Semantic-driven situation analysis method, device and equipment

Abstract

The application discloses a semantic driving-based situation analysis method, device and equipment, relates to the technical field of security question and answer, and discloses a semantic driving-based situation analysis method, which comprises the following steps: performing compression processing based on a to-be-processed situation analysis question and original historical context to obtain compressed historical context and enhanced question expression; performing task arrangement based on the compressed historical context and the enhanced question expression to obtain a structured step sequence; determining an executable step plan based on the structured step sequence, the compressed historical context and the enhanced question expression; determining an execution result set based on the executable step plan; performing result aggregation based on the execution result set, the situation analysis question and the original historical context to output a situation analysis result. The scheme can improve the executability of a situation analysis task.

Description

Technical Field

[0001] This application relates to the field of security question answering technology, and in particular to semantic-driven situational analysis methods, apparatus and devices. Background Technology

[0002] Among existing situational analysis solutions based on text-based answer generation, some focus on text generation enhancement, while others are only suitable for simple analysis scenarios that can be directly translated into query scripts, and are prone to generating illusions when generating final conclusions.

[0003] Therefore, improving the feasibility of situation analysis tasks to avoid generating illusory situation analysis results has become a problem that needs to be solved.

[0004] The above content is only used to help understand the technical solution of this application and does not represent an admission that the above content is prior art. Summary of the Invention

[0005] The main objective of this application is to provide a semantic-driven situation analysis method, apparatus, and device, aiming to solve the technical problem of how to improve the executability of situation analysis tasks and avoid generating situation analysis results with illusions.

[0006] To achieve the above objectives, this application proposes a semantic-driven situational analysis method, which includes: Based on the situation analysis problem to be processed and the original historical context, compression processing is performed to obtain compressed historical context and enhanced problem statement; Based on the compressed historical context and the enhanced problem statement, task orchestration is performed to obtain a structured sequence of steps; An executable step plan is determined based on the structured step sequence, the compressed historical context, and the enhanced problem statement; Based on the executable steps, a set of execution results is determined; Based on the execution result set, the situation analysis question, and the original historical context, the results are aggregated and the situation analysis results are output.

[0007] In one embodiment, the step of compressing the situation analysis problem and the original historical context to obtain a compressed historical context and an enhanced problem representation includes: The first historical round text to be retained and the historical round text to be filtered are determined from the original historical context according to the preset retention round; Determine the relevance score between the query text of the first retained historical round text and the historical round text to be filtered; Based on the relevance score, the texts of the historical rounds to be screened are filtered to obtain the second set of retained historical rounds texts; A compressed historical context is obtained based on the first and second preserved historical round texts; Based on the compressed historical context, the problem to be processed in the situation analysis is enhanced to obtain an enhanced problem statement.

[0008] In one embodiment, the step of orchestrating tasks based on the compressed historical context and the enhanced problem statement to obtain a structured sequence of steps includes: The enhanced problem statement is normalized to obtain a normalized problem statement; The normalized problem statement is matched with the template problem in the preset template library to obtain the target similarity. When the target similarity is greater than or equal to a preset similarity threshold, the template step skeleton corresponding to the target similarity is extracted from the preset template library; When the target similarity is less than the preset similarity threshold, the enhanced question statement, the preset execution unit set, and the preset template example are input into the large language model to obtain candidate steps; Based on the template step skeleton or the candidate steps, task orchestration is performed to obtain a structured step sequence.

[0009] In one embodiment, the step of determining an executable step plan based on the structured step sequence, the compressed historical context, and the enhanced problem statement includes: Extract the entity set from the enhanced problem statement; A semantic context is constructed based on the enhanced question statement, the compressed historical context, and the entity set; Extract placeholder parameters from the structured step sequence; Based on the semantic context, a parameter matching score is determined between the candidate placeholder values ​​and the placeholder parameters; The target binding value is determined from the placeholder candidate values ​​based on the parameter matching score; An executable step plan is determined based on the target binding value and the structured step sequence.

[0010] In one embodiment, the step of determining the parameter matching score between the candidate placeholder value and the placeholder parameter based on the semantic context includes: Based on the semantic context, candidate values ​​for placeholders are generated; The type matching score of the candidate placeholder value is determined based on the parameter type of the placeholder parameter; Determine the explicit occurrence score of the placeholder candidate values ​​in the situation analysis problem to be addressed; The text proximity score of the placeholder candidate value is determined based on the round proximity distance; The name suitability score of the candidate placeholder value is determined based on the execution unit name corresponding to the placeholder parameter. The parameter matching score between the candidate placeholder value and the placeholder parameter is determined based on the type matching score, the explicit occurrence score, the text proximity score, and the name suitability score.

[0011] In one embodiment, the step of determining an executable step plan based on the target binding value and the structured step sequence includes: Obtain the first parsing step corresponding to the target binding value from the structured step sequence; The placeholder parameters of the first step to be parsed are replaced based on the target binding value to obtain the first executable step; The second step to be parsed is determined from the structured step sequence based on the first step to be parsed; When the second step to be parsed is a preset step type, the placeholder parameters of the second step to be parsed are replaced based on the target type entity of the current context to obtain the second executable step; When the second step to be parsed is not of the preset step type, the placeholder parameter of the second step to be parsed is marked as unparsed, and the third executable step is obtained. An executable step plan is obtained based on the first executable step, the second executable step, and the third executable step.

[0012] In one embodiment, the step of determining the set of execution results based on the executable step plan includes: Initialize the execution result set and the current global state; Iterate through the executable step plan to obtain the call type, execution unit name, and step parameters of the current step to be executed; Based on the current global state and the call type, the corresponding situation analysis agent or situation analysis tool is invoked to execute the current step to be executed, obtain the current execution result, and update the current global state based on the current execution result; When the current execution result is successful, the current execution result, the execution unit name, and the step parameters are written into the execution result set; Return to the step that iterates through the executable steps plan, obtains the call type, execution unit name, and step parameters of the current step to be executed, until the current global state is updated to the target global state.

[0013] In one embodiment, after the step of determining the executable step plan based on the structured step sequence, the compressed historical context, and the enhanced problem statement, the method further includes: When the intent type of the structured step sequence is a preset intent type, a knowledge retrieval step is inserted at the beginning of the executable step plan; When performing the knowledge retrieval step, the reference question set and keyword set of the knowledge item are obtained from the knowledge item set; Calculate the similarity between the enhanced question statement and the reference question set to obtain the reference question matching score; Calculate the similarity between the enhanced question statement and the keyword set to obtain a keyword matching score; The reference question matching score and the keyword matching score are weighted and fused to obtain the comprehensive matching score of the knowledge item; Candidate knowledge entries are determined from the set of knowledge entries based on the comprehensive matching score, and a knowledge retrieval database for the executable step plan is constructed based on the candidate knowledge entries.

[0014] Furthermore, to achieve the above objectives, this application also proposes a semantic-driven situation analysis device, which includes: The text compression module is used to compress the situation analysis problem to be processed and the original historical context to obtain compressed historical context and enhanced problem description. The task orchestration module is used to orchestrate tasks based on the compressed historical context and the enhanced problem statement to obtain a structured sequence of steps; The plan generation module is used to determine an executable step plan based on the structured step sequence, the compressed historical context, and the enhanced problem statement; The execution plan module is used to plan and determine the set of execution results based on the executable steps. The situation analysis module is used to aggregate the results based on the execution result set, the situation analysis question, and the original historical context, and output the situation analysis results.

[0015] Furthermore, to achieve the above objectives, this application also proposes a semantic-driven situation analysis device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the semantic-driven situation analysis method described above.

[0016] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the semantic-driven situational analysis method described above.

[0017] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the semantic-driven situational analysis method described above.

[0018] One or more technical solutions proposed in this application have at least the following technical effects: By compressing and simplifying the original historical context and generating enhanced problem statements, redundant information is reduced from interfering with subsequent processing. Simultaneously, the implicit semantic content of the problem is supplemented, resulting in a more complete expression of the analytical requirements. A standardized, structured sequence of steps is generated and executed. Data aggregation and integration of the results produce situational analysis outcomes, ensuring that conclusions are supported by sufficient evidence. This approach improves the executability of situational analysis tasks, preventing the generation of misleading or misleading situational analysis results. Attached Figure Description

[0019] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0020] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating an embodiment of the semantic-driven situational analysis method of this application. Figure 2 This is a schematic diagram of the task orchestration process provided in Embodiment 1 of the semantic-driven situational analysis method of this application; Figure 3 This is a flowchart illustrating Embodiment 2 of the semantic-driven situational analysis method of this application; Figure 4 This is a schematic diagram of the parameter binding and step enhancement process provided in Embodiment 2 of the semantic-driven situational analysis method of this application; Figure 5 A simplified flowchart illustrating the semantic-driven situational analysis method provided in Embodiment 2 of this application; Figure 6This is a schematic diagram of the module structure of the semantic-driven situational analysis device according to an embodiment of this application; Figure 7 This is a schematic diagram of the device structure of the hardware operating environment involved in the semantic-driven situational analysis method in this application embodiment.

[0022] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0023] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0024] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0025] The main solution of this application embodiment is as follows: Based on the situation analysis problem to be processed and the original historical context, compression processing is performed to obtain a compressed historical context and an enhanced problem statement; based on the compressed historical context and the enhanced problem statement, task orchestration is performed to obtain a structured step sequence; based on the structured step sequence, the compressed historical context, and the enhanced problem statement, an executable step plan is determined; based on the executable step plan, an execution result set is determined; based on the execution result set, the situation analysis problem, and the original historical context, the results are aggregated to output the situation analysis result.

[0026] Because existing situational analysis solutions based on text-based answer generation either focus on text generation enhancement or are only applicable to simple analysis scenarios that can be directly translated into query scripts, they are prone to generating illusions when generating final conclusions.

[0027] This application provides a solution that maps user-input questions, historical context, candidate templates, execution unit sets, and retrieved knowledge into a structured step plan. Then, through explicit parameter binding and a unified execution scheduling mechanism, multi-step analysis is achieved, thereby enabling the situation analysis process to have a higher level of automation, stronger execution stability, and better process interpretability.

[0028] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device capable of performing the above functions, such as a semantic-driven situation analysis device. The following description uses a semantic-driven situation analysis device as an example to illustrate this embodiment and the subsequent embodiments.

[0029] Based on this, embodiments of this application provide a semantic-driven situational analysis method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the semantic-driven situational analysis method of this application.

[0030] In this embodiment, the semantic-driven situational analysis method includes steps S10 to S50: Step S10: Based on the situation analysis problem to be processed and the original historical context, compression processing is performed to obtain compressed historical context and enhanced problem statement; It should be noted that the situation analysis issues to be processed are various network situation-related inquiries raised by users, including independent situation analysis-related queries as well as follow-up questions in multi-round dialogues that build upon the previous content. These issues can cover steps such as Internet Protocol (IP) intelligence analysis, IP assessment, and honeypot record analysis.

[0031] In addition, the original historical context is all the past content generated by the multi-round situation analysis dialogue, including various types of information such as historical questions, corresponding analysis content, network entities, and time range. The original historical context often contains a lot of redundant content that is unrelated to the current situation analysis problem, which will interfere with subsequent analysis work.

[0032] In addition, compression is a filtering and simplification operation performed on the original historical context. This operation retains recent dialogue content on the one hand, and filters out early valid content by using relevance judgment rules on the other hand, in order to eliminate invalid information.

[0033] In addition, compressed historical context is a simplified historical content obtained after compression. This content only retains information that is highly relevant to the situation analysis problem to be processed, and can provide stable and reliable context support for subsequent task orchestration, entity extraction and other processes.

[0034] In addition, the enhanced problem statement is the result of semantic completion of the original situation analysis problem by combining compressed historical context. This content fills in the implicit information in the current problem that can only be determined based on historical dialogue, making the expression of the problem more complete.

[0035] It should be understood that the process begins by acquiring the current situation analysis question and the complete original historical context. Following a preset retention criteria, the most recent rounds of historical content are directly retained. Then, a relevance-based method is used to filter out historical content with high relevance from earlier rounds. These two parts are then integrated and compressed to obtain the compressed historical context. Next, the implicit semantics of the situation analysis question are interpreted using the compressed historical context, and the original question is supplemented to generate an enhanced question statement. After these operations, both the compressed historical context and the enhanced question statement are obtained.

[0036] In one feasible implementation, step S10 may include steps S11 to S15: Step S11: Determine the first historical round text to be retained and the historical round text to be filtered from the original historical context according to the preset retention round; It should be noted that the preset retention rounds are pre-defined standards for defining the number of recent dialogue rounds to be directly retained. These standards can be flexibly adjusted in combination with the parameter scale of the large language model and the size of the context window. Models with different performance specifications will be matched with different round values ​​to adapt to the information carrying capacity of the model.

[0037] For example, for models with small parameter sizes or short context windows, such as models with 7B to 14B and context windows of 8k to 16k, the default retention rounds can be set to 4 to 6 rounds; for models with large parameter sizes or long context windows, such as models with 32B or more or context windows of 32k or more, the default retention rounds can be set to 6 to 10 rounds; as a general default setting, the default retention rounds can be set to 4 to 8 rounds.

[0038] In addition, the first retained historical round text is the recent dialogue content directly extracted from the original historical context according to the preset retention round. This part of the content is closer to the current dialogue time and is generally more related to the current situation analysis problem, so it is the content that is given priority for retention.

[0039] Additionally, the historical round text to be screened is the early dialogue content remaining after removing the first retained historical round text from the original historical context. This part of the content is far removed from the current dialogue time, and the relevance of the content to the current analysis needs cannot be directly determined.

[0040] It should be understood that the preset retention rounds are retrieved first, and the complete original historical context is divided into independent dialogue rounds according to the order in which the dialogue occurs. Starting from the round closest to the current dialogue, the content with the same quantity as the preset retention rounds is extracted as the first retention historical round text. The first retention historical round text is then removed from the original historical context to obtain the historical round text to be filtered.

[0041] Step S12: Determine the relevance score between the query text of the first retained historical round text and the historical round text to be filtered; It should be noted that the query text is a set of query terms constructed based on the first retained historical round text, which will serve as a unified reference for measuring the relevance of early historical content. The relevance score is a numerical result used to quantify the degree of semantic connection between two texts; the higher the score, the stronger the connection between the corresponding historical content and the current analysis requirements. Each piece of historical round text to be screened needs to be compared individually with the query text to generate a corresponding relevance score.

[0042] It should be understood that the first step is to extract the content from the first retained historical round text, integrate the core words, key sentences and core analytical requirements that appear in it, and organize them into the corresponding query text. Then, each piece of historical round text to be screened is selected in turn, and semantic matching operation is performed between it and the query text. The relevance score corresponding to each piece of historical round text to be screened is calculated according to a unified judgment rule, and the score judgment of all content to be screened is completed.

[0043] For example, the formula for calculating the relevance score is as follows:

[0044] In the formula, This represents the Best Match 25 (BM25) relevance scoring function, used to calculate the relevance score between candidate historical round texts and query text; Indicates the candidate historical round text; This represents the query text constructed from the most recently retained historical rounds; This represents a single term in the query text; Indicates terms Inverse document frequency; Indicates terms In candidate historical texts Frequency of occurrence in; This represents a pre-set balance coefficient used to adjust the impact of word frequency; This represents a pre-set balance coefficient used to adjust the impact of document length; Indicates the text length of the candidate historical round text; This represents the average text length of all candidate historical rounds.

[0045] Step S13: Based on the relevance score, filter the text of the historical rounds to be filtered to obtain the second set of retained historical rounds text; It should be noted that the preset screening score standard is a pre-set numerical limit used to judge whether the content to be screened has retention value. Only historical texts that reach the relevance score limit will be considered as content that is effectively related to the current analysis needs.

[0046] Additionally, the second set of retained historical round texts consists of early dialogue content filtered from the pending historical round texts based on relevance scores. This type of content undergoes relevance verification and can supplement the background information needed for the current analysis, thus possessing value for continued retention. Historical round texts that do not meet the preset screening score criteria are deemed redundant and excluded from subsequent processing to reduce interference from invalid information.

[0047] It should be understood that, with reference to the pre-set preset screening score standard, the relevance score of each historical round text to be screened is compared with the standard, and the round texts that meet the corresponding standard are selected. These early historical contents that have passed the screening are integrated together to form the second retained historical round texts.

[0048] Step S14: Obtain compressed historical context based on the first retained historical round text and the second retained historical round text; It should be understood that the extracted first retained historical round text and the filtered second retained historical round text are systematically integrated and spliced ​​together according to the chronological order of the dialogue. In the integration process, repetitive expressions and meaningless fragments are removed to form a compressed historical context.

[0049] For example, the expression formula for historical context compression is as follows:

[0050] In the formula, This represents the compressed historical context obtained after processing by the historical context compression module. This refers to the history context compression module, which receives user questions and the original history context, and performs compression processing on the history content. This indicates the current situation analysis question input by the user; Indicates the original historical context.

[0051] Step S15: Based on the compressed historical context, perform problem enhancement processing on the situation analysis problem to be processed to obtain an enhanced problem statement.

[0052] It should be noted that some situational analysis questions may omit key network entities, time constraints, or implicit semantics based on the preceding dialogue. Interpreting only the question itself may easily lead to misunderstandings. Question enhancement processing is a text optimization operation that combines the simplified historical content to complete the various omitted contents in the current question. The purpose of this operation is to make the semantic expression of the question more complete and clear.

[0053] It should be understood that by reading and organizing the compressed historical context, extracting key information such as network entities, time ranges, and prior analysis conclusions, and combining this information to interpret the omitted content and implicit semantics in the situation analysis problem to be processed, the original problem is supplemented and its semantics are improved to generate an enhanced problem statement with definite semantics.

[0054] For example, the problem enhancement process can be expressed as follows:

[0055] In the formula, This refers to the enhanced problem statement obtained by combining the compressed historical context with the completion of the current problem. The question enhancement module is used to complete the current user's question by combining the compressed historical context. This indicates the current situation analysis question input by the user; This indicates the compressed historical context.

[0056] In this implementation, recent historical content and earlier historical content to be filtered are divided by a preset retention round. The relevance of the earlier historical content is scored using the query text. Valuable earlier historical content is then selected based on the score results. These two types of effective historical content are integrated to form a compressed historical context, which is then used to enhance the question processing. This approach allows for control over the historical scope while retaining key dialogue information, reducing the interference of lengthy text on subsequent steps. It also fills in omitted information and implicit semantics in the questions, providing more stable input for subsequent task orchestration, parameter binding, and other steps.

[0057] Step S20: Based on the compressed historical context and the enhanced problem statement, the task is orchestrated to obtain a structured sequence of steps; It should be noted that task orchestration is a process that combines compressing historical context with enhancing problem descriptions to interpret situational analysis requirements and plan the entire analysis operation process. This process adopts a dual-path strategy of prioritizing templates and generating supplementary information, while setting content verification and process rollback rules to ensure that the orchestration results meet the standard requirements of situational analysis.

[0058] In addition, a structured step sequence is a standardized set of steps output after task orchestration. This sequence has a fixed field composition specification. A structured step sequence contains at least three first-level fields: intent type, entity set, and step sequence. Each step object in the step sequence contains at least three fields: call type, execution unit name, and parameter object.

[0059] In addition, structured constraint validation is an operation that checks the format of generated content, field composition, and scope of execution unit usage according to preset specifications, and is used to determine whether the candidate steps generated by the large language model are legal and usable.

[0060] It should be understood that compressing historical context and enhancing the problem statement are used as the basic inputs for task orchestration. The enhanced problem statement is normalized to unify the expression of Internet Protocol version 4 (IPv4) addresses, dates, time ranges, and other content. Subsequently, template vector retrieval is performed, and the matching degree between the normalized content and each template in the template library is calculated. The optimal matching result is compared with a preset template matching threshold. If the matching degree of the optimal matching result reaches the preset template matching threshold, the step skeleton of the corresponding template is adopted. If the matching degree does not reach the standard, a large language model is called to generate candidate steps, and the candidate steps are subjected to structured constraint verification. If the generated content is valid, it is directly used as the orchestration result; if the generated content is invalid, the execution process is rolled back, the optimal template step obtained from the retrieval is selected, and a compliant structured step sequence is output.

[0061] In one feasible implementation, step S20 may include steps S21 to S25: Step S21: Normalize the enhanced problem statement to obtain a normalized problem statement; It should be noted that normalization is a standardized operation that rewrites the different expressions within the problem text in a unified manner. This operation mainly targets two types of content: network entities and time-related descriptions. The purpose is to eliminate matching interference caused by semantically identical but differently written texts.

[0062] Furthermore, IPv4 addresses are frequently encountered network entities in situational analysis scenarios. Time-granularity grouping is an operation that categorizes diverse time-specific terms such as "today," "the last 7 days," and "this week" according to time ranges. Normalization replaces all IPv4 addresses in the text with corresponding placeholders, and also standardizes specific dates and date ranges appearing in the text into fixed time placeholders according to their chronological order. The normalized problem statement is the standardized text obtained after normalization.

[0063] For example, the formula for expressing the normalization problem is as follows: .

[0064] In the formula, This indicates the user's question after normalization. This represents the question normalization function, used to normalize the IP and time expressions of the original user question. This indicates the situation analysis question currently being input by the user.

[0065] It should be understood that the process begins by reading the complete enhanced question statement, identifying each IPv4 address contained within the text, and replacing all IPv4 addresses with specified placeholders according to a unified rule. Explicit dates, date ranges, and various colloquial time descriptions within the text are then identified, and corresponding time placeholders are set for dates and date ranges in the order of their appearance.<start_time> and<end_time> Simultaneously, time-granularity grouping is performed on different time-descriptive terms, among which,<start_time> Used to mark the starting point of the analysis time interval.<end_time> Used to mark the end point of the analysis time interval. After completing the standardized rewriting of network entities and time representations, a normalized problem statement with a unified format is generated.

[0066] Step S22: Perform similarity matching between the normalized problem statement and the template problem in the preset template library to obtain the target similarity; It should be noted that the preset template library is a collection of pre-defined content for various routine situational analysis. The library integrates standard query texts and supporting analysis processes for different scenarios.

[0067] Additionally, template questions are standardized situational analysis query texts stored within a pre-defined template library. Each template question corresponds to a fixed analysis process framework and serves as the reference for semantic comparison. Vector encoding models can convert natural language text into digital vector forms, and text vectors can quantitatively represent the semantic features of the text. Similarity matching is an operation that calculates the semantic closeness of two text segments based on their text vectors. This operation can transform abstract semantic differences into comparable numerical values. Target similarity is the maximum semantic similarity value obtained after comparing the normalized question statement with all template questions in the pre-defined template library, which can intuitively reflect the degree of fit between the current question and existing templates in the library.

[0068] It should be understood that the vector encoding model is invoked to transform the normalized problem statement and each template problem in the preset template library, converting all text content into corresponding semantic vectors. The semantic similarity values ​​between the vector of the normalized problem statement and the vector of each template problem are calculated sequentially. After summing all the calculation results, the one with the largest value is selected and determined as the target similarity.

[0069] For example, a preset template library The formula for expressing this is as follows: } In the formula, the subscript of p indicates the template sequence number identifier. This indicates the total number of templates in the template library; This represents a preset template library, where each template... It includes a template question description and a corresponding step-by-step framework.

[0070] The formula for calculating template similarity is as follows:

[0071] In the formula, the subscript Indicates the template serial number identifier; Indicates the input question and the first Similarity between templates; This represents the cosine similarity calculation function, used to determine the degree of similarity between two sets of feature vectors; This represents a vector encoding model used to map text into feature vectors; This indicates the user's question after normalization. This indicates the compressed historical context; Indicates the first A template question or template item; This indicates the total number of templates in the template library.

[0072] The formula for template filtering is as follows:

[0073] In the formula, This represents the optimal template number with the highest similarity. This function represents the index of the independent variable corresponding to the maximum similarity, used to filter the template number with the highest similarity. Indicates the input question and the first Similarity between templates.

[0074] Step S23: When the target similarity is greater than or equal to a preset similarity threshold, extract the template step skeleton corresponding to the target similarity from the preset template library; It should be noted that the preset similarity threshold is a pre-defined numerical standard used to determine whether the template matching result meets the standard. This standard can be flexibly adjusted according to the accuracy requirements and scenario types of situational analysis operations, and is a key criterion for distinguishing different task orchestration paths. The template step skeleton is a standardized analysis process framework that is bound to the template problem one by one. The framework determines the execution order of the analysis steps, the type of execution unit for each step, and sets various parameter placeholders. This framework only plans the overall execution logic and does not fill in specific running parameters, so it can be directly reused in similar situational analysis tasks. The template step skeleton distinguishes between two types of execution units: intelligent agents and tools, corresponding to different types of situational analysis operations such as knowledge retrieval, log analysis, and intelligence assessment.

[0075] It should be understood that the calculated target similarity is compared with a preset similarity threshold. When the target similarity value is greater than or equal to the preset similarity threshold, it indicates a high semantic fit between the current situation analysis problem and the corresponding template problem. Subsequently, based on the target similarity matching result, the corresponding template entry is located in the preset template library, and the corresponding template step skeleton is extracted from this entry as the basis for subsequent task orchestration. That is, it satisfies... Then, obtain the step skeleton corresponding to the template, where, This represents the similarity between the optimal matching template and the input problem. This represents a pre-set template matching threshold used to determine whether a template match is successful.

[0076] Step S24: When the target similarity is less than the preset similarity threshold, the enhanced question statement, the preset execution unit set, and the preset template example are input into the large language model to obtain candidate steps; It should be noted that the preset execution unit set is a collection of all execution units with legal calling permissions. The execution units are divided into two main categories: agents and tools. This determines all the operation units that can be selected in the task orchestration process, which can avoid calling unauthorized units during the orchestration process.

[0077] Additionally, the preset template examples are several similar template examples selected from the preset template library. These include standard template questions and corresponding template step skeletons, serving as reference examples for the large language model and guiding the model to output process content that conforms to situational analysis specifications. The large language model is an artificial intelligence model with natural language understanding, logical reasoning, and structured text generation capabilities, capable of planning and adapting analysis processes for unconventional problems based on multiple types of input information. Candidate steps are a set of preliminary analysis steps generated by the large language model based on the input content.

[0078] It should be understood that when the target similarity value is less than the preset similarity threshold, it indicates that there is no template content in the preset template library that can highly adapt to the current problem, and the existing process cannot be directly reused. At this time, the three types of information—enhanced problem description, preset execution unit set, and preset template example—are integrated and the integrated complete content is input into the large language model. The large language model combines the current analysis requirements, available execution units, and reference examples to generate corresponding candidate steps according to the business logic of situational analysis.

[0079] Step S25: Based on the template step skeleton or the candidate steps, perform task orchestration to obtain a structured step sequence.

[0080] It's important to note that structured constraints are a pre-defined system for standardizing the format, field composition, and content rules of analysis steps. This system requires that each step contain at least three primary fields: intent type, entity set, and step sequence. Each sub-step also needs to include at least a call type, execution unit name, and parameter object. The call type is restricted to utility or agent classes, the execution unit name must belong to a pre-authorized set of execution units, and the parameter object is used to carry placeholder or explicit parameters required for subsequent parameter binding. Structured constraints can be implemented using either function call patterns or constrained JSON output patterns. The rollback strategy is a handling method for non-compliant candidate steps, ensuring that the task orchestration process is not interrupted due to abnormal generated content.

[0081] It should be understood that when the target similarity is greater than or equal to the preset similarity threshold, the structured step sequence is directly output based on the template step skeleton; when the target similarity is less than the preset similarity threshold, candidate steps are generated, and the candidate steps are fully verified against the structured constraints, checking the integrity of fields, the legality of execution units, etc. If the candidate steps pass the verification, the structured step sequence is output according to the candidate steps; if the candidate steps fail the verification, such as the generated result is empty, the parsing fails, or an unauthorized execution unit is referenced, the rollback strategy is activated, and the template step skeleton with the best matching degree in the preset template library is selected to output the structured step sequence.

[0082] For example, the formula for the sub-path output of the step plan is as follows:

[0083] In the formula, This represents the step plan output by the task orchestration module; This indicates the task orchestration module; This refers to the enhanced problem statement obtained by combining the compressed historical context with the completion of the current problem. This indicates the compressed historical context; This indicates the step plan for outputting the template path; This represents the step plan for generating the output path of the large model; This indicates the rollback plan obtained after a failed generation. Indicates the input question and the first Similarity between templates; This represents a pre-set template matching threshold used to determine whether a template match is successful.

[0084] Furthermore, the step plan can be uniformly represented as an ordered sequence of steps, and the formula for expressing a structured step sequence is as follows:

[0085] Among them, the Each step is recorded as

[0086] In the formula, the subscript Indicates the step number identifier; subscript Indicates the total number of steps; This represents the step plan output by the task orchestration module; Indicates the first A raw step object without bound parameters; Indicates the first The call type for this step is limited to either Agent or Tool. Indicates the first The name of the execution unit corresponding to the step; Indicates the first The original parameter object of the step.

[0087] In this implementation, the network entities and time representations within the problem are first normalized to reduce the impact of textual differences on matching results and improve the accuracy of template retrieval. Based on similarity matching and a preset similarity threshold, two orchestration paths are defined. For high-matching scenarios, the template step skeleton is directly reused, simplifying the process planning and improving overall processing efficiency. For low-matching scenarios, a large language model combined with reference content is used to generate candidate steps, adapting to various personalized situational analysis problems and expanding the applicability of process planning. Controlling the generated content using structured constraints and rollback strategies reduces the probability of illegal steps, ensuring the standardization and stability of task orchestration results. The entire process combines template reuse and intelligent generation, balancing processing efficiency and scenario adaptability. The output structured step sequence format is standardized, allowing for smooth transitions to subsequent parameter binding and other steps.

[0088] Figure 2 This is a schematic diagram of the task orchestration process provided in Embodiment 1 of the semantic-driven situational analysis method of this application. Figure 2 As shown, starting from the input question and compression history, the question is first normalized, then template vector retrieval is performed to determine whether the similarity is greater than or equal to the threshold. If the result is yes, the template step skeleton is output. If the result is no, the large language model is called to generate candidate steps. Then, structured constraint verification is performed, and the validity of the generated result is determined. If the result is valid, the generation step plan is output. If the result is invalid, it is backed up to the optimal template step to complete the complete process of dual-path task orchestration.

[0089] Step S30: Determine an executable step plan based on the structured step sequence, the compressed historical context, and the enhanced problem statement; It should be noted that the executable step plan is a complete solution formed on the basis of the structured step sequence, after placeholder replacement, missing parameter completion, and optional step enhancement. This solution has complete parameters and a complete process, and can be directly delivered to the execution stage.

[0090] It should be understood that the structured step sequence, compressed historical context, and enhanced question description are used as the overall input. Various situational entities are extracted from these three types of content, and a complete semantic context is constructed based on the extraction results. Then, all parameter regions of the structured step sequence are traversed, various placeholders within the regions are identified, and all placeholders are replaced according to the semantic context. After replacement, the parameter completeness of each step is checked one by one. For any remaining missing key fields, automatic parameter completion is performed according to preset parameter completion rules. Subsequently, the type of the current analysis task is determined, and it is checked whether knowledge retrieval-related content already exists within the step sequence. If the task belongs to knowledge query or general question answering and there is no corresponding retrieval step, a knowledge retrieval step is inserted at the beginning of the step sequence. After a series of processing steps, the executable step plan is determined.

[0091] For example, the formula for task orchestration is as follows:

[0092] In the formula, This represents the step plan output by the task orchestration module; This indicates the task orchestration module, used for structured step planning based on enhanced questions and compressed historical generation situation analysis; This refers to the enhanced problem statement obtained by combining the compressed historical context with the completion of the current problem. This indicates the compressed historical context.

[0093] In one feasible implementation, step S30 may include steps S31 to S36: Step S31: Extract the entity set from the enhanced problem statement; It should be noted that the entity set is a summary of all key situational information extracted from situational analysis-related text, including IPv4 addresses, time ranges, alarm objects, attack event names, etc. The types of situational entities are defined based on the situational analysis business scenario, filtering only valid content relevant to the current analysis task and excluding irrelevant text information.

[0094] It should be understood that the process involves reading all the text content of the enhanced problem statement segment by segment, identifying various situation-related entities in the text according to the predefined situation entity type standards, summarizing and organizing all identified entities, removing duplicate entity content, and forming a complete entity set.

[0095] Step S32: Construct a semantic context based on the enhanced question statement, the compressed historical context, and the entity set; It should be noted that semantic context is a comprehensive reference text formed by integrating multiple types of information. The integrated objects include enhanced problem statements, compressed historical context, and entity sets, which can comprehensively present the needs of current situation analysis, dialogue background, and key entity information.

[0096] It should be understood that integrating and sorting out three independent categories of content—enhancing problem description, compressing historical context, and entity sets—and sorting out the semantic connections and logical relationships between different pieces of information, the scattered problem descriptions, historical dialogues, and key entities are merged into a coherent and complete semantic context, providing a comprehensive information foundation for the subsequent matching and replacement of placeholder parameters.

[0097] For example, the expression formula for semantic context is as follows:

[0098] In the formula, This represents the semantic context constructed during the parameter binding process; This refers to the enhanced problem statement obtained by combining the compressed historical context with the completion of the current problem. This indicates the compressed historical context; This represents the set of entities extracted from the current problem and history.

[0099] Step S33: Extract placeholder parameters from the structured step sequence; It should be noted that the structured step sequence defines the overall analysis process, execution unit type, and parameter-related areas, but only plans the execution logic without filling in the actual running parameters. Placeholder parameters, also known as placeholders, are abstract identifiers set within the parameter area of ​​the structured step sequence. For any step, its parameter object can contain several placeholders. Different placeholder parameters correspond to different types of running parameters such as IP address, start time, end time, and enhanced query statements, and cannot be directly called and executed by the execution unit.

[0100] It should be understood that by sequentially traversing the parameter object region of each sub-step in the structured step sequence, identifying the various placeholder parameters existing in each region, classifying and recording the identified placeholder parameters, and completely extracting all placeholder parameters in the structured step sequence, all abstract identifiers that need to be replaced subsequently are determined.

[0101] Step S34: Determine the parameter matching score between the candidate placeholder value and the placeholder parameter based on the semantic context; It should be noted that placeholder candidate values ​​are alternative data content selected from the semantic context that possess the characteristics of the corresponding parameter type. Each placeholder parameter corresponds to one or more sets of placeholder candidate values, which are used to replace the placeholder parameter. The preset scoring rules are pre-defined criteria used to calculate the parameter matching score. The evaluation dimensions include value type matching degree, explicit appearance of the content in the current problem, proximity of the content to recent historical content, and business adaptability of the content to the corresponding execution steps. The parameter matching score is a numerical result calculated by combining multiple evaluation dimensions; a high or low score directly reflects the degree of adaptability between the placeholder candidate value and the corresponding placeholder parameter.

[0102] It should be understood that, for each placeholder parameter that has been extracted, all content that meets the basic type requirements is first filtered from the semantic context as candidate placeholder values ​​for that parameter. Referring to preset scoring rules and considering multiple dimensions such as value type, content location, historical relevance, and business adaptability, the parameter matching score between each candidate placeholder value and its corresponding placeholder parameter is calculated sequentially, thus completing the score calculation for all candidate values.

[0103] In one feasible implementation, step S34 may include steps S341 to S346: Step S341: Generate placeholder candidate values ​​based on the semantic context; It should be understood that the complete semantic context should be read first, and the filtering range should be defined in combination with the basic usage features of the current placeholder parameter. From the various contents contained in the semantic context, such as situational entities, time information, and text statements, placeholder candidate values ​​should be extracted one by one to form a set of placeholder candidate values ​​corresponding to the current placeholder parameter.

[0104] Step S342: Determine the type matching score of the candidate placeholder value based on the parameter type of the placeholder parameter; It's important to note that parameter types are predefined standards used to categorize the data types of placeholder parameters. In situational analysis scenarios, these can include categories such as network entity types, time-related types, and text query types. Each parameter type corresponds to a fixed data format and content specification. The type matching score is a numerical value that quantifies the degree of fit between the data type and format of the candidate placeholder value and the parameter type required by the placeholder parameter. The closer the data format of the candidate value is to the parameter type requirement, the higher the corresponding type matching score.

[0105] It should be understood that, first, the specific parameter type and corresponding data format specifications corresponding to the current placeholder parameter should be determined. Then, each placeholder candidate value should be extracted in turn, and the data category and format of the candidate value should be checked to see if they meet the relevant requirements of the parameter type. The corresponding type matching score should be calculated for each placeholder candidate value according to the preset scoring criteria, and the scoring operation of all candidate values ​​in the data type dimension should be completed.

[0106] Step S343: Determine the explicit occurrence score of the placeholder candidate value in the situation analysis problem to be processed; It should be noted that the text of the situation analysis problem to be processed will directly present key information such as network entities, time range, and analysis objects that the user is most concerned about. This directly presented content is often the preferred choice for parameter use and is an important reference for judging the priority of candidate values.

[0107] Additionally, the explicit appearance score measures whether placeholder candidate values ​​appear directly in the question text for the situation analysis. If a candidate value appears directly in the question text, it indicates that the content aligns with the user's current needs, and the corresponding explicit appearance score will be higher. This score can distinguish the strength of the correlation between different candidate values ​​and the user's immediate needs, helping to filter out parameters that better meet those needs.

[0108] It should be understood that the process involves traversing all the text content of the situation analysis problem to be processed, checking whether each placeholder candidate value appears directly in the text, and combining the position of the candidate value in the text with the number of times it appears repeatedly to determine its importance. The score is calculated according to the established scoring rules to obtain the explicit occurrence score corresponding to each placeholder candidate value.

[0109] Step S344: Determine the text proximity score of the placeholder candidate value based on the round proximity distance; It should be noted that round proximity distance is a measure of the proximity between the historical round to which the placeholder candidate value belongs and the current round. Multi-round situational analysis dialogues are divided into independent rounds according to the order of communication. The closer the round to the current round is to the candidate value, the smaller the round proximity distance is, and the stronger the timeliness and relevance of the corresponding content.

[0110] Additionally, the text proximity score is calculated based on the proximity distance between rounds. It primarily reflects the closeness of the relationship between the historical content containing the placeholder candidate value and the current situational analysis requirements. The closer the round distance, the higher the text proximity score. In multi-turn dialogue scenarios, this score can effectively distinguish the reference value of different historical content, adapting to the context-dependent usage characteristics.

[0111] It should be understood that, firstly, the specific historical dialogue round to which each placeholder candidate value belongs is located, the round proximity distance between the historical round and the current dialogue round is calculated, and each placeholder candidate value is scored in combination with the round proximity relationship according to the preset score conversion rules, so as to obtain the text proximity score corresponding to all placeholder candidate values.

[0112] Step S345: Determine the name suitability score of the candidate placeholder value based on the execution unit name corresponding to the placeholder parameter; It should be noted that the execution unit name is a corresponding identification name assigned to different execution units. Different execution units correspond to different situation analysis business functions, and the execution unit name and its own business function are one-to-one.

[0113] Additionally, the name suitability score measures the degree of matching between the semantic content of the placeholder candidate value and the business function of the execution unit to which the placeholder parameter is bound. A higher score indicates that the candidate value is more in line with the operational requirements of the execution unit at the business logic level. This score focuses on the suitability for business scenarios, avoiding the problem of selecting parameters that are compliant in data format but inconsistent in business logic.

[0114] It should be understood that the process first retrieves the name of the execution unit bound to the current placeholder parameter, sorts out the business functions, usage scenarios and operational requirements corresponding to the execution unit, interprets the semantics of each placeholder candidate value, determines whether the candidate value is suitable for the business operation logic of the execution unit, completes the evaluation according to the preset scoring rules, and obtains the name suitability score corresponding to each placeholder candidate value.

[0115] Step S346: Determine the parameter matching score between the candidate placeholder value and the placeholder parameter based on the type matching score, the explicit occurrence score, the text proximity score, and the name suitability score.

[0116] It should be understood that the four individual scores corresponding to each placeholder candidate value are summarized, and the scores of different dimensions are integrated and calculated according to the preset weight allocation rules. The results of multiple dimensions such as data type, text occurrence, historical rounds, and business adaptability are comprehensively considered to calculate the parameter matching score between each placeholder candidate value and the corresponding placeholder parameter.

[0117] For example, the formula for calculating the parameter matching score is as follows:

[0118] In the formula, This indicates the optimal parameter value obtained from placeholder matching; A function representing the selection of optimal parameters; Indicates the candidate parameter values ​​for the placeholder; Indicates parameter placeholders; Indicates placeholder The corresponding set of candidate values; This represents a parameter matching scoring function, used to calculate the candidate parameter fit score by comprehensively considering multiple dimensions. Indicates the semantic context constructed during the parameter binding process; subscript Indicates the step sequence number; Indicates the first A raw step object with no bound parameters.

[0119] In this implementation, placeholder candidate values ​​are first generated based on the semantic context. Corresponding scores are calculated from four independent dimensions: data type, explicit occurrence of the problem, historical rounds, and business adaptability of the execution unit. These multiple scores are then combined to obtain a comprehensive parameter matching score. Evaluating candidate content from multiple perspectives—basic format, immediate user requests, multi-turn dialogue context, and situational analysis business logic—improves the rationality of parameter matching results and reduces operational issues caused by incorrect parameter types or content deviating from the business scenario.

[0120] Step S35: Determine the target binding value from the placeholder candidate values ​​based on the parameter matching score; It should be noted that the target binding value is the optimal content selected from all candidate placeholder values ​​corresponding to the same placeholder parameter. This content has the highest parameter matching score and is the actual running parameter used to replace the placeholder parameter.

[0121] It should be understood that, for all candidate placeholder values ​​corresponding to a single placeholder parameter, the parameter matching score corresponding to each candidate value is compared, and the candidate placeholder value with the highest score is selected and determined as the target binding value corresponding to that placeholder parameter.

[0122] Step S36: Determine an executable step plan based on the target binding value and the structured step sequence.

[0123] It should be understood that by using the target binding value corresponding to each placeholder parameter, the corresponding placeholder parameters in the structured step sequence are replaced one by one, completing the conversion of all abstract identifiers to actual parameters. Afterwards, the parameter integrity of the overall step sequence is checked, and any remaining missing parameters are completed. The type of the current analysis task is identified, determining whether the task belongs to the category of knowledge query or general question answering and whether there are no knowledge retrieval-related steps in the sequence. If the conditions are met, a default knowledge retrieval step is inserted at the beginning of the step sequence, and all content is integrated to obtain an executable step plan.

[0124] For example, the parameter binding process can be expressed as follows:

[0125] In the formula, This represents the executable step plan after parameter binding and rule enhancement; This indicates the parameter binding module, which is used to bind placeholder parameters and perform step enhancement processing on the original step plan. This represents the step plan output by the task orchestration module; This indicates the current situation analysis question input by the user; This indicates the compressed historical context.

[0126] In this implementation, an entity set is first extracted from the enhanced question statement, and a complete semantic context is constructed by combining multiple types of information, providing sufficient reference for parameter matching. Placeholder parameters are extracted from the structured step sequence, candidate values ​​are generated based on the semantic context, and a matching score is calculated using multi-dimensional standards. The optimal target binding value is selected based on the scoring results to complete the parameter replacement. Simultaneously, parameter completion and step enhancement operations are combined to form an executable step plan. This approach enables accurate binding of placeholder parameters, reducing the probability of problems such as parameter type mismatch and content errors.

[0127] In one feasible implementation, step S36 may include steps S361 to S366: Step S361: Obtain the first parsing step corresponding to the target binding value from the structured step sequence; It should be noted that the first step to be parsed is a sub-step within the structured step sequence that has a corresponding association with the current target bound value and requires priority for parameter parsing and replacement operations. It is the first step object to be processed in this round of parameter processing.

[0128] It should be understood that by traversing the complete structured step sequence, comparing the correspondence between the placeholder parameters of each sub-step in the sequence and the currently determined target binding value, the sub-step that matches the association relationship is located, and the step is selected as the first step to be parsed.

[0129] Step S362: Replace the placeholder parameters of the first step to be parsed with the target binding value to obtain the first executable step; It should be noted that the first executable step is the step object formed after the first parsed step has completed the placeholder parameter replacement. This object has complete internal parameter content and possesses the basic conditions to directly participate in subsequent execution scheduling. The parameter replacement operation supports the replacement of all placeholder parameters, as well as the replacement of placeholder parameters embedded within strings, and can adapt to diverse parameter writing formats.

[0130] It should be understood that the process involves retrieving the already determined target binding value, opening the parameter area of ​​the first parsing step, identifying all placeholder parameters within the area, replacing the corresponding placeholder parameters with the target binding value according to a one-to-one correspondence, completing the conversion of all abstract identifiers to actual data within this step, and obtaining the first executable step after processing.

[0131] Step S363: Determine the second step to be parsed from the structured step sequence based on the first step to be parsed; It should be noted that the structured step sequence consists of multiple sub-steps arranged in an orderly manner according to the execution order of the situation analysis. There is a logical relationship between the steps, and subsequent steps need to be processed in sequence after the preceding steps are processed. The second step to be parsed is the unparsed step obtained after removing the first step to be parsed from the structured step sequence.

[0132] Step S364: When the second step to be parsed is a preset step type, the placeholder parameters of the second step to be parsed are replaced based on the target type entity of the current context to obtain the second executable step; It should be noted that the preset step type is a pre-defined category of situational analysis steps that require active parameter supplementation. This category can include steps corresponding to routine situational analysis operations such as IP intelligence analysis, attack event analysis, and honeypot record analysis. For these types of steps, the corresponding automatic parameter completion logic will be enabled.

[0133] Additionally, the current context is the text content of the current dialogue turn. The target type entity is a situational entity extracted from the current context that matches the business function of the preset step type, such as IP address, time range, alarm object, etc. The second executable step is the step object formed after the placeholder parameters of the second step to be parsed are replaced.

[0134] It should be understood that the process involves determining whether the current second step to be parsed belongs to a preset step type. If the determination result is yes, a target type entity matching the business function of that step is selected from the current context. The content of the target type entity is then used to replace the placeholder parameters in the second step to be parsed. After completing the parameter replacement operation, the second executable step is generated. For example, for steps such as IP intelligence analysis, IP assessment, and honeypot record analysis, if the corresponding parameters are empty or still retained as... In the format, the first IP entity in the current context will be automatically filled in; for attack event analysis steps, the first IP can be bound to... Fields, where, It is a pre-defined, universal placeholder identifier that refers to an Internet Protocol address; The field is a fixed parameter field in the attack event analysis step, representing the source Internet Protocol address.

[0135] Step S365: When the second step to be parsed is not the preset step type, mark the placeholder parameter of the second step to be parsed as unparsed to obtain the third executable step; It should be noted that the unresolved flag is a pre-defined status indicator used to mark placeholder parameters for which there are currently no valid replacements. This flag only records the status and does not create false data to fill in the parameters, thus preventing erroneous data from flowing into subsequent execution stages. The third executable step is a step object formed after the second unresolved step has been marked. This object retains the original step structure, call type, and execution unit information, only adding the unresolved flag to the missing placeholder parameters, and can still enter the subsequent execution flow normally.

[0136] It should be understood that if it is determined that the current second step to be parsed does not belong to the preset step type, and the placeholder parameters inside the step cannot be matched with valid replacement content, an unparsed mark is uniformly added to such placeholder parameters, the original structure and configuration of the second step to be parsed are preserved throughout the process, and the third executable step is obtained after the marking process is completed.

[0137] Step S366: Obtain an executable step plan based on the first executable step, the second executable step, and the third executable step.

[0138] It should be understood that, according to the initial execution order set in the structured step sequence, the first, second, and third executable steps that have been processed are integrated and arranged in sequence to sort out the logical relationship of the overall process, summarize all step objects to form a complete process plan, and obtain the executable step plan.

[0139] For example, the formula for expressing the steps after parameter binding is as follows:

[0140] In the formula, the subscript Indicates the step sequence number; Indicates the first An executable step object after parameter binding is completed; Indicates the first The call type for this step is limited to either Agent or Tool. Indicates the first The name of the execution unit corresponding to the step; Indicates the first The step completes the replacement of placeholders with available parameter objects.

[0141] In this implementation, the sub-steps within the structured step sequence are parsed and replaced sequentially according to their original order. Steps that match the target binding values ​​are processed first to form complete executable steps. Different processing methods are used for different types of subsequent steps. For preset step types, the corresponding entities are automatically matched to complete parameter replacement. For non-preset step types and whose parameters cannot be parsed, only status markers are added without forcibly filling in data. This entire processing method completes parameter binding in batches and by type. It can automatically complete the parameters of routine situation analysis steps according to established rules, improving the automation level of parameter processing, and effectively avoids runtime errors caused by fabricated parameters, reducing the spread of errors in the process.

[0142] Step S40: Determine the set of execution results based on the executable step plan; It should be noted that exception information is the recorded content generated when problems such as call failure or runtime errors occur during the execution of steps. Exception information will be collected and saved separately to facilitate subsequent problem investigation and process review.

[0143] In addition, the execution result set is a collection of valid data generated by the normal operation of each step after all steps in the executable step plan have been executed in sequence. This set is independent of abnormal information and fully includes the normal analysis results.

[0144] It should be understood that the executable step plan is used as the basis for scheduling. Unified execution scheduling operations are initiated, and different steps are assigned to their corresponding execution units strictly according to the order of the steps. Each time a step is started, the global execution status of the previous stage is considered. After a step completes its execution normally, the valid output of that step is added to the execution result set, and the global execution status is updated. If a problem occurs during the execution of a step, the corresponding exception information is recorded separately, and the execution of subsequent steps continues. This process is repeated until all steps in the executable step plan have been executed, resulting in a complete execution result set.

[0145] For example, the formula for expressing the execution of the scheduling process is as follows:

[0146] In the formula, This represents the set of results from all execution steps. This refers to the unified execution scheduling module, which is used to schedule the execution units to run the executable steps of the plan and summarize the execution results. This represents the executable step plan after parameter binding and rule enhancement.

[0147] In one feasible implementation, step S40 may include steps S41 to S45: Step S41: Initialize the execution result set and the current global state; It should be noted that the current global state is an information carrier that records the running status of each step of the situation analysis process, intermediate data, parameter flow information, and anomaly records, and it will continuously change as the steps are executed. Initialization is an operation that sets the execution result set to an empty set and restores the current global state to a unified initial baseline form before starting a new round of execution.

[0148] It should be understood that before formally initiating the execution flow of the executable steps plan, the execution result set must first be initialized by clearing all residual content within the set, leaving it in a blank, ready-to-be-written state. Simultaneously, the current global state is initialized, setting the basic state information corresponding to the start of the process and removing irrelevant historical execution records, thus preparing for subsequent step execution, state updates, and result recording.

[0149] Step S42: Traverse the executable step plan to obtain the call type, execution unit name, and step parameters of the current step to be executed; It should be noted that the currently pending step is the single step that needs to be started and run in the current round of the traversal process; it is the processing object of the operation in this round. The invocation type is an identifier used to distinguish the type of execution unit, limited to two categories: situation analysis agents and situation analysis tools.

[0150] It should be understood that the traversal operation is performed sequentially according to the predetermined execution order of the executable steps. In each round of traversal, the current step to be executed that needs to be processed is located. From the structured content of this step, the corresponding call type, execution unit name and step parameters are extracted respectively. The basic information required for the operation of a single step is collected in a complete manner, so as to prepare data for subsequent calls to execution units.

[0151] Step S43: Based on the current global state and the call type, call the corresponding situation analysis agent or situation analysis tool to execute the current step to be executed, obtain the current execution result, and update the current global state based on the current execution result; It should be noted that the situation analysis agent is the execution unit responsible for complex heterogeneous operations such as knowledge retrieval and database querying, and is capable of handling situation analysis tasks with complex logic and multi-dimensional linkages. The situation analysis tool, on the other hand, is the execution unit responsible for atomic, specialized operations such as log analysis, IP intelligence assessment, and attack event statistics, primarily performing single-type situation analysis actions.

[0152] Additionally, the current execution result contains all content generated after the current step to be executed has finished running. This includes both analytical data produced when the step runs normally and records related to operational anomalies such as failed step calls or abnormal parameters. Updating the current global state involves supplementing and integrating the running process, output content, and anomaly information of the current step to be executed into the existing current global state, so that the current global state can reflect the latest running progress and detailed information of the situation analysis process in real time.

[0153] It should be understood that, based on the initialized current global state and the call type extracted in the previous step, the type of execution unit that the current step needs to match is determined. Subsequently, the corresponding situation analysis agent or situation analysis tool is invoked to run the current step. After the step is completed, the corresponding execution result is generated. The execution details, output data, and exception records of that step are integrated and the current global state is updated synchronously, so that the global state continuously records the progress of the entire process.

[0154] Step S44: When the current execution result is successful, write the current execution result, the execution unit name, and the step parameters into the execution result set; It should be noted that a successful execution result indicates that the current execution step has successfully completed all its actions without any issues such as execution unit call failure, parameter format errors, or program errors, and has produced valuable situational analysis data.

[0155] It should be understood that the status of the current execution result obtained after the step is run is determined. When the current execution result is determined to be successful, the current execution result generated by this run, the corresponding execution unit name, and the step parameters used throughout the process are uniformly organized and written into the execution result set according to the preset format requirements, so as to completely retain the valid running information of the step.

[0156] Step S45: Return to the step that traverses the executable step plan and obtains the call type, execution unit name and step parameters of the current step to be executed, until the current global state is updated to the target global state.

[0157] It should be noted that returning terminates the current round's step processing flow and jumps back to the stage of traversing the executable step plan to continue processing the loop jump operation for the next sub-step. This operation is used to achieve the sequential execution of sub-steps. The target global state is the global state formed after all sub-steps within the executable step plan have been executed. This state signifies that the entire situation analysis execution process has been completed.

[0158] It should be understood that after completing the execution of a single step, updating the global state, and writing a valid result, the process jumps back to the stage of traversing the executable step plan. It continues to retrieve various information for the next currently pending step in sequence, and repeats subsequent execution, judgment, and recording operations. This entire process is continuously executed in a loop until the current global state is updated to the target global state, indicating that all steps within the executable step plan have been executed. At this point, the loop terminates.

[0159] For example, the formula for expressing the result of the step execution is as follows:

[0160] In the formula, the subscript Indicates the current step number; subscript This indicates the sequence number of the previous step; Indicates the first The execution results of each step; This indicates the unified execution scheduling module, which is used to perform calculations and output results based on the step content and the global state of the previous step. Indicates the first An executable step object after parameter binding is completed; Indicates the first The global state after the step is completed.

[0161] For example, the formula for updating the global state is as follows:

[0162] In the formula, the subscript Indicates the current step number; subscript This indicates the sequence number of the previous step; Indicates the first The global state after the step is executed, the initial state is ; This represents the global state update function, used to refresh the system's global running state based on the previous state and the result of the current step. Indicates the first The global state after the step is completed; Indicates the first The results of each step.

[0163] In this embodiment, by traversing the executable step plan in a preset order, the key information of each step to be executed is extracted in sequence. Based on the call type, two heterogeneous execution units, namely the situation analysis agent and the situation analysis tool, are uniformly scheduled. After each step is executed, the current global state is updated in real time, and the process trajectory and abnormal information are completely recorded. For successfully executed steps, the results, execution unit names and step parameters are uniformly collected. A unified state scheduling framework is adopted, which can be compatible with different types of execution units, completely retain the running data and parameter information of the entire process, and improve the stability and traceability of the situation analysis execution process.

[0164] Step S50: Aggregate the results based on the execution result set, the situation analysis question, and the original historical context, and output the situation analysis results.

[0165] It should be noted that result aggregation is a process of integrating multiple types of data, such as execution result sets, step operation information, exception information, and original input content, and performing comprehensive reasoning and content generation based on the integrated content. This process does not simply splice together various types of text content, but first sorts out standardized integrated content and then performs reasoning and summarization.

[0166] For example, the formula for expressing the execution result set is as follows:

[0167] In the formula, the subscript Indicates the total number of steps; The subscript number represents the step number; This represents the set of execution results for all steps. Indicates the first The results of each step.

[0168] In addition, the aggregation context is the standardized integrated content formed during the result aggregation process, which includes at least a number of information such as enhanced problem description, step execution order, execution unit information, parameter binding results, evidence fragments, statistical content, and anomaly records.

[0169] For example, the expression formula for aggregation context is as follows:

[0170] In the formula, A unified aggregation context representing the result aggregation phase; This represents the process of structuring and organizing results, used to integrate multiple types of data to generate a standardized aggregation context. This represents the set of execution results for all steps. This represents a set of exceptions or errors that occur during execution. This represents the executable step plan after parameter binding and rule enhancement; This indicates an enhanced problem statement obtained by combining the compressed historical context with the current problem.

[0171] In addition, the situation analysis results are the output after the results are aggregated. This content is divided into two parts: one part is the analysis conclusion in natural language form for users, and the other part is the structured process information used for auditing and review work, such as call chains, key parameter mapping relationships, evidence summaries and anomaly information.

[0172] For example, the formula for expressing the situation analysis results is as follows:

[0173] In the formula, This indicates the final output of the situation analysis task; This refers to the large language model that participates in generating the final conclusion, used to perform comprehensive judgment and generate answers based on the aggregated context. Represents the unified aggregation context for the result aggregation phase.

[0174] The resulting aggregation process can be expressed by the following formula:

[0175] In the formula, This indicates the final output of the situation analysis task; This module represents the result aggregation and output generation module, used to integrate execution results, user questions, and compressed history to generate the final analysis answer; This represents the set of results from all execution steps. This indicates the current situation analysis question input by the user; This indicates the compressed historical context.

[0176] It should be understood that by integrating the execution result set, the initial pending situation analysis issues, and the original historical context, and initiating result aggregation operations, the execution data, step information, anomaly records, and original input content are organized and integrated into a standardized aggregation context. Based on this aggregation context, comprehensive analysis, conflict resolution, and content organization are performed. Combined with the overall analysis logic, natural language analysis conclusions and structured process information for audit review are generated. After integrating these two types of content into a unified whole, it is output as the situation analysis result.

[0177] This embodiment provides a semantic-driven situational analysis method. It simplifies the original historical context through compression and generates enhanced problem statements, reducing redundant information from interfering with subsequent processing. Simultaneously, it completes the implicit semantic content of the problem, making the analysis requirements more fully expressed. A standardized, structured sequence of steps is generated and executed. The results are aggregated and integrated to produce situational analysis results, ensuring that the conclusions are supported by sufficient evidence. This approach improves the executability of situational analysis tasks and avoids generating misleading situational analysis results.

[0178] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in the first embodiment described above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 3 Following step S30, the semantic-driven situational analysis method further includes steps S301 to S306: Step S301: When the intent type of the structured step sequence is a preset intent type, insert a knowledge retrieval step at the beginning of the executable step plan; It should be noted that intent type is a classification identifier within the structured step sequence, used to categorize situational analysis tasks. Preset intent types are pre-defined task categories, including knowledge query and general question-and-answer tasks that require analysis based on static situational security knowledge. The knowledge retrieval step is a standardized execution step specifically designed to retrieve content from the static situational security knowledge base, providing objective knowledge support for subsequent analysis and reasoning.

[0179] It should be understood that the corresponding intent type identifier in the structured step sequence is first read, and the identifier is compared with the preset intent type. When the two match, it is determined that the current situation analysis task needs to call static knowledge content. Then, a knowledge retrieval step is added at the beginning of the executable step plan, so that the knowledge retrieval operation becomes the pre-process of the entire executable step plan execution flow.

[0180] Step S302: When performing the knowledge retrieval step, obtain the reference question set and keyword set of the knowledge item from the knowledge item set; It should be noted that the knowledge entry set is a comprehensive collection of various static security knowledge, encompassing categories such as security common sense, threat intelligence, security rules, and fault descriptions. Each knowledge entry is an independent piece of knowledge within the set, and each entry is accompanied by two types of indexes: a set of reference questions and a set of keywords. The reference question set is a collection of standardized queries corresponding to each knowledge entry, with a style consistent with typical security questions, used to match user questions at a complete semantic level. The keyword set is a collection of core security terminology, network entities, and specialized vocabulary corresponding to each knowledge entry, used to match user questions at a key content level.

[0181] For example, let the set of knowledge items be... Each knowledge entry Includes a set of reference questions Keyword set and knowledge content N represents the number of knowledge items in the knowledge item set.

[0182] It should be understood that when the process progresses to the knowledge retrieval step and begins execution, the entire set of knowledge entries is traversed. For each independent knowledge entry, its corresponding set of reference questions and set of keywords are extracted. The contents of these two sets are organized as the basic data for subsequent similarity calculation.

[0183] Step S303: Calculate the similarity between the enhanced question statement and the reference question set to obtain the reference question matching score; It should be noted that the reference question matching score is the optimal score obtained by calculating the similarity between the enhanced question statement and each statement in the reference question set. This score reflects the degree of fit between the current user's question and the corresponding reference question.

[0184] It should be understood that, taking the enhanced question statement as the comparison subject, semantic similarity is calculated with all statements in the reference question set corresponding to a single knowledge item in turn, and the result with the highest value is selected from all the calculation results and determined as the reference question matching score corresponding to this knowledge item.

[0185] For example, the formula for calculating the reference question matching score is as follows:

[0186] In the formula, the subscript Indicates the serial number identifier of the knowledge entry; Indicates the first The matching score of each knowledge item under the reference question dimension; This represents the function for finding the maximum value. This refers to a single reference question text; Indicates the first A set of reference questions corresponding to each knowledge item; This represents the function for calculating cosine similarity. Represents a vector coding model; This indicates an enhanced problem statement obtained by combining the compressed historical context with the current problem.

[0187] Step S304: Calculate the similarity between the enhanced question statement and the keyword set to obtain the keyword matching score; It should be noted that the keyword set consists of core situational security terms associated with corresponding knowledge entries. These terms are key identifiers for identifying the attribution of knowledge content. The keyword matching score is the optimal score obtained by calculating the similarity between the enhanced question statement and each term in the keyword set. This score reflects the strength of the association between the core content of the user's question and the keywords of the knowledge entries. This score and the reference question matching score belong to two different matching dimensions, focusing on the semantics of the complete sentence and the association of core terms, respectively.

[0188] It should be understood that, taking the enhanced question expression as the comparison subject, for the same set of keywords corresponding to a knowledge item, the similarity between words and question text is calculated one by one, all calculation results are integrated and the highest value is selected to determine the keyword matching score corresponding to this knowledge item.

[0189] For example, the formula for calculating the keyword matching score is as follows:

[0190] In the formula, the subscript Indicates the serial number identifier of the knowledge entry; Indicates the first The matching score of each knowledge item under the keyword dimension; This represents the function for finding the maximum value. Represents a single keyword; Indicates the first The set of keywords corresponding to each knowledge item; This represents the function for calculating cosine similarity. Represents a vector coding model; This indicates an enhanced problem statement obtained by combining the compressed historical context with the current problem.

[0191] Step S305: The reference question matching score and the keyword matching score are weighted and fused to obtain the comprehensive matching score of the knowledge item; It should be noted that weighted fusion is a processing method that integrates and calculates scores from multiple dimensions according to pre-set weighting rules. Different weights can distinguish the importance of the two matching dimensions: reference question and keywords. The comprehensive matching score is the total score obtained by integrating the reference question matching score and the keyword matching score. This score combines the matching results of two dimensions: complete sentence semantics and core vocabulary association, and can comprehensively evaluate the overall fit between the enhanced question statement and individual knowledge items.

[0192] It should be understood that the pre-configured weight coefficients are retrieved, and the corresponding weight proportions of the reference question matching score and keyword matching score are assigned respectively. The two scores are then integrated into a total score in a weighted calculation method. This total score is used as the comprehensive matching score of the current knowledge item, thus completing the score fusion operation for a single knowledge item.

[0193] For example, the formula for calculating the overall matching score is as follows:

[0194] In the formula, the subscript Indicates the serial number identifier of the knowledge entry; Indicates the first The final search matching score after integrating knowledge from two dimensions; This represents the pre-defined weighting coefficients used to weight the scores of reference questions; Indicates the first The matching score of each knowledge item under the reference question dimension; This represents the pre-set weighting coefficients used for keyword scoring; Indicates the first The matching score of each knowledge item under the keyword dimension.

[0195] Step S306: Based on the comprehensive matching score, candidate knowledge items are determined from the set of knowledge items, and the knowledge retrieval database of the executable step plan is constructed based on the candidate knowledge items.

[0196] It should be noted that candidate knowledge items are those from the knowledge item set whose overall matching score meets the preset qualification standard and has a high degree of relevance to the current situation analysis problem. This type of content can provide effective knowledge support for this analysis. The preset qualification standard is a pre-set score limit used to filter knowledge content with reference value. The knowledge retrieval database is a corresponding database formed by integrating multiple candidate knowledge items after screening. It is specifically used for the executable steps of this round of dialogue, which can narrow the search scope and improve search efficiency.

[0197] It should be understood that by comparing the comprehensive matching score of each knowledge item with the preset qualification standard, the knowledge items that meet the score are selected as candidate knowledge items. All candidate knowledge items are then compiled and organized to form a corresponding knowledge retrieval database, which is then used as the output of the knowledge retrieval step for subsequent executable steps to be called upon.

[0198] Figure 4 This is a schematic diagram of the parameter binding and step enhancement process provided in Embodiment 2 of the semantic-driven situational analysis method of this application. Figure 4 As shown, starting from the structured step plan, entity extraction and context construction are executed sequentially, placeholder replacement is performed, and missing parameters are automatically filled. Then it is determined whether it belongs to knowledge query or general question and answer and does not contain knowledge retrieval steps. If the result is yes, a default knowledge retrieval step is inserted. If the result is no, the original step plan is kept. Both paths eventually output an executable step plan to complete the complete process of parameter binding and step enhancement.

[0199] This embodiment provides a semantically driven situational analysis method. In this implementation, the insertion of a knowledge retrieval step is determined based on the intent type of the structured step sequence, accurately identifying analysis tasks requiring static knowledge support. Similarity calculation is performed using a dual-dimensional approach of a reference question set and a keyword set, adapting to both complete sentence forms and fragmented vocabulary forms of situational security question expressions. A weighted fusion method yields a comprehensive matching score, enriching the dimensions of the matching evaluation. Candidate knowledge items are filtered based on the comprehensive matching score, and a corresponding knowledge retrieval database is constructed, eliminating content with low relevance and simplifying the retrieval data source. This improves the knowledge retrieval strategy in situational analysis scenarios, providing sufficient and effective static knowledge support for subsequent analysis stages and enhancing the completeness of the situational analysis results.

[0200] For example, to help understand the implementation process of the semantic-driven situational analysis method obtained by combining this embodiment with the above embodiment one, please refer to... Figure 5 , Figure 5 A simplified flowchart of a semantic-driven situational analysis method is provided, specifically: Starting with user input, the process proceeds to the historical context compression stage, then to the task orchestration model stage, which includes template matching, generation and supplementation, and failure rollback. Next, it enters the parameter binding and step enhancement stage, which includes placeholder replacement, auto-completion, and default knowledge retrieval. After passing through the unified execution scheduling stage, the process is finally completed through the result aggregation and output stage, thus finishing the situation analysis and processing flow.

[0201] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the semantic-driven situational analysis method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0202] This application also provides a semantic-driven situational analysis device, please refer to... Figure 6 The semantic-driven situational analysis device includes: The text compression module 10 is used to compress the situation analysis problem to be processed and the original historical context to obtain compressed historical context and enhanced problem description. Task orchestration module 20 is used to orchestrate tasks based on the compressed historical context and the enhanced problem statement to obtain a structured sequence of steps; The plan generation module 30 is used to determine an executable step plan based on the structured step sequence, the compressed historical context, and the enhanced problem statement; The execution planning module 40 is used to plan and determine the set of execution results based on the executable steps. The situation analysis module 50 is used to aggregate the results based on the execution result set, the situation analysis question, and the original historical context, and output the situation analysis results.

[0203] In one embodiment, the text compression module 10 is further configured to determine the first retention historical round text and the historical round text to be filtered from the original historical context according to a preset retention round; Determine the relevance score between the query text of the first retained historical round text and the historical round text to be filtered; Based on the relevance score, the texts of the historical rounds to be screened are filtered to obtain the second set of retained historical rounds texts; A compressed historical context is obtained based on the first and second preserved historical round texts; Based on the compressed historical context, the problem to be processed in the situation analysis is enhanced to obtain an enhanced problem statement.

[0204] In one embodiment, the task orchestration module 20 is further configured to normalize the enhanced problem statement to obtain a normalized problem statement; The normalized problem statement is matched with the template problem in the preset template library to obtain the target similarity. When the target similarity is greater than or equal to a preset similarity threshold, the template step skeleton corresponding to the target similarity is extracted from the preset template library; When the target similarity is less than the preset similarity threshold, the enhanced question statement, the preset execution unit set, and the preset template example are input into the large language model to obtain candidate steps; Based on the template step skeleton or the candidate steps, task orchestration is performed to obtain a structured step sequence.

[0205] In one embodiment, the plan generation module 30 is further configured to extract an entity set from the enhanced problem statement; A semantic context is constructed based on the enhanced question statement, the compressed historical context, and the entity set; Extract placeholder parameters from the structured step sequence; Based on the semantic context, a parameter matching score is determined between the candidate placeholder values ​​and the placeholder parameters; The target binding value is determined from the placeholder candidate values ​​based on the parameter matching score; An executable step plan is determined based on the target binding value and the structured step sequence.

[0206] In one embodiment, the plan generation module 30 is further configured to generate placeholder candidate values ​​based on the semantic context; The type matching score of the candidate placeholder value is determined based on the parameter type of the placeholder parameter; Determine the explicit occurrence score of the placeholder candidate values ​​in the situation analysis problem to be addressed; The text proximity score of the placeholder candidate value is determined based on the round proximity distance; The name suitability score of the candidate placeholder value is determined based on the execution unit name corresponding to the placeholder parameter. The parameter matching score between the candidate placeholder value and the placeholder parameter is determined based on the type matching score, the explicit occurrence score, the text proximity score, and the name suitability score.

[0207] In one embodiment, the plan generation module 30 is further configured to obtain the first parsing step corresponding to the target binding value from the structured step sequence; The placeholder parameters of the first step to be parsed are replaced based on the target binding value to obtain the first executable step; The second step to be parsed is determined from the structured step sequence based on the first step to be parsed; When the second step to be parsed is a preset step type, the placeholder parameters of the second step to be parsed are replaced based on the target type entity of the current context to obtain the second executable step; When the second step to be parsed is not of the preset step type, the placeholder parameter of the second step to be parsed is marked as unparsed, and the third executable step is obtained. An executable step plan is obtained based on the first executable step, the second executable step, and the third executable step.

[0208] In one embodiment, the execution planning module 40 is further configured to initialize the execution result set and the current global state; Iterate through the executable step plan to obtain the call type, execution unit name, and step parameters of the current step to be executed; Based on the current global state and the call type, the corresponding situation analysis agent or situation analysis tool is invoked to execute the current step to be executed, obtain the current execution result, and update the current global state based on the current execution result; When the current execution result is successful, the current execution result, the execution unit name, and the step parameters are written into the execution result set; Return to the step that iterates through the executable steps plan, obtains the call type, execution unit name, and step parameters of the current step to be executed, until the current global state is updated to the target global state.

[0209] In one embodiment, the plan generation module 30 is further configured to insert a knowledge retrieval step at the beginning of the executable step plan when the intent type of the structured step sequence is a preset intent type; When performing the knowledge retrieval step, the reference question set and keyword set of the knowledge item are obtained from the knowledge item set; Calculate the similarity between the enhanced question statement and the reference question set to obtain the reference question matching score; Calculate the similarity between the enhanced question statement and the keyword set to obtain a keyword matching score; The reference question matching score and the keyword matching score are weighted and fused to obtain the comprehensive matching score of the knowledge item; Candidate knowledge entries are determined from the set of knowledge entries based on the comprehensive matching score, and a knowledge retrieval database for the executable step plan is constructed based on the candidate knowledge entries.

[0210] The semantic-driven situation analysis device provided in this application, employing the semantic-driven situation analysis method described in the above embodiments, can solve the technical problem of how to improve the executability of situation analysis tasks and avoid generating situation analysis results with illusions. Compared with the prior art, the beneficial effects of the semantic-driven situation analysis device provided in this application are the same as those of the semantic-driven situation analysis method provided in the above embodiments, and other technical features in the semantic-driven situation analysis device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0211] This application provides a semantic-driven situational analysis device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the semantic-driven situational analysis method in Embodiment 1 above.

[0212] The following is for reference. Figure 7 This document illustrates a structural diagram of a semantic-driven situational analysis device suitable for implementing embodiments of this application. The semantic-driven situational analysis device in these embodiments may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 7 The semantic-driven situational analysis device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0213] like Figure 7As shown, a semantic-driven situational awareness device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.) that can perform various appropriate actions and processes based on programs stored in ROM (Read Only Memory) 1002 or programs loaded from storage device 1003 into RAM (Random Access Memory) 1004. RAM 1004 also stores various programs and data required for the operation of the semantic-driven situational awareness device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via bus 1005. Input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, LCDs (Liquid Crystal Displays), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the semantic-driven situational analysis device to communicate wirelessly or wiredly with other devices to exchange data. Although the figure shows a semantic-driven situational analysis device with various systems, it should be understood that it is not required to implement or possess all the systems shown. More or fewer systems can be implemented alternatively.

[0214] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0215] The semantic-driven situation analysis device provided in this application, employing the semantic-driven situation analysis method described in the above embodiments, can solve the technical problem of how to improve the executability of situation analysis tasks and avoid generating situation analysis results with illusions. Compared with the prior art, the beneficial effects of the semantic-driven situation analysis device provided in this application are the same as those of the semantic-driven situation analysis method provided in the above embodiments, and other technical features in this semantic-driven situation analysis device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0216] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0217] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0218] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, which are used to execute the semantic-driven situational analysis method in the above embodiments.

[0219] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, RAM (Random Access Memory), ROM (Read Only Memory), EPROM (Erasable Programmable Read Only Memory), or flash memory, optical fiber, CD-ROM (CD-Read Only Memory), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0220] The aforementioned computer-readable storage medium may be included in a semantic-driven situation analysis device; or it may exist independently and not assembled into a semantic-driven situation analysis device.

[0221] The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by a semantically driven situation analysis device, the semantically driven situation analysis device performs the following: compression processing based on the situation analysis problem to be processed and the original historical context to obtain a compressed historical context and an enhanced problem statement; performs task orchestration based on the compressed historical context and the enhanced problem statement to obtain a structured sequence of steps; determines an executable step plan based on the structured step sequence, the compressed historical context, and the enhanced problem statement; determines an execution result set based on the executable step plan; and aggregates the results based on the execution result set, the situation analysis problem, and the original historical context to output the situation analysis result.

[0222] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including LAN (Local Area Network) or WAN (Wide Area Network)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0223] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0224] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0225] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described semantic-driven situation analysis method. This addresses the technical problem of improving the executability of situation analysis tasks to avoid generating illusory situation analysis results. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the semantic-driven situation analysis method provided in the above embodiments, and will not be elaborated upon here.

[0226] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the semantic-driven situational analysis method described above.

[0227] The computer program product provided in this application solves the technical problem of how to improve the executability of situation analysis tasks to avoid generating illusory situation analysis results. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the semantic-driven situation analysis method provided in the above embodiments, and will not be repeated here.

[0228] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A semantic-driven based situation analysis method, characterized in that, The semantic-driven situational analysis method includes: Based on the situation analysis problem to be processed and the original historical context, compression processing is performed to obtain compressed historical context and enhanced problem statement; Based on the compressed historical context and the enhanced problem statement, task orchestration is performed to obtain a structured sequence of steps; Extract the entity set from the enhanced problem statement; A semantic context is constructed based on the enhanced question statement, the compressed historical context, and the entity set; Extract placeholder parameters from the structured step sequence; Based on the semantic context, a parameter matching score is determined between the candidate placeholder values ​​and the placeholder parameters; The target binding value is determined from the placeholder candidate values ​​based on the parameter matching score; An executable step plan is determined based on the target binding value and the structured step sequence; Based on the executable steps, a set of execution results is determined; Based on the execution result set, the situation analysis question, and the original historical context, the results are aggregated and the situation analysis results are output.

2. The method as described in claim 1, characterized in that, The steps of compressing the situation analysis problem and the original historical context to obtain a compressed historical context and an enhanced problem statement include: The first historical round text to be retained and the historical round text to be filtered are determined from the original historical context according to the preset retention round; Determine the relevance score between the query text of the first retained historical round text and the historical round text to be filtered; Based on the relevance score, the texts of the historical rounds to be screened are filtered to obtain the second set of retained historical rounds texts; A compressed historical context is obtained based on the first and second preserved historical round texts; Based on the compressed historical context, the problem to be processed in the situation analysis is enhanced to obtain an enhanced problem statement.

3. The method as described in claim 1, characterized in that, The steps of arranging tasks based on the compressed historical context and the enhanced problem statement to obtain a structured sequence of steps include: The enhanced problem statement is normalized to obtain a normalized problem statement; The normalized problem statement is matched with the template problem in the preset template library to obtain the target similarity. When the target similarity is greater than or equal to a preset similarity threshold, the template step skeleton corresponding to the target similarity is extracted from the preset template library; When the target similarity is less than the preset similarity threshold, the enhanced question statement, the preset execution unit set, and the preset template example are input into the large language model to obtain candidate steps; Based on the template step skeleton or the candidate steps, task orchestration is performed to obtain a structured step sequence.

4. The method as described in claim 1, characterized in that, The step of determining the parameter matching score between the candidate placeholder value and the placeholder parameter based on the semantic context includes: Based on the semantic context, candidate values ​​for placeholders are generated; The type matching score of the candidate placeholder value is determined based on the parameter type of the placeholder parameter; Determine the explicit occurrence score of the placeholder candidate values ​​in the situation analysis problem to be addressed; The text proximity score of the placeholder candidate value is determined based on the round proximity distance; The name suitability score of the candidate placeholder value is determined based on the execution unit name corresponding to the placeholder parameter. The parameter matching score between the candidate placeholder value and the placeholder parameter is determined based on the type matching score, the explicit occurrence score, the text proximity score, and the name suitability score.

5. The method as described in claim 1, characterized in that, The step of determining the executable step plan based on the target binding value and the structured step sequence includes: Obtain the first parsing step corresponding to the target binding value from the structured step sequence; The placeholder parameters of the first step to be parsed are replaced based on the target binding value to obtain the first executable step; The second step to be parsed is determined from the structured step sequence based on the first step to be parsed; When the second step to be parsed is a preset step type, the placeholder parameters of the second step to be parsed are replaced based on the target type entity of the current context to obtain the second executable step; When the second step to be parsed is not of the preset step type, the placeholder parameter of the second step to be parsed is marked as unparsed, and the third executable step is obtained. An executable step plan is obtained based on the first executable step, the second executable step, and the third executable step.

6. The method as described in claim 1, characterized in that, The step of determining the set of execution results based on the executable step plan includes: Initialize the execution result set and the current global state; Iterate through the executable step plan to obtain the call type, execution unit name, and step parameters of the current step to be executed; Based on the current global state and the call type, the corresponding situation analysis agent or situation analysis tool is invoked to execute the current step to be executed, obtain the current execution result, and update the current global state based on the current execution result; When the current execution result is successful, the current execution result, the execution unit name, and the step parameters are written into the execution result set; Return to the step that iterates through the executable steps plan, obtains the call type, execution unit name, and step parameters of the current step to be executed, until the current global state is updated to the target global state.

7. The method according to any one of claims 1 to 6, characterized in that, Following the step of determining the executable step plan based on the structured step sequence, the compressed historical context, and the enhanced problem statement, the method further includes: When the intent type of the structured step sequence is a preset intent type, a knowledge retrieval step is inserted at the beginning of the executable step plan; When performing the knowledge retrieval step, the reference question set and keyword set of the knowledge item are obtained from the knowledge item set; Calculate the similarity between the enhanced question statement and the reference question set to obtain the reference question matching score; Calculate the similarity between the enhanced question statement and the keyword set to obtain a keyword matching score; The reference question matching score and the keyword matching score are weighted and fused to obtain the comprehensive matching score of the knowledge item; Candidate knowledge entries are determined from the set of knowledge entries based on the comprehensive matching score, and a knowledge retrieval database for the executable step plan is constructed based on the candidate knowledge entries.

8. A semantically driven situational analysis device, characterized in that, The device includes: The text compression module is used to compress the situation analysis problem to be processed and the original historical context to obtain compressed historical context and enhanced problem description. The task orchestration module is used to orchestrate tasks based on the compressed historical context and the enhanced problem statement to obtain a structured sequence of steps; The plan generation module is used to extract an entity set from the enhanced problem statement; construct a semantic context based on the enhanced problem statement, the compressed historical context, and the entity set; extract placeholder parameters from the structured step sequence; determine a parameter matching score between placeholder candidate values ​​and the placeholder parameters based on the semantic context; determine a target binding value from the placeholder candidate values ​​based on the parameter matching score; and determine an executable step plan based on the target binding value and the structured step sequence. The execution plan module is used to plan and determine the set of execution results based on the executable steps. The situation analysis module is used to aggregate the results based on the execution result set, the situation analysis question, and the original historical context, and output the situation analysis results.

9. A semantic-driven situational analysis device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the semantic-driven situational analysis method as described in any one of claims 1 to 7.

Images