period.

[0078] Specifically, the communication intent distribution is the proportion of each type of action intent in the five-tuple of all employee intents. Action intents include types such as sending, retrieving, deleting, modifying, and copying, and the distribution ratio is expressed as a percentage. For example, sending intents account for 30%, and retrieving intents account for 50%.

[0079] Operation frequency refers to the average number of times an employee performs various operations per unit of time. This unit of time can be daily or weekly, and operations include file downloading, printing, peripheral device copying, and system access. Operation time distribution refers to the statistical proportion of operations performed by employees in different time periods, including working hours, non-working hours, and weekends. Working hours are typically from 9:00 AM to 6:00 PM, and non-working hours are from 6:00 PM to 9:00 AM the following morning. Sensitivity distribution of the accessed object refers to the frequency statistics of the sensitivity levels of the documents or data accessed by employees, categorized from low to high as public, internal, confidential, and top secret. Group behavior statistics refer to the aggregated results of the above four statistics for all employees in the employee's department or group within the same preset time period. The mean is the arithmetic mean of the corresponding statistics for all individuals in the group. The standard deviation is the dispersion of individual statistics within the group relative to the mean, reflecting the differences in behavior within the group.

[0080] The model first calculates provisional statistics, including the frequency of the current operation, the distribution of operation time, the distribution of sensitivity of the operation object, and the distribution of communication intent. The model compares the current operation frequency with the operation frequency in historical behavior statistics; if the current value exceeds the historical average plus twice the historical standard deviation, it is considered a deviation from individual historical behavior. The model also compares the current operation frequency with the average and standard deviation in group behavior statistics; if the current value is higher than the group average plus one group standard deviation, it is considered a deviation from group behavior. Regarding the operation time distribution, the model checks whether the current proportion of operations during non-working hours is significantly higher than the historical proportion during non-working hours and the group average proportion during non-working hours.

[0081] For example, if the historical proportion of non-working periods is 10%, while the current sequence shows a proportion of 50%, it is considered a deviation. Regarding the sensitivity distribution of the accessed object, if the historical proportion of access to confidential documents is 5%, and this proportion rises to 30% in the current sequence, with a group mean of 8% and a standard deviation of 3%, it is considered a deviation. For the communication intent distribution, the model compares the proportion of each action intent in the current intent sequence with the historical proportion and the group mean proportion. The degree of deviation is quantified as a deviation score, ranging from zero to one, with higher scores indicating more severe deviation.

[0082] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 3 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile and / or volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The network interface is used to communicate with external clients via a network connection. When the computer program is executed by the processor, it implements server-side functions or steps of a real-time supervision method for cross-border employee behavior compliance based on a large language model.

[0083] In one embodiment, a computer device is provided, which may be a client, and its internal structure diagram may be as follows: Figure 4 As shown, the computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The network interface is used to communicate with an external server via a network connection. When executed by the processor, the computer program implements client-side functions or steps of a real-time supervision method for cross-border employee behavior compliance based on a large language model.

[0084] It should be noted that the functions or steps that can be implemented by the computer-readable storage medium or computer device described above can be referred to the relevant descriptions on the server side and client side in the foregoing method embodiments. To avoid repetition, they will not be described one by one here.

[0085] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0086] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0087] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A method for real-time supervision of cross-border employee behavioral compliance based on a large language model, characterized in that, Includes the following steps: We use a large language model to perform semantic analysis on the communication content and operation logs of cross-border employees to determine the intent sequence and behavior sequence with timestamps. The intent sequence and the behavior sequence are placed in the same preset time window for temporal alignment, so that each intent element is associated with one or more behavior records in the same preset time window. The length of the time window is preset according to the cross-border employee's job position or behavior type. The large language model is used to assess the degree of matching between intent and behavior based on the alignment results, and combined with the historical behavior statistics of cross-border employees, group behavior statistics and predefined violation behavior patterns to infer the qualitative results of the behavior. Based on the qualitative results, a supervisory response is triggered that matches the risk level of the qualitative results, and the intensity of the supervisory response increases as the risk level increases. Specifically, the method of using a large language model to assess the degree of matching between intent and behavior based on alignment results, and combining historical behavior statistics of cross-border employees, group behavior statistics, and predefined violation behavior patterns for inference to determine the qualitative result of the behavior, includes: For the aligned set of intent sequences and behavior sequences, the matching score between them is calculated by the large language model; The large language model extracts the first deviation of the current behavior sequence relative to the employee's personal historical behavior statistics, the second deviation relative to the group behavior statistics, and the hit flag indicating whether it hits a predefined violation behavior pattern. The matching score, the first deviation, the second deviation, and the hit mark are concatenated into a feature vector, which is then mapped to a work error class and a malicious violation class through a linear transformation layer to determine the probability values ​​of misoperation and malice. When the matching score is lower than the second threshold, the malicious probability value is higher than the misoperation probability value, and the behavior sequence deviates from the employee's historical behavior statistics or group behavior statistics, it is determined to be a low-risk anomaly.

2. The method for real-time supervision of cross-border employee behavior compliance based on a large language model according to claim 1, characterized in that, The step of using a large language model to perform semantic parsing on the communication content and operation logs of cross-border employees to determine timestamped intent sequences and behavior sequences includes: Real-time collection of communication content and operation logs of cross-border employees; The communication content is subjected to multilingual semantic understanding using a large language model in order to extract a five-tuple of intent related to work behavior. The five-tuple of intent includes action intent, target object, receiver, time urgency and emotional polarity extracted from the communication content. Each of the intent quintuples, along with a timestamp and employee identifier, is stored in the intent sequence; An anomaly description and deviation score are generated for each behavior in the operation log using a large language model, forming a sequence of behaviors with timestamps.

3. The method for real-time supervision of cross-border employee behavior compliance based on a large language model according to claim 2, characterized in that, The process of using a large language model to perform multilingual semantic understanding on the communication content to extract intent quintuples related to work behavior includes: Identify the intent of the action from the text of the communication content; Identify the target object, receiver, time urgency, and emotional polarity of the action intention.

4. The method for real-time supervision of cross-border employee behavior compliance based on a large language model according to claim 2, characterized in that, The method further includes: when the behavior sequence matches a predefined violation behavior pattern, it is determined to be a malicious violation; The predefined violation patterns include: pre-departure data accumulation pattern, pre-competition preparation pattern, batch encrypted external transmission pattern during non-working hours, and data theft pattern that bypasses access control. The pre-competition preparation model includes: after employees contact external competitors, they engage in sensitive operations such as accessing the company's core intellectual property and exporting customer data in batches, and the communication content implies the intention to switch jobs or leak secrets.

5. The method for real-time supervision of cross-border employee behavior compliance based on a large language model according to claim 4, characterized in that, The step of triggering a supervisory response matching the risk level of the qualitative result, wherein the intensity of the supervisory response increases with the risk level, includes: If the qualitative result indicates a work error, a compliance reminder message will be sent to the cross-border employee, and a notice of concern will be sent to the cross-border employee's direct supervisor. If the qualitative result is a low-risk anomaly, a warning message is sent to the security administrator. The warning message includes a description of the abnormal behavior and a preliminary interpretation generated by the large language model. If the qualitative result indicates malicious violation, the system will automatically block the operations being performed by the cross-border employee, freeze the cross-border employee's account, and send an alert to the security operations center.

6. The method for real-time supervision of cross-border employee behavior compliance based on a large language model according to claim 5, characterized in that, The method further includes: Based on the large language model, an evidence chain is generated according to the original communication text that generates the intent analysis, the extracted intent quintuple, the corresponding operation log records and anomaly descriptions, and the judgment criteria of the large language model. The judgment criteria include the matching degree score, the historical behavior statistical deviation, the group behavior statistical deviation, and the hit violation behavior pattern. The aforementioned chain of evidence can serve as initial material for internal investigations or cross-border legal action.

7. The method for real-time supervision of cross-border employee behavior compliance based on a large language model according to claim 1, characterized in that, The historical behavior statistics of the cross-border employees include: the distribution of the cross-border employees' communication intentions, operation frequency, operation time distribution, and sensitivity distribution of the operation objects within a preset time period in the past; The group behavior statistics include: the average and standard deviation of the communication intent distribution, operation frequency, operation time distribution, and sensitivity distribution of the operation object within the same preset time period of the cross-border employee's department or group of employees.

8. The method for real-time supervision of cross-border employee behavior compliance based on a large language model according to claim 2, characterized in that, The intent sequence and the behavior sequence are aligned in time within the same preset time window to establish a correspondence between each intent element and one or more behavior records within the same preset time window. The length of the time window is preset according to the cross-border employee's job position or behavior type. Centered on the timestamp of each intention quintuple, extend forward and backward by a preset time window length to form the target time window; Within the target time window, search for one or more behavioral records that are semantically associated with the intent quintuple; If a behavior record falls within the target time window of at least one intention quintuple, the behavior record and the intention quintuple are associated as the same analysis unit. If the behavior record is not associated with any intention quintuple, the behavior record is treated as a behavior unit without intention interpretation.

9. A real-time supervision system for cross-border employee behavior compliance based on a large language model, characterized in that, It includes a processor and a memory, the memory storing a computer program, and the processor executing the computer program to implement the real-time supervision method for cross-border employee behavior compliance based on a large language model as described in any one of claims 1 to 8.

Images