Information processing method and system based on five-layer knowledge graph and nlp

Abstract

The application discloses an equal protection evaluation method and system based on a five-layer knowledge graph and NLP, belongs to the technical field of network security, and further relates to a knowledge graph and natural language processing technology. The method solves the problems of low efficiency of an existing equal protection evaluation method, subjective differences in understanding of standard clauses, inconsistent understanding and determination conclusions of different evaluators on the same requirement, frequent rework in a report review link, delayed report template regular update, high maintenance cost of existing scripts and tools, and the like. The method comprises the following steps: obtaining a structured entity list and a relationship list through a three-level progressive NLP extraction method; generating a structured collection task through construction of a five-layer knowledge graph; performing data collection by using a multi-protocol collection probe; obtaining a compliance determination result by using a two-stage determination model; aggregating scores by mapping to corresponding chapters of a report template and generating an evaluation report, collecting and manually correcting data specifications and generating a report; and updating the two-stage determination model through a hybrid incremental learning mechanism.

Description

Technical Field

[0001] This invention belongs to the field of network security technology and also relates to knowledge graph and natural language processing technologies. Background Technology

[0002] Cybersecurity Classified Protection Assessment (hereinafter referred to as "Classified Protection") is an important means of ensuring the security of information systems.

[0003] Currently available automated tools and technical solutions for assisting assessment generally suffer from the following four shortcomings: 1. Only covers post-event verification, not the entire execution process. Most existing solutions focus on the compliance verification stage after the assessment report is completed, performing keyword matching or semantic checks on the report text. However, these solutions do not cover the most time-consuming stages in the assessment process: standard analysis, evidence collection, and compliance assessment.

[0004] 2. Insufficient depth of knowledge modeling. Some solutions employ knowledge graph technology, but these graphs typically only model down to the level of standard clauses and control measures, failing to extend to specific data sources and evidentiary elements. In other words, the system knows which control item to look up, but doesn't know which parameter to retrieve from which configuration file on which device.

[0005] 3. Lack of automated data collection capabilities. Existing solutions generally lack the ability to actively connect to the system under test and automatically collect configuration data. Technical evidence still requires assessors to manually log into the device to obtain it, and then import it into the system for analysis, resulting in low work efficiency due to manual operation.

[0006] 4. In the current assessment process, the main steps still require assessment by evaluators. Due to subjective differences in the evaluators' understanding of the standard clauses, different evaluators have different understandings and judgments on the same requirement, which leads to frequent rework in the report review process, reducing work efficiency. At the same time, it also requires the existing assessment auxiliary tools to be repeatedly adapted and modified, increasing the auxiliary maintenance cost.

[0007] 5. Compliance assessment does not differentiate between requirements of varying strength. The cybersecurity standards use the terms "should," "appropriately," and "may" to indicate requirements of different strengths, each with entirely different impacts on the assessment conclusion. However, existing solutions typically use a uniform scoring rule for assessment, without differentiating between requirements of varying strengths. Summary of the Invention

[0008] This invention addresses the problems of inefficiency in existing information security assessment methods, subjective differences in the interpretation of standard clauses, inconsistent understanding and judgments of the same requirement by different assessors, frequent rework in the report review process, and high maintenance costs due to the need for repeated adaptation and modification of existing scripts and tools as standard clauses and report templates are updated regularly.

[0009] The technical solution provided by this invention: Option 1: A method for assessing compliance with information security standards based on a five-layer knowledge graph and NLP, including the following steps: S1: Extract the received information security standard document into a structured entity list and relationship list using a three-level progressive NLP extraction method; S2: Construct a five-layer knowledge graph based on the entity list and relation list; the five-layer knowledge graph includes five node types and four edge types; The five node types include standard clause nodes, control measure nodes, assessment method nodes, data source nodes, and evidence element nodes; The four edge types include HAS_MEASURE edge, ASSESSED_BY edge, TARGETS edge, and REQUIRES_EVIDENCE edge; S3: Based on the five-layer knowledge graph, a structured data collection task is generated by traversing the graph from the standard clause node down to the evidence element node. S4: Based on the structured acquisition task, use a multi-protocol acquisition probe to perform data acquisition and obtain standardized evidence objects; S5: Input the standardized evidence object and the corresponding standard requirement text into the two-stage judgment model, and output the compliance judgment result using differentiated judgment logic. The two-stage judgment model includes the first-stage SBERT semantic matching model and the second-stage LLM secondary judgment model. S6: Map the compliance determination results to the corresponding chapters of the report template, aggregate the scores and generate an assessment report, wait to receive the assessment report review results from the assessors, and generate manually corrected data based on the review results; S7: Based on the manually corrected data, the two-stage decision model is updated through a hybrid incremental learning mechanism, which includes three parallel channels: periodic full-scale fine-tuning, automatic rule generation, and single-sample online adaptation.

[0010] In a further preferred embodiment, the three-level progressive NLP extraction method in step S1 includes: the first level uses regular expressions to extract text with a fixed format; the second level uses the BERT-BiLSTM-CRF sequence labeling model to identify free text that cannot be processed by regular expressions; and the third level is used to call the LLM quadratic decision model for calibration when the confidence level output by the second-level BERT-BiLSTM-CRF sequence labeling model is lower than 0.7 or when there is a logical contradiction between the entity and its relationship at the extraction point.

[0011] In a further preferred embodiment, in step S2, the standard clause node includes at least the clause number attribute, the original text of the clause attribute, the standard attribute, and the chapter attribute. The control measure node includes at least identity authentication attributes, description attributes, requirement intensity attributes, and security category attributes, wherein the requirement intensity attributes include should, should be, and may be. The evaluation method node includes at least a method type attribute, which includes: verification, interview, and test. The data source node includes at least device type attributes, IP address attributes, and communication protocol attributes; The evidence element node includes at least the inspection command attribute, parameter name, expected value attribute, and expected operator attribute.

[0012] In a further preferred embodiment, in step S2, the HAS_MEASURE edge is used to connect the standard clause node and the control measure node; The ASSESSED_BY edge is used to connect the control measure node and the evaluation method node; The TARGETS edge is used to connect the evaluation method node and the data source node; The REQUIRES_EVIDENCE edge is used to connect the data source node and the evidence element node.

[0013] In a further preferred embodiment, step S3, the generation of the structured acquisition task includes: Starting from the standard clause node of each clause, the process proceeds down along the HAS_MEASURE edge, ASSESSED_BY edge, TARGETS edge and REQUIRES_EVIDENCE edge to the evidence element node. Each complete path from the standard clause node to the evidence element node generates a collection task. If a path breaks in the middle during the traversal, the control item will be marked as needing manual replacement. All generated acquisition tasks are deduplicated and merged according to IP address attributes and inspection command attributes, so that acquisition tasks with the same target device and the same command are executed only once, ultimately generating structured acquisition tasks.

[0014] In a further preferred embodiment, in step S4, the multi-protocol acquisition probes include SSH probes, WinRM probes, JDBC probes, NETCONF probes, RESTAPI probes, and offline export probes. The multi-protocol acquisition probe is uniformly adapted through a protocol adapter layer. The protocol adapter layer converts the uniform format input from the upper layer into specific operations corresponding to each protocol, and converts the acquisition results into standardized evidence objects in a uniform format.

[0015] In a further preferred embodiment, in step S5, the differentiation determination logic involves reading the required intensity attribute stored in the control measure node. When the required strength attribute is classified as "applicable" and the judgment result is non-compliant, it is marked as a mandatory non-compliant item that affects the information security score, and is identified in the report and a rectification suggestion is generated. In a further preferred embodiment, step S7 includes periodic full-scale fine-tuning, which includes SBERT fine-tuning and NER fine-tuning.

[0016] Option 2: A compliance assessment system based on a five-layer knowledge graph and NLP, wherein the system is used to implement the steps of any of the methods described in this invention, and the system includes: Standard parsing module: Used to receive the information security standard document and extract a structured list of entities and a list of relationships through a three-level progressive NLP extraction method; Knowledge graph construction module: used to construct a five-layer knowledge graph based on the entity list and relation list; the five-layer knowledge graph includes five node types and four edge types; The five node types are specifically: standard clause node, control measure node, assessment method node, data source node, and evidence element node. The four edge types are HAS_MEASURE edge, ASSESSED_BY edge, TARGETS edge, and REQUIRES_EVIDENCE edge.

[0017] Collection task orchestration module: Based on the five-layer knowledge graph, it generates structured collection tasks by traversing the graph from the standard clause node down to the evidence element node; Multi-protocol acquisition module: Based on the structured acquisition task, it uses a multi-protocol acquisition probe to perform data acquisition and obtain standardized evidence objects; Compliance determination module: Input the standardized evidence object and the corresponding standard requirement text into the two-stage determination model, and output the compliance determination result using differentiated determination logic. The two-stage determination model includes the first-stage SBERT semantic matching model and the second-stage LLM secondary determination model. Report generation module: Based on the compliance judgment results, it maps to the corresponding chapters of the report template, aggregates scores and generates an assessment report, and receives the assessment report from assessors for review, generating manually corrected data; Incremental learning module: Based on the manually corrected data, the judgment model is updated through a hybrid incremental learning mechanism, which includes three parallel channels: periodic full-scale fine-tuning, automatic rule generation, and single-sample online adaptation.

[0018] Option 3: A computer device comprising a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of any of the methods described in this invention.

[0019] Option 4: A computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implements the steps of any of the methods described in this invention.

[0020] Option 5: A computer program product for implementing light and temperature control, comprising computer instructions that, when executed by a processor, implement the steps of any of the methods described in this invention.

[0021] The information security compliance assessment method and system based on five-layer knowledge graph and NLP described in this invention introduces "knowledge graph" technology. Compared with existing technologies, the specific beneficial effects are as follows: 1. This invention constructs a five-layer knowledge graph to generate structured data collection tasks, combines multi-protocol data collection probes to perform data collection, and obtains standardized evidence objects. This shortens the most time-consuming evidence collection process in traditional manual assessments and solves the problems of low efficiency, subjective differences in the interpretation of standard clauses, and inconsistent understanding and judgment conclusions of different assessors for the same requirement in existing information security assessment methods.

[0022] 2. This invention constructs a five-layer knowledge graph through a three-level progressive NLP extraction method, which improves the modeling depth. By traversing the graph, it deduces from the standard clause node and control measure level down to the data source and evidence element node, filling the gaps in the data source and evidence element layers of existing technologies, and improving the accuracy of the system in deriving inspection commands from standard clauses to specific equipment.

[0023] 3. This invention frees evaluators from the tedious repetitive work of logging into each device, typing commands, extracting configurations, and copying parameters. They only need to review and correct the results when the system determines that the results are abnormal or the data collection fails, which improves work efficiency and reduces labor costs.

[0024] 4. This invention outputs a report generated from each processing result and uses it as a sample to optimize the system, achieving the effect of automatically correcting the system and significantly reducing system maintenance costs. Attached Figure Description

[0025] Figure 1 This is a flowchart illustrating the information security assessment method based on five-layer knowledge graph and NLP as described in Implementation Method 1.

[0026] Figure 2 This is a schematic diagram of the three-level progressive NLP extraction method in Implementation Method 1. Detailed Implementation

[0027] To facilitate understanding of the technical solutions claimed in this invention, the following specific embodiments are provided in conjunction with the accompanying drawings. These embodiments are merely used to explain the technical principles of the embodiments of this application and are not intended to limit the scope of protection of this application. Those skilled in the art can make reasonable adjustments to the embodiments given in the following specific embodiments based on their general knowledge in the art to adapt to specific application scenarios. It should also be noted that, for ease of description, only the parts related to this invention are shown in the accompanying drawings, not the entire structure.

[0028] Implementation Method 1, see Figure 1 This embodiment describes a method for assessing compliance with information security standards based on a five-layer knowledge graph and NLP, which includes the following steps: S1: Extract the received information security standard document into a structured entity list and relationship list using a three-level progressive NLP extraction method; S2: Construct a five-layer knowledge graph based on the entity list and relation list; the five-layer knowledge graph includes five node types and four edge types; The five node types include standard clause nodes, control measure nodes, assessment method nodes, data source nodes, and evidence element nodes; The four edge types include HAS_MEASURE edge, ASSESSED_BY edge, TARGETS edge, and REQUIRES_EVIDENCE edge; S3: Based on the five-layer knowledge graph, a structured data collection task is generated by traversing the graph from the standard clause node down to the evidence element node. S4: Based on the structured acquisition task, use a multi-protocol acquisition probe to perform data acquisition and obtain standardized evidence objects; S5: Input the standardized evidence object and the corresponding standard requirement text into the two-stage judgment model, and output the compliance judgment result using differentiated judgment logic. The two-stage judgment model includes the first-stage SBERT semantic matching model and the second-stage LLM secondary judgment model. S6: Map the compliance determination results to the corresponding chapters of the report template, aggregate the scores and generate an assessment report, wait for and receive the assessment report's review results from the assessors, and generate manually corrected data based on the review results; S7: Based on the manually corrected data, the two-stage decision model is updated through a hybrid incremental learning mechanism, which includes three parallel channels: periodic full-scale fine-tuning, automatic rule generation, and single-sample online adaptation.

[0029] In this embodiment, the three-level progressive NLP extraction method in step S1 includes: the first level uses regular expressions to extract text with a fixed format; the second level uses the BERT-BiLSTM-CRF sequence labeling model to identify free text that cannot be processed by regular expressions; and the third level is used to call the LLM secondary decision model for calibration when the confidence level output by the second-level BERT-BiLSTM-CRF sequence labeling model is lower than 0.7 or when there is a logical contradiction between the entity and its relationship at the extraction point.

[0030] Regular expressions only process text with highly fixed formats, specifically including the following categories: clause numbers, such as "8.1.4.2 a", chapter titles, keywords indicating the strength of requirements ("should", "should", "may"), date formats, and structured numbering in tables. These texts are characterized by their predictable format, allowing for precise matching using regular expressions. We define this level as a coarse filter, identifying all text with regular patterns to reduce the processing burden on subsequent models.

[0031] Text that cannot be processed by regular expressions is handled by the second level. This includes: natural language descriptions of control measures (such as "identification techniques should be combined with two or more methods, such as passwords, cryptography, and biometrics"), narrative text of evaluation methods, and semantic relationships across paragraphs. These texts are expressed flexibly and without a fixed format, requiring a deep learning model to understand their semantics for correct recognition. A preferred embodiment of this invention is that the second-level deep learning model uses the BERT-BiLSTM-CRF sequence labeling model.

[0032] In practical engineering, the text types processed by regular expressions and the BERT-BiLSTM-CRF sequence labeling model are largely non-overlapping (one processes text with fixed formats, and the other processes free text), resulting in very few conflicts. However, if the same text is indeed processed by both levels simultaneously—for example, if a text contains both numbered and descriptive content—the result of the BERT-BiLSTM-CRF sequence labeling model takes precedence, and the result of the regular expression is retained as an auxiliary feature for subsequent reference and is not directly used in the final output.

[0033] For complex text that regular expressions cannot handle, the BERT-BiLSTM-CRF sequence labeling model is used. BERT is responsible for converting each word into a vector representation containing contextual information; for example, BERT understands the five words "password complexity" as a whole concept. BiLSTM captures longer-distance contextual relationships based on BERT. CRF ensures that the final labeling result is reasonable overall. The corpus size and training parameters were fine-tuned on the self-labeled corpus of the information security compliance standard, as shown in Table 1. The identified entity types include control point number, control point name, evaluation method (verification, interview, and test), and requirement strength attributes (should, appropriate, and permissible).

[0034] Table 1

[0035] The third-level LLM secondary decision model is not permanently running; it is only automatically triggered under specific conditions. There are two triggering conditions: first, the confidence level of the second-level BERT-BiLSTM-CRF sequence labeling model output is below 0.7. This threshold was obtained through repeated parameter tuning on 500 labeled samples, covering most complex cases without excessively calling LLM and wasting resources; second, logical contradictions appear in the extracted entity list, such as control point numbers not matching chapter titles, or conflicting entities being identified within the same text segment. When either condition is met, the system automatically sends the original text fragment and the preliminary results from the BERT-BiLSTM-CRF sequence labeling model together to the LLM secondary decision model (ChatGLM or DeepSeek) for secondary verification and error correction. Since most standard documents have good text quality, the actual trigger rate is less than 15%.

[0036] After identifying the entity list, dependency parsing tools (LTP or HanLP) are used to extract the dependencies between entities, and an attention mechanism is used to classify the candidate relations to obtain the relation list.

[0037] The five-layer knowledge graph is stored in the Neo4j graph database using an attribute graph model.

[0038] In this embodiment, in step S2, the standard clause node includes at least the clause number attribute, the original text of the clause attribute, the standard attribute, and the chapter attribute. The control measure node includes at least identity authentication attributes, description attributes, requirement intensity attributes, and security category attributes, wherein the requirement intensity attributes include should, should be, and may be. The evaluation method node includes at least a method type attribute, which includes: verification, interview, and test. The data source node includes at least device type attributes, IP address attributes, and communication protocol attributes; The evidence element node includes at least the inspection command attribute, parameter name, expected value attribute, and expected operator attribute.

[0039] In this embodiment, in step S2, the HAS_MEASURE edge is used to connect the standard clause node and the control measure node to obtain which control measures are included in the standard clause. The ASSESSED_BY edge is used to connect the control measure node and the evaluation method node to obtain which evaluation methods are used to evaluate the control measure; The TARGETS edge is used to connect the evaluation method node and the data source node, so as to obtain which data sources the evaluation method needs to check; The REQUIRES_EVIDENCE edge is used to connect the data source node and the evidence element node to determine which evidence elements the data source needs to examine.

[0040] In this embodiment, step S3, the generation of the structured acquisition task, includes: Starting from the standard clause node of each clause, the process proceeds down along the HAS_MEASURE edge, ASSESSED_BY edge, TARGETS edge and REQUIRES_EVIDENCE edge to the evidence element node. Each complete path from the standard clause node to the evidence element node generates a collection task. If a path breaks in the middle during the traversal, the control item will be marked as needing manual replacement. All generated acquisition tasks are deduplicated and merged according to IP address attributes and inspection command attributes, so that acquisition tasks with the same target device and the same command are executed only once, ultimately generating structured acquisition tasks.

[0041] For each complete path leading to an evidence element node, the system reads the attributes of the data source node and the attributes of the evidence element node, and assembles this information into a structured data collection task.

[0042] For example, if there is a path in the graph: "Identity Authentication → Verification → Linux Server 192.168.1.100 → pam_google_authenticator Configuration", the system will automatically generate a data collection task: target IP=192.168.1.100, protocol=SSH, command=cat / etc / pam.d / system-auth, expected field=pam_google_authenticator.

[0043] The same server may be referenced by multiple control items. For example, authentication and access control may both need to query the same configuration file on the same Linux server. Without deduplication, this would result in repeated connections and executions. We perform deduplication and merging based on the target IP address and the command. The same command on the same device is executed only once, and the collected results are shared with all associated control measure nodes.

[0044] In this embodiment, the multi-protocol acquisition probes in step S4 include SSH probes, WinRM probes, JDBC probes, NETCONF probes, RESTAPI probes, and offline export probes. The multi-protocol acquisition probe is uniformly adapted through a protocol adapter layer. The protocol adapter layer converts the uniform format input from the upper layer into specific operations corresponding to each protocol, and converts the acquisition results into standardized evidence objects in a uniform format.

[0045] Because the communication protocols corresponding to the six types of probes differ significantly—for example, SSH probes use command lines, JDBC probes use SQL queries, and RESTAPI probes use HTTP requests—this invention designs a protocol adapter layer for unified adaptation. Each protocol has its own adapter plugin, similar to the approach used in printer drivers: the upper-layer scheduling module only needs to pass in a unified input format (target IP + credentials + collection instruction template). Each adapter plugin is responsible for translating this unified input into the specific operations of its respective protocol, and after execution, converting the results into standardized evidence objects for output. The advantage of this approach is that adding a new protocol only requires developing a new adapter plugin; the core task scheduling and result processing logic remains completely unchanged.

[0046] The most commonly used probes are SSH probes, which connect to Linux / Unix servers, establish connections using the paramiko library to execute commands, and collect configuration files and system parameters. Credentials are obtained through key pairs or temporary passwords distributed by the bastion host. For Windows environments, WinRM probes use PowerShell Remoting to collect registry entries, security policies, and event logs. JDBC probes are used to directly connect to databases and query encryption configurations, audit logs, and permission records using only read-only accounts. For network devices, NETCONF probes or SSH+CLI probes are used to collect ACL and SNMP configurations. For cloud platforms, RESTAPI probes use short-lived credentials to collect security group rules and Kubernetes configurations. For physically isolated devices that cannot be remotely connected, offline export tools are used to generate JSON data packets on the device, which are then imported into the system via an encrypted USB drive.

[0047] Because the probes need to connect to the production environment, this invention incorporates security features. For credential management, all credentials are uniformly encrypted using the SM4 national cryptographic algorithm and stored in a credential vault. Probes temporarily decrypt credentials each time they are used and destroy the plaintext in memory after use. SSH probes prioritize key pairs, and the database is enforced to use read-only accounts. For communication, all probes use encrypted channels (SSH / HTTPS / SSL) and are deployed in a management network segment isolated from the business network segment by firewalls. For auditing, every connection, command execution, and data read is logged and retained for at least 180 days. This retention period aligns with the security audit log retention requirements in GB / T 22239-2019.

[0048] The raw data acquired by multi-protocol acquisition probes have different formats. The system uniformly converts them into standardized evidence objects, the structure of which is defined as shown in Table 2: Table 2

[0049] In this embodiment, in step S5, the differentiation determination logic involves reading the required intensity attribute stored in the control measure node. When the required strength attribute is classified as "appropriate" and the judgment result is non-compliant, it is marked as a mandatory non-compliant item that affects the graded protection score, and is highlighted in red in the report with rectification suggestions generated. For example, when the required strength attribute is classified as appropriate and the judgment result is non-compliant, it is marked as a suggestion that does not affect the score, highlighted in yellow in the report, and accompanied by a risk description. When the required strength attribute is classable, compliance determination is not performed by default.

[0050] The SBERT semantic matching model is a model specifically designed to compare the similarity of meanings between two text segments. The basic model used in this invention is paraphrase-multilingual-MiniLM-L12-v2, with minor adjustments made based on historical evaluation data. Specifically, the evidence segment E and the standard requirement text R are input into the SBERT semantic matching model, respectively encoded as semantic vectors v_E and v_R. Then, the degree of matching between the two is calculated using the cosine similarity formula. sim(E,R)=(v_E.v_R) / (||v_E||*||v_R||), This formula calculates how similar two texts are in meaning, with the result ranging from 0 to 1. The closer to 1, the stronger the match. We set three intervals based on this value: values ​​above one threshold are directly considered compliant, values ​​below another threshold are directly considered non-compliant, and the middle interval is a fuzzy range, as shown in Table 2. For long text evidence containing multiple checkpoints, the TextRank algorithm (an automatic method for extracting key sentences) is first used to select the most crucial sentences before encoding, avoiding semantic dilution of long texts.

[0051] The accuracy of the SBERT semantic matching model is shown in Table 3.

[0052] Table 3

[0053] The accuracy figures in Table 3 appear different, but this is due to different statistical methods used at different stages. The 99.87% figure represents the final accuracy of the entire system after completing the entire process (including rule matching, model judgment, and manual review). The SBERT model itself has an F1 score of 90.5%, which only reflects the model's inherent capabilities and does not include rule-based or human intervention. The 98% to 99% figures represent the accuracy of judgments on mandatory clauses, as these clauses have clear requirements and relatively fixed evidence, leading to more accurate model judgments.

[0054] Within the fuzzy range, if the evidence fragment is relatively long and the similarity is in the upper-middle range, we will input the standardized evidence object and the corresponding standard requirement text into the LLM secondary decision model for fine-tuning. The prompt is: Please determine whether the following configuration / log meets the requirements of the information security standard, indicate yes / no and explain the reason. The conclusion of the LLM secondary decision model overrides the SBERT result with a higher weight. Fuzzy results that do not meet the triggering conditions are marked for manual review.

[0055] After obtaining all the judgment results, read the required intensity attribute of the control measure node in the graph and proceed to different processing branches: should, appropriate, or possible.

[0056] When the probe is unable to collect data due to timeout, authentication failure, or connection rejection, the system marks the status of the evidence object of the control measure as the corresponding error type, automatically enters the manual review queue, and marks "Unable to collect automatically, manual confirmation required" in the report.

[0057] Some control measures may not have a complete five-layer path (for example, the data source has not yet been configured for the newly added standard clauses). The system will list these control measures separately and prompt the assessor to manually supplement them.

[0058] In rare cases, the SBERT semantic matching model gives a similarity score slightly above the fuzzy range, while the LLM quadratic decision model classifies it as non-compliant. In such cases, the LLM quadratic decision model's result is prioritized, but the output results of both models are recorded for the assessor's reference. The assessor reviews the assessment report and generates manually corrected data. The manually corrected data obtained by the assessor is then used for incremental learning.

[0059] The core idea of ​​incremental learning is to transform the manually corrected data from assessors into the driving force for system evolution.

[0060] Table 4 shows the comparison of accuracy before and after incremental learning.

[0061] Table 4

[0062] In this embodiment, step S7, the periodic full-scale fine-tuning includes SBERT fine-tuning and NER fine-tuning.

[0063] Full fine-tuning is triggered every two weeks. The incremental dataset consists of corrected samples and replays of old samples (to prevent catastrophic forgetting, i.e., the model learning new things but forgetting old ones). The fine-tuning objective function for the SBERT semantic matching model is the weighted mean squared error loss. L=(1 / N)*sum_i[w_i*(sim(E_i,R_i)-y_i)^2], Where N is the total number of samples, w_i is the sample weight (high for corrected samples, low for old samples), and y_i is the human label (1 for compliance, 0 for non-compliance). The goal is to minimize the deviation between model prediction and human labeling.

[0064] Rules are automatically generated to handle pattern-based errors. For example, if we find that the model repeatedly judges "password notset" as compliant and is manually corrected, the system will automatically extract regular expressions from these high-frequency patterns, insert them into the rule base, and apply them in real time.

[0065] Single-sample online adaptation: When an emergency correction is needed, the system does not retrain the model; instead, it adds the semantic vector of the sample to the correction set C. Subsequent encounters with similar evidence dynamically adjust the judgment threshold using the formula theta_adj=theta_base-alpha*min_id(v_E_new,v_c_i), where theta_base is the base threshold, alpha is the adjustment strength coefficient, and d is the Euclidean distance between the new evidence and the nearest sample in the correction set. Closer distances indicate greater similarity, resulting in a more significant threshold reduction, allowing results that were just barely passing the threshold to re-enter the review process.

[0066] The reason for designing three parallel channels instead of just one is that the timeliness requirements vary greatly in actual use. Some errors need to be corrected immediately, and a two-week fine-tuning period is not feasible, hence the instant correction through single-sample online adaptation; some errors are recurring issues of the same type, and handling them with rules is more direct than retraining the model, hence the automatic rule generation. Regular fine-tuning is responsible for improving the overall capability; although slower, it yields the most solid results.

[0067] The test and experimental verification results using the information security assessment method based on the five-layer knowledge graph and NLP of this invention are shown in Table 5.

[0068] Table 5

[0069] A preferred testing scheme of this invention includes a Level 3 information security compliance system comprising two Linux application servers, one Windows domain controller server, one MySQL database, one Huawei firewall, and three Alibaba Cloud ECS instances. The knowledge graph is stored using the Neo4j graph library, the semantic model runs on an NVIDIA T4 GPU, the probes are deployed using Python 3.8+ on the management network segment, vector retrieval is performed using FAISS, and large models are accessed via API calls.

[0070] Implementation Method 2: This implementation method is an application of the five-layer knowledge graph and NLP-based information security assessment method described in Implementation Method 1 to Linux identity authentication.

[0071] The standard requires that "users should be identified using a combination of two or more authentication techniques, such as passwords, cryptographic techniques, and biometrics."

[0072] The system receives the standard requirement text and uses a three-level progressive NLP extraction method to identify the control measure node as the "identity authentication attribute," the requirement strength attribute as "should," and the evaluation method node as "verification." Based on a pre-built five-layer knowledge graph, the system proceeds from the standard clause node along the HAS_MEASURE edge to the control measure node (identity authentication attribute), then along the ASSESSED_BY edge to the evaluation method node (verification), along the TARGETS edge to the data source node (Linux server, IP 192.168.1.100), and finally along the REQUIRES_EVIDENCE edge to the evidence element node (check command attribute: cat / etc / pam.d / system-auth, expected operator attribute: contains, expected value attribute: pam_google_authenticator.so).

[0073] A structured data collection task is generated based on the above path: target IP = 192.168.1.100, protocol = SSH, command = cat / etc / pam.d / system-auth, expected field = pam_google_authenticator. The SSH probe in the multi-protocol data collection module connects to the target server, executes the command, returns the raw content "auth required pam_google_authenticator.so", and converts it into a standardized evidence object (containing the raw content, parsed value, collection status, etc.).

[0074] Read the requirement strength attribute (mandatory, corresponding to the "should" category) of the control measure node and enter the "should" category judgment branch. Input the evidence fragment and the standard requirement text into the first-stage SBERT semantic matching model, calculate the cosine similarity to 0.91, which is higher than the compliance threshold of 0.85, and directly judge it as "compliant".

[0075] The "Compliance" assessment result is mapped to the "Identity Authentication" section under the "Secure Communication Networks" chapter in the report template, marked as "Compliant," and the score is aggregated. The final assessment report is then output.

[0076] Implementation Method 3: This implementation method is the application of the five-layer knowledge graph and NLP-based information security assessment method described in Implementation Method 1 to Windows audit logs.

[0077] The standard requires that audit logs be protected, backed up regularly, and protected from unintended deletion, modification, or overwriting.

[0078] The BERT-BiLSTM-CRF sequence labeling model identified the control measure node as "security audit", the requirement intensity attribute as "should", and the method type attribute as "verification", extending the knowledge graph to the Windows event log registry configuration.

[0079] The registry was queried using the WinRM probe, and it returned MaxSize=20480 (20MB) and Retention=0 (the log was overwritten and not retained after it was full).

[0080] Upon reading the command, the SBERT semantic matching model calculated a similarity of 0.38, far below the non-compliance threshold, resulting in a direct non-compliance judgment. The report marked it as "Severely Non-compliant," highlighted in red, and automatically generated rectification suggestions: "Increase the audit log size to no less than 200MB, and set the retention policy to not overwrite old events."

[0081] Implementation Method 4: This implementation method is the application of the five-layer knowledge graph and NLP-based information security assessment method described in Implementation Method 1 to database access control.

[0082] The standard requirement is: "Security labels shall be set for important subjects and objects, and access of subjects to information resources with security labels shall be controlled".

[0083] The BERT-BiLSTM-CRF sequence labeling model identifies the control measure node as "access control", the requirement intensity attribute as "recommended", the method type attribute as "verification", and the knowledge graph extends to the GRANT permission table of MySQL.

[0084] Query user permissions and the mandatory_roles variable through a JDBC probe, and a permission list with more than 200 characters is returned.

[0085] After reading "recommended", the SBERT semantic matching model calculates a similarity of 0.78, which falls into the fuzzy interval and satisfies the trigger condition of the LLM secondary judgment model. After analysis by GLM-4, it is determined that: "Role permission management is configured but mandatory_roles is not set, the security label control is incomplete, and the requirement is not satisfied". Since the requirement intensity attribute is "recommended", it is finally marked as a recommendation item with a yellow mark, and is listed in the security problem summary.

[0086] Implementation Mode 5: This implementation mode is an application of the classified protection assessment method based on five-layer knowledge graph and NLP described in Implementation Mode 1 when network device collection fails.

[0087] The standard requirement is: "Access control rules shall be set according to access control policies between network boundaries or regions".

[0088] The control measure node "boundary protection", the requirement intensity attribute "required", the method type attribute "verification" are identified, and the knowledge graph extends to the ACL of Huawei firewalls.

[0089] An SSH probe is used to try to connect to 10.0.0.1, but the management port of the firewall is configured with an IP whitelist, and the network segment where the SSH probe is located is not in the whitelist, so the connection is rejected. The SSH probe returns collect_status=connection_refused. The system does not interrupt the assessment process, but marks this item as collection failure, adds it to the manual review queue, and marks "cannot collect automatically, manual confirmation is required" in the report. The assessor manually logs in to the firewall to supplement the evidence. This manual data is also recorded for subsequent optimization of the probe's network segment configuration.

Claims

1. A method for assessing information security compliance based on a five-layer knowledge graph and NLP, characterized in that, Includes the following steps: S1: Extract the received information security standard document into a structured entity list and relationship list using a three-level progressive NLP extraction method; S2: Construct a five-layer knowledge graph based on the entity list and relation list; the five-layer knowledge graph includes five node types and four edge types; The five node types include standard clause nodes, control measure nodes, assessment method nodes, data source nodes, and evidence element nodes; The four edge types include HAS_MEASURE edge, ASSESSED_BY edge, TARGETS edge, and REQUIRES_EVIDENCE edge; S3: Based on the five-layer knowledge graph, a structured data collection task is generated by traversing the graph from the standard clause node down to the evidence element node. S4: Based on the structured acquisition task, use a multi-protocol acquisition probe to perform data acquisition and obtain standardized evidence objects; S5: Input the standardized evidence object and the corresponding standard requirement text into the two-stage judgment model, and output the compliance judgment result using differentiated judgment logic. The two-stage judgment model includes the first-stage SBERT semantic matching model and the second-stage LLM secondary judgment model. S6: Map the compliance determination results to the corresponding chapters of the report template, aggregate the scores and generate an assessment report, wait to receive the assessment report review results from the assessors, and generate manually corrected data based on the review results; S7: Based on the manually corrected data, the two-stage decision model is updated through a hybrid incremental learning mechanism, which includes three parallel channels: periodic full-scale fine-tuning, automatic rule generation, and single-sample online adaptation.

2. The method for assessing information security compliance based on five-layer knowledge graph and NLP according to claim 1, characterized in that, In step S1, the three-level progressive NLP extraction method includes: the first level uses regular expressions to extract text with a fixed format; the second level uses the BERT-BiLSTM-CRF sequence labeling model to identify free text that cannot be processed by regular expressions; and the third level is used to call the LLM quadratic decision model for calibration when the confidence level output by the second-level BERT-BiLSTM-CRF sequence labeling model is lower than 0.7 or when there is a logical contradiction between the entity and its relationship at the extraction point.

3. The method for assessing information security compliance based on five-layer knowledge graph and NLP according to claim 1, characterized in that, In step S2, the standard clause node includes at least the clause number attribute, the original text of the clause attribute, the standard attribute, and the chapter attribute; The control measure node includes at least identity authentication attributes, description attributes, requirement intensity attributes, and security category attributes, wherein the requirement intensity attributes include should, should be, and may be. The evaluation method node includes at least a method type attribute, which includes: verification, interview, and test. The data source node includes at least device type attributes, IP address attributes, and communication protocol attributes; The evidence element node includes at least the inspection command attribute, parameter name, expected value attribute, and expected operator attribute.

4. The method for assessing information security compliance based on five-layer knowledge graph and NLP according to claim 1, characterized in that, In step S2, the HAS_MEASURE edge is used to connect the standard clause node and the control measure node; The ASSESSED_BY edge is used to connect the control measure node and the evaluation method node; The TARGETS edge is used to connect the evaluation method node and the data source node; The REQUIRES_EVIDENCE edge is used to connect the data source node and the evidence element node.

5. The method for assessing information security compliance based on five-layer knowledge graph and NLP according to claim 1, characterized in that, In step S3, the generation of the structured acquisition task includes: Starting from the standard clause node of each clause, the process proceeds down along the HAS_MEASURE edge, ASSESSED_BY edge, TARGETS edge and REQUIRES_EVIDENCE edge to the evidence element node. Each complete path from the standard clause node to the evidence element node generates a collection task. If a path breaks in the middle during the traversal, the control item will be marked as needing manual replacement. All generated acquisition tasks are deduplicated and merged according to IP address attributes and inspection command attributes, so that acquisition tasks with the same target device and the same command are executed only once, ultimately generating structured acquisition tasks.

6. The method for assessing information security compliance based on five-layer knowledge graph and NLP according to claim 1, characterized in that, In step S4, the multi-protocol acquisition probes include SSH probes, WinRM probes, JDBC probes, NETCONF probes, RESTAPI probes, and offline export probes. The multi-protocol acquisition probe is uniformly adapted through a protocol adapter layer. The protocol adapter layer converts the uniform format input from the upper layer into specific operations corresponding to each protocol, and converts the acquisition results into standardized evidence objects in a uniform format.

7. The method for assessing information security compliance based on five-layer knowledge graph and NLP according to claim 1, characterized in that, In step S5, the differentiation determination logic involves reading the required intensity attribute stored in the control measure node. When the required strength attribute is classified as "applicable" and the judgment result is non-compliant, it is marked as a mandatory non-compliant item that affects the information security level protection score, and is identified in the report and a rectification suggestion is generated.

8. The method for assessing information security compliance based on five-layer knowledge graph and NLP according to claim 1, characterized in that, In step S7, the periodic full-scale fine-tuning includes SBERT fine-tuning and NER fine-tuning.

9. A compliance assessment system based on a five-layer knowledge graph and NLP, characterized in that, The system is used to implement the method according to any one of claims 1-7, the system comprising: Standard parsing module: Used to receive the information security standard document and extract a structured list of entities and a list of relationships through a three-level progressive NLP extraction method; Knowledge graph construction module: used to construct a five-layer knowledge graph based on the entity list and relation list; the five-layer knowledge graph includes five node types and four edge types; The five node types are specifically: standard clause node, control measure node, assessment method node, data source node, and evidence element node. The four edge types are HAS_MEASURE edge, ASSESSED_BY edge, TARGETS edge, and REQUIRES_EVIDENCE edge; Collection task orchestration module: Based on the five-layer knowledge graph, it generates structured collection tasks by traversing the graph from the standard clause node down to the evidence element node; Multi-protocol acquisition module: Based on the structured acquisition task, it uses a multi-protocol acquisition probe to perform data acquisition and obtain standardized evidence objects; Compliance determination module: Input the standardized evidence object and the corresponding standard requirement text into the two-stage determination model, and output the compliance determination result using differentiated determination logic. The two-stage determination model includes the first-stage SBERT semantic matching model and the second-stage LLM secondary determination model. Report generation module: Based on the compliance judgment results, it maps to the corresponding chapters of the report template, aggregates scores and generates an assessment report, and receives the assessment report from assessors for review, generating manually corrected data; Incremental learning module: Based on the manually corrected data, the judgment model is updated through a hybrid incremental learning mechanism, which includes three parallel channels: periodic full-scale fine-tuning, automatic rule generation, and single-sample online adaptation.

10. A computer device comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes a computer program to implement the steps of the method according to any one of claims 1-8.

Images