Big model-based network security situation awareness bi page construction method and system

Abstract

The application provides a big model-based network security situation awareness BI page construction method and system, which can automatically and intelligently construct a page based on a user input security analysis requirement. The method comprises: performing semantic understanding on the user input security analysis requirement based on a big language model to obtain an intent description object containing an analysis target and a statistical index; determining a data set structure description of a data set required by the intent description object based on the intent description object, a semantic dictionary and a security analysis page design rule; performing reasoning on information required for page configuration of the intent description object, the semantic dictionary and the data set structure description of the data set required by the intent description object through the big language model to generate a page configuration template; and performing analysis and rendering on the page configuration template through a rendering engine to generate a corresponding network security situation awareness business intelligence (BI) page.

Description

Technical Field

[0001] This application relates to the field of network security situation awareness technology, and in particular to a method and system for constructing a network security situation awareness BI page based on a large model. Background Technology

[0002] With the continuous development of network security situation awareness systems, these systems typically acquire a large amount of security-related data through methods such as traffic probes, log collection, database auditing, and interface auditing. Based on data analysis and visualization, they provide situation monitoring and decision support for security operations and maintenance personnel.

[0003] In practical applications, operations and maintenance personnel or data analysts need to manually configure datasets and select visualization component types based on fixed data models or predefined analysis templates in the network security situation awareness system, according to constantly changing attack methods and analysis needs. They then build and publish the network security situation awareness business intelligence (BI) page through drag-and-drop or configuration methods. This page provides a visual presentation of security-related data and real-time analysis results, thus providing decision support for operations and maintenance personnel. However, the above solutions typically predefine a limited number of datasets and visualization templates, limiting users to selection or simple configuration within a template range. This makes it difficult to quickly respond to constantly changing security analysis needs, resulting in poor scalability and flexibility. Furthermore, manually configuring datasets relies on human understanding of database structure and the meaning of security fields, and selecting visualization component types requires understanding visualization configuration rules. The configuration process is complex, requires high levels of experience, has a long build cycle, and is prone to configuration errors, making it difficult to meet the real-time and agile requirements of security situation monitoring.

[0004] Therefore, there is an urgent need for a solution that can automatically and intelligently build a cybersecurity situational awareness BI page. Summary of the Invention

[0005] This application provides a method and system for constructing a network security situation awareness BI page based on a large model, which can automatically and intelligently construct a network security situation awareness BI page based on the security analysis requirements input by the user.

[0006] Firstly, a method for constructing a network security situation awareness BI page based on a large model is provided, including: Based on the large language model, semantic understanding is performed on the natural language descriptions for network security situation analysis received through the natural language interaction interface to obtain an intent description object containing analysis objectives and statistical indicators. Based on the intent description object, semantic dictionary and security analysis page design rules, the dataset structure description of the dataset required by the intent description object is determined. The semantic dictionary is used to associate fields with field semantic information in the data table of the data table that has been connected to the data source. The field semantic information includes information about the field in terms of business and analysis scenario. The dataset structure description is used to define the structure and source of the dataset. By reasoning about the information required for page configuration based on the intent description object, semantic dictionary, and dataset structure description of the dataset required by the intent description object through a large language model, a page configuration template is generated. The page configuration template is used to define the page structure, the component configuration of each component, and the layout parameters of each component. Each component references the dataset obtained through the dataset configuration object associated with the dataset structure description. The rendering engine parses and renders the page configuration template to generate the corresponding network security situation awareness business intelligence (BI) page.

[0007] In one feasible design, the dataset structure description of the dataset required for the intent description object is determined based on the intent description object, semantic dictionary, and security analysis page design rules, including: Based on the large language model, page-level business logic planning and reasoning are performed on the intent description object, semantic dictionary and security analysis page design rules to obtain page logic planning results, which include page-level planning information and component-level planning information. Based on the large language model, the dataset requirements are obtained by reasoning about the page logic planning results. If a matching dataset structure description exists in the database based on the dataset requirements, the matching dataset structure description is reused. The dataset structure description stored in the database includes basic dataset structure description or analytical dataset structure description. If, based on the dataset requirements, it is determined that there is a missing matching dataset structure description in the database, then, based on the intent description object and semantic dictionary, determine the roles of each field corresponding to the analysis master object of the intent description object, as well as the basic dataset structure description corresponding to each target data table in the associated target data tables. Based on the large language model, dataset structure reasoning is performed on the intent description object, the field roles corresponding to the analysis main object, and the basic dataset structure description corresponding to each target data table to generate dataset construction function instructions. Generate the corresponding dataset structure description based on the dataset construction function instructions.

[0008] In one feasible design, a large language model is used to infer the information required for page configuration based on the intent description object, semantic dictionary, and dataset structure description of the dataset required by the intent description object, generating a page configuration template, including: Based on the large language model, page-level structural reasoning is performed on the intent description object, semantic dictionary, dataset structure description of the dataset required by the intent description object, security monitoring scenario rules and page design specifications to generate a page structure planning object, which is used to describe the page structure. Based on the large language model, component-level semantic reasoning is performed on the dataset structure description required for the page structure planning object and intent description object, generating a component semantic definition object for each component. The component semantic definition object is used to describe the configuration of the component. The layout parameters of each component are determined based on the page structure planning object and the component semantic definition object of each component. Based on the large language model, the linkage relationship between components is inferred from the page logic planning results, the component semantic definition object of each component, the dataset structure description of the dataset required by the intent description object, the semantic dictionary and the consistency relationship information of the dataset dimension. A linkage rule planning object is generated to describe the linkage relationship between different components. Based on the page structure planning object, the component semantic definition object of each component, and the structured functional instructions corresponding to the linkage rule planning object, a page configuration template is generated in combination with the layout parameters of each component.

[0009] In a feasible design, the method also includes: If a change in the data structure of an already connected data source is detected, determine the semantic information of the fields that have changed in the data source, and update the semantic dictionary accordingly. Identify the target dataset affected by the data source; Based on the large language model, reasoning is performed on the intent description objects corresponding to the target dataset, the updated semantic dictionary, and the security analysis page design rules to obtain new dataset requirements; Determine the new dataset structure description corresponding to the target dataset based on the new dataset requirements; Update the page configuration template that references the target dataset based on the new dataset structure description; Replace the initial page configuration template in the page configuration library with the updated page configuration template.

[0010] In one feasible design, the semantic information of fields that have changed in the data source is determined based on a large language model, and the semantic dictionary is updated accordingly, including: Extract a predetermined number of data samples from the target field that has changed in the data source; Construct the context of the target field, which includes the name of the data table to which the target field belongs, the field name of the target field, the type of the target field, a preset number of data samples, and preset security business semantic prompts; The large language model is invoked to perform semantic reasoning on the context and generate structured field semantic information, which includes field business type, field role and business remarks information. Update the semantic dictionary based on the field semantic information and the target field.

[0011] In a feasible design, the method also includes: Based on the data structure scan results, determine the data tables contained in the connected data sources; Identify the semantic information of each field in each data table based on the semantic dictionary; The aggregation method and / or time field configuration of each field are determined based on the semantic information of each field in each data table; By integrating the data source, field name, aggregation method, and / or time field configuration of each data table, a dataset structure description of the basic dataset corresponding to each data table is generated, namely, the basic dataset structure description. Generate corresponding dataset configuration objects based on the basic dataset structure description of each data table, and store each dataset configuration object in the database.

[0012] In a feasible design, the method also includes: If a dataset with a changed structure is detected, the page referencing the dataset and the components within that page are determined based on the first dependency relationship. The first dependency relationship is used to represent the reference relationship between the page identifier, the component identifier, and the dataset identifier. Iterate through each component on the page that references the dataset, and for each component, perform the following steps: Determine whether the fields referenced by the component are included in the structure of the dataset; If any of the fields referenced by the component contain an initial field that is not included in the structure of the dataset, a replacement field that matches the semantics of the initial field is determined based on the semantic dictionary; Update the component's configuration based on the alternative fields; Based on the updated components, perform an incremental update on the page configuration template corresponding to the page, and generate a new page configuration template.

[0013] In a feasible design, the semantic dictionary also includes business notes corresponding to the fields, and alternative fields that match the semantics of the initial fields are determined based on the semantic dictionary, including: Fields in the semantic dictionary that have the same business type as the initial fields are identified as candidate fields. If the number of candidate fields is equal to 1, the candidate field is determined as the replacement field; If the number of candidate fields is greater than 1, the candidate fields that have the same field role as the initial field and belong to the same data table will be determined as new candidate fields. If the number of new candidate fields is equal to 1, the new candidate field will be determined as the replacement field; If the number of new candidate fields is greater than 1, the comprehensive score of each new candidate field is determined based on the similarity of the field name and business notes information between each new candidate field and the initial field. The new candidate field with the highest comprehensive score is determined as the replacement field.

[0014] In one feasible design, the page configuration template is parsed and rendered by a rendering engine to generate a corresponding network security situation awareness business intelligence (BI) page, including: Perform validation on the page configuration template, including page layout validation, component linkage detection, and dataset dependency integrity validation. If the page configuration template passes the validation, the rendering engine parses and renders the page configuration template to generate the corresponding network security situation awareness business intelligence (BI) page.

[0015] Secondly, a network security situation awareness BI page construction system based on a large model is provided, including: The intent analysis module is used to perform semantic understanding on the natural language descriptions for network security situation analysis received through the natural language interaction interface based on the large language model, and obtain intent description objects containing analysis objectives and statistical indicators. The dataset structure determination module is used to determine the dataset structure description of the dataset required by the intent description object based on the intent description object, semantic dictionary and security analysis page design rules. The semantic dictionary is used to associate fields with field semantic information in the data table of the data source that has been connected. The field semantic information includes information about the field in terms of business and analysis scenario. The dataset structure description is used to define the structure and source of the dataset. The page configuration template generation module is used to infer the information required for page configuration by using a large language model to analyze the intent description object, semantic dictionary, and dataset structure description of the dataset required by the intent description object. The page configuration template is used to define the page structure, the component configuration of each component, and the layout parameters of each component. Each component references the dataset obtained through the dataset configuration object associated with the dataset structure description. The page generation module is used to parse and render the page configuration template through the rendering engine to generate the corresponding network security situation awareness business intelligence (BI) page.

[0016] This application utilizes a large language model to parse unstructured security analysis descriptions into intent description objects containing analysis objectives and statistical indicators. This achieves an automatic transformation from vague requirements to explicit analysis objectives and statistical indicators, laying a precise semantic foundation for all subsequent operations. Subsequently, based on the intent description object, semantic dictionary, and security analysis page design rules, the dataset structure description required by the intent description object is accurately determined. This dataset structure description defines the structure of the dataset, solving the problem of "what kind of data is needed and how to retrieve the data."

[0017] The intent description provides the analytical objectives and core business elements (such as statistical indicators) for determining the dataset structure, specifying "what data is needed" to answer specific security questions. The semantic dictionary provides structured semantic knowledge of all fields in the accessed data source (including the business type of the fields and their role in the analysis), establishing a mapping relationship from business concepts to underlying data fields, indicating "where the data comes from and how to understand it." The security analysis page design rules provide domain-specific business specifications and constraints for determining the dataset structure, injecting data usage conventions and best practices in the security analysis scenario, ensuring that the generated dataset structure description meets the logical requirements of professional security monitoring. Therefore, the final dataset structure description accurately anchors business semantics while strictly adhering to the data source structure and security analysis specifications.

[0018] Based on this, the large language model is used to infer the information required for page configuration from the intent description object, semantic dictionary and dataset structure description, and automatically generate a page configuration template that defines the page structure, component configuration and layout parameters. The component references in the page configuration template are obtained through the dataset configuration object associated with the dataset structure description, thereby automatically completing the design of page layout, component selection and data binding.

[0019] Furthermore, the rendering engine parses and renders the page configuration template to generate a cybersecurity situational awareness business intelligence (BI) page. The entire process requires no manual intervention, solving the problems of traditional BI pages that require manual design of information structures and reliance on expert experience. It achieves automated planning from problem analysis to page logical architecture, reducing the professional threshold and time cost of building security situational awareness pages, and realizing efficient and intelligent automated page generation. Attached Figure Description

[0020] To more clearly illustrate the technical solution of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a schematic flowchart illustrating an exemplary embodiment of the network security situation awareness BI page construction method based on a large model provided in this application; Figure 2 This is a schematic diagram of an exemplary network security situation awareness BI page construction system based on a large model, provided in an exemplary embodiment of this application. Detailed Implementation

[0022] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0023] To address the issues in network security situation awareness systems, such as the reliance on manual configuration of security analysis datasets and visual monitoring interfaces (i.e., network security situation awareness BI pages), resulting in low construction efficiency and difficulty in quickly adapting to diverse security analysis needs, such as... Figure 1 As shown, this application provides a method for constructing a network security situation awareness BI page based on a large model, including: S110 performs semantic understanding on the natural language descriptions for network security situation analysis received through the natural language interaction interface based on a large language model, and obtains an intent description object containing analysis objectives and statistical indicators.

[0024] Specifically, the system obtains user-inputted analysis questions (i.e., natural language descriptions for network security situation analysis) through a natural language interaction interface. Examples include: viewing daily attack trends, counting weekly attack counts from various source IPs, and analyzing monthly high-risk account behavior. A large language model is then invoked to perform semantic understanding of the analysis questions, extracting analysis objectives and statistical indicators, and standardizing them to obtain structured intent description objects.

[0025] It should be noted that this application does not impose any restrictions on the framework of the large language model, as long as it can support semantic understanding and structured output.

[0026] For example, the intent description object also includes the time scope and analytical dimensions. That is, the large language model also extracts the time scope and analytical dimensions from the analytical question.

[0027] The structured intent description object is a structured data model used to transform user-input natural language analysis questions into standardized machine-understandable expressions. It establishes a unified intermediate expression between natural language analysis needs and the underlying data structure, decoupling the analysis intent from the data modeling and page generation processes. In the subsequent dataset construction phase, it serves as input for data requirement reasoning, guiding the large language model to select relevant data tables and fields from the semantic dictionary and generate dataset construction instructions. In the page generation phase, it serves as input for page planning, determining the page content, component types, and display logic.

[0028] S120, Determine the dataset structure description of the dataset required for the intent description object based on the intent description object, semantic dictionary, and security analysis page design rules.

[0029] Specifically, the dataset structure description required for the dataset is determined based on the dataset requirements. These requirements are generated through reasoning using a large language model based on the intent description object, semantic dictionary, and security analysis page design rules. This description serves to define the requirements for the dataset and guide subsequent dataset construction and query execution. The query in question refers to checking whether the required dataset structure description is stored in the database. The security analysis page design rules are design guidelines for the information architecture, component composition, and logical relationships of security analysis pages. They guide the large language model to translate security analysis requirements into page structure, such as determining core monitoring metrics, component type combinations, and inter-component business logic.

[0030] The semantic dictionary is used to associate fields in a data table that has been connected to the data source with field semantic information. The field semantic information includes information about the field in terms of business and analysis scenarios.

[0031] The dataset structure description is used to define the structure and origin of the dataset, which may include a base dataset or an analytical dataset.

[0032] The data sources and tables used in this application are described below: In this application, the data source refers to an accessible data storage instance used to provide raw data related to security posture. It can be a relational database instance (such as MySQL, PostgreSQL, etc.) or a non-relational data storage instance (such as Elasticsearch, Drois, etc.).

[0033] A data source typically contains multiple data tables or equivalent data structures (such as indexes, sets, etc.), with each data table used to store a specific type of security data (such as attack log tables, user behavior tables, etc.).

[0034] For example, dynamic awareness of the data source structure can be achieved in the following way: (1) Data structure scanning: Regularly scan the database system (i.e., the data source) metadata tables to obtain the following structural information for each data table: table name, field names, field types, primary key and index information, field update timestamps, field data samples, etc.; among them, the metadata table is a special table that stores the structural information of the data table and is used to describe the metadata of the data table. One metadata table usually corresponds to multiple data tables. The data structure scan results of the metadata table are constructed into a data structure description object with a unified format; The data structure description object is stored in the system structure description area, serving as the basis for subsequent difference detection and dataset generation.

[0035] (2) Identification of data structure changes: Maintain a snapshot of the current system structure description area and a snapshot of the historical structure, and perform difference calculations on the two to identify one or more of the following change types: Add a data table, delete a data table, add a data table field, delete a field, or change the field type; When a structural change is detected (i.e., a change in the structural snapshot), a structural difference description object is generated, triggering subsequent semantic dictionary and dataset update processes. This structural difference description object includes the name of the newly added data table, the name of the deleted data table, the name of the newly added field (including newly added fields in a newly added data table and / or newly added fields in an existing data table) and the name of its parent data table, the name of the deleted field and the name of its parent data table, the name of the field whose type has changed, the initial field type and the changed field type of the field whose type has changed, and the name of the data table to which the field whose type has changed belongs.

[0036] The above example enables real-time awareness of changes in the data source structure, so as to trigger subsequent semantic dictionary updates and dataset updates in a timely manner.

[0037] When a newly added or structurally changed data table or field is detected, information about the newly added field and / or the field whose field type has changed (i.e., information about the target field) is obtained from the structural difference description object, and the semantic dictionary is updated in the following way: Extract a predetermined number of data samples from the target field that has changed in the data source; Construct the context of the target field, which includes the name of the data table to which the target field belongs, the field name of the target field, the type of the target field, a preset number of data samples, and preset security business semantic prompts; The large language model is invoked to perform semantic reasoning on the context and generate structured field semantic information, which includes field business type, field role and business remarks information. Update the semantic dictionary based on the field semantic information and the target field.

[0038] Among them, the field business type is used to identify the business semantic category corresponding to the field, such as source Internet Protocol (IP) address, destination IP address, username, attack type, time field, etc., to support dataset construction and component field selection; Field roles describe the functional roles of fields in an analysis scenario. Examples include dimension fields for grouping analysis, indicator fields (i.e., metric fields) for numerical aggregation calculations, time fields for time series analysis, and identifier fields, which can guide data aggregation and visualization mapping.

[0039] Business notes are used to supplement the business meaning of data tables or fields, serving as auxiliary information for semantic understanding. As a natural language description, business notes can enhance semantic matching capabilities, playing a supporting role in field matching, ambiguity resolution, and multi-candidate field selection.

[0040] For example, the semantic dictionary can be updated based on the semantic information of the field and the target field in the following way: Extract structured information such as the field name, field type, table identifier, and data source identifier of the target field from the structural difference description object; If the target field is a newly added field, add the structured information of the target field to the semantic dictionary; If the target field is a field whose field type has changed, replace the initial field type of the target field in the semantic dictionary with the changed field type; The large language model is invoked to generate structured functional instructions for semantic updates based on the semantic information of the target field. The functional instructions are executable commands with specific syntactic structures and semantic meanings. Perform legality checks on function instructions used for semantic updates; Map the functional instructions used for semantic updates to internal configuration update operations; Perform an internal configuration update operation to write the field semantic information to the storage location corresponding to the target field in the semantic dictionary.

[0041] As can be seen, the semantic dictionary is a system-level unified semantic management structure used to provide a unified semantic description of data tables and fields in all connected data sources within the system. Its content originates from the system's automatic scanning of data structures and semantic inference results based on a large language model. The semantic information of all data table fields is uniformly stored in the same semantic dictionary. Each field (referring to the field structure object from the data table in the data source, including structured information such as field name, field type, and the identifier of the data table it belongs to) corresponds to a semantic description record in the semantic dictionary. The semantic dictionary organizes semantic information through a hierarchical structure of "data source - data table - field". Therefore, the semantic dictionary can also be described as storing the mapping relationship between fields and their semantic information.

[0042] It should be understood that the semantic dictionary exists in an initialized state before the first update, and its contents are empty; each subsequent update is based on the previous semantic dictionary snapshot for incremental synchronization.

[0043] For example, the semantic dictionary also contains semantic descriptions at the data table level, which describe the overall business purpose of the data table.

[0044] The above embodiments, upon detecting changes in the data structure, construct rich contextual information for newly added or changed "target fields" using actual data samples and preset business prompts. They then invoke a large language model for deep semantic reasoning, generating a structured semantic description containing precise field business types, field roles, and business notes. This ultimately achieves real-time and accurate updates to the semantic dictionary. Furthermore, by periodically scanning the database structure in the network security situation awareness system, combined with field sample extraction and large-model semantic reasoning, the above embodiments automatically generate field-level semantic information and construct a unified semantic dictionary. This solves the problems of traditional BI systems relying on manual maintenance of field meanings and difficulty in timely adaptation to data structure changes. It achieves automatic understanding and semantic unification of secure data structures, providing a stable semantic foundation for subsequent dataset construction and page planning.

[0045] The dataset (i.e., the basic dataset) in each data table can be directly applied to the component for display. Based on the aforementioned semantic dictionary, this application automatically generates a dataset configuration object for the basic dataset for each data table in the following way, and the method also includes: Based on the data structure scan results, determine the data tables contained in the connected data sources; Identify the semantic information of each field in each data table based on the semantic dictionary; The aggregation method and / or time field configuration of each field are determined based on the semantic information of each field in each data table; By integrating the data source, field name, aggregation method, and / or time field configuration of each data table, a basic dataset structure description for each data table is generated. Generate corresponding dataset configuration objects based on the basic dataset structure description of each data table, and store each dataset configuration object in the database.

[0046] The data structure scan result refers to the data structure obtained by scanning the metadata table after the data source is connected.

[0047] The basic dataset structure description is a structured modeling result of a single data table in the data source, which describes the analyzable form of that data table in the BI page.

[0048] The dataset configuration object is used to structurally define how the dataset is acquired and / or the computation logic.

[0049] For example, the description of the underlying dataset structure includes one or more of the following: Data source: including the data table to which it belongs and the identifier of the corresponding data source; Field list: Includes the set of fields from the data table that are involved in the analysis; Aggregation method: This includes the aggregation calculation method for indicator fields (such as counting, summing, etc.); Time field configuration: Includes fields used for time statistics and time granularity information.

[0050] The aggregation method for a field can be determined in the following way: Method 1: Preset the aggregation method of the field according to the field's business type and field role. For example, the metric field (i.e. the measurement field) is an aggregateable field.

[0051] Method 2: Based on the data type and business semantics of the fields, the aggregation method of the fields is preset. For example, numerical statistical fields, such as alarm number prediction, are aggregated by default as average; count fields, such as alarm count, are aggregated by default as summation; status or category fields, such as alarm type, are not included in the aggregation or are only used for grouping.

[0052] In subsequent analytical dataset generation or data query command construction, aggregation methods can be invoked based on the user's intent description object, or adjusted in specific scenarios. For example, in 7-day security alert trend analysis, after determining the time field, grouping by time (GROUP BY) is performed, and the alarm quantity field is aggregated using the default COUNT method to complete the statistics. The field aggregation method can be used as the default calculation rule in subsequent analysis processes, providing basic support for the construction of the final data query command together with grouping logic, etc.

[0053] The time field configuration is used not only to identify whether the field is a time type, but also to support the construction of time-dimensional analysis and data query commands, including one or more of the following information: Time field identifier: Used to identify a field as a time field and record its data type (such as timestamp, date type or string time format). Time format information: Used to describe the time representation of the field, such as "yyyyMMdd" or standard timestamp format, to support parsing and conversion; Time analysis configuration: Used to support subsequent analysis processes, including supported time granularity (such as hour, day, week, month) and whether time range filtering is supported.

[0054] In the subsequent dataset generation and page construction process, time grouping logic and time filtering conditions can be automatically generated based on the time field configuration.

[0055] For example, this is achieved by generating a corresponding dataset configuration object based on the underlying dataset structure description of each data table in the following way: Supplement execution strategies and metadata management information, such as assigning unique dataset identifiers, recording creation time and version number, setting default data refresh cycles and sorting rules, and integrating data access control and dependency records; The information contained in the basic dataset structure description, execution strategy, and metadata management information are encapsulated into a standardized internal configuration object (i.e., a dataset configuration object) according to the preset format required by the data service layer, and written to the dataset configuration storage table in the database. The dataset identifier is then added to the basic dataset structure description and written to the dataset structure description storage table in the database. In other words, the basic dataset structure description and the corresponding dataset configuration object are associated through the same dataset identifier. The dataset configuration object supports subsequent dynamic loading of datasets, version rollback, and permission verification.

[0056] When performing visualization or data analysis tasks, the front-end rendering engine sends a data request to the back-end data service layer based on the dataset identifier associated with the component contained in the page configuration object. The data service layer reads the corresponding dataset configuration object based on the dataset identifier carried in the data request, dynamically generates a query statement (such as SQL), and sends a query request (i.e., a data query instruction) to the underlying data source or computing engine. After obtaining the required dataset (including datasets from the underlying data source or statistical data from the computing engine after statistical analysis of the dataset), it returns it to the front-end rendering engine, which then displays it through the corresponding components. This process applies to both basic dataset configuration objects and analytical dataset configuration objects.

[0057] As can be seen, the dataset configuration object (i.e., the dataset configuration object of the basic dataset or the dataset configuration object of the analytical dataset) is used to describe the data acquisition and / or computation logic. Its essence is a structured definition of data access and computation, which enables the system to generate corresponding queries and obtain data during execution.

[0058] It should be noted that the above embodiments can automatically generate and save the dataset configuration object by calling the preset FunctionCall interface.

[0059] The core function of generating dataset structure descriptions and dataset configuration objects in this application is to decouple the "structure definition" and "execution management" of the dataset. The dataset structure description focuses on recording static structural information such as data source, field list, and field roles, providing a standardized data format description for subsequent dataset inference and automatic page construction. The dataset configuration object, on the other hand, supplements the structure description with execution strategies (such as refresh cycle and sorting rules) and metadata management information (such as unique identifiers, version numbers, access control, and dependencies), thereby supporting dynamic loading, version rollback, and access control of the dataset. This separation design ensures that when the execution strategy or management information needs adjustment (such as modifying the refresh frequency or updating permissions), only the configuration object needs to be updated, without altering the underlying structure description. When performing visualization or analysis tasks, the data service layer reads the corresponding configuration object based on the dataset identifier, which can both obtain structural information to generate query statements and control query behavior according to the execution strategy, ultimately achieving efficient and secure data acquisition.

[0060] The above embodiment automatically identifies data tables in the connected data source through data structure scanning and, combined with pre-stored field semantic information in the semantic dictionary, automatically determines the aggregation method and time field configuration for each data table. It then integrates the data source, field names, aggregation method, and time configuration to generate a standardized basic dataset structure description, which is ultimately transformed into a persistent dataset configuration object and stored in the database. This embodiment achieves fully automated generation of basic dataset configuration objects, ensuring high efficiency and standardization in the construction of the underlying data model.

[0061] In a feasible design, the automatic update of the page configuration template is achieved by using changes in the dataset structure as the trigger source: If a dataset with a changed structure is detected, the page referencing the dataset and the components within that page are determined based on the first dependency relationship. The first dependency relationship is used to represent the reference relationship between the page identifier, the component identifier, and the dataset identifier. Iterate through each component on the page that references the dataset, and for each component, perform the following steps: Determine whether the fields referenced by the component are included in the structure of the dataset; If any of the fields referenced by the component contain an initial field that is not included in the structure of the dataset, a replacement field that matches the semantics of the initial field is determined based on the semantic dictionary; Update the component's configuration based on the alternative fields; Based on the updated components, perform an incremental update on the page configuration template corresponding to the page, and generate a new page configuration template.

[0062] As a further example, if none of the fields referenced by the component are initial fields not included in the structure of the dataset, the processing flow for that component ends.

[0063] The updated component configuration includes updating field mapping relationships and correcting related parameters.

[0064] For example, a dataset that detects structural changes can be implemented in the following way: Determine the identifiers of the data tables included in the structural difference description object and / or the identifiers of the data tables to which the fields belong; Based on the identifier of at least one data table involved in the structural difference description object, determine whether there is a dataset whose data source includes any of the identifiers of at least one data table. If present, the dataset whose data source includes the identifier of at least one data table is identified as the dataset whose structure has changed. Furthermore, if it does not exist, it is determined that no dataset with structural changes has been detected.

[0065] Further exemplarily, determining whether a dataset exists whose data source includes any of the identifiers of at least one data table, based on the identifiers of at least one data table involved in the structural difference description object, includes: Record the names of the fields involved in exceptions that occur during query execution (such as fields not existing, type mismatch, etc.), and determine the identifier of the supplementary data table to which the field belongs from the semantic dictionary based on the field name; Based on the identifiers of at least one data table involved in the structural difference description object and the identifiers of supplementary data tables, determine whether there exists a dataset whose data source includes any of the identifiers of at least one data table.

[0066] When a field is deleted or undergoes structural changes, the field referenced in a component will not be found in the current dataset structure. The above embodiment quickly locates all pages and components referencing this dataset through a first dependency relationship and checks the persistence of component fields one by one. For missing initial fields, semantically consistent replacement fields are automatically matched based on a semantic dictionary. Then, based on the relevant information of the replacement fields in the semantic dictionary, the field mapping relationships of the affected component configurations are updated and related parameters are corrected, completing the reconstruction of component field mappings. For unaffected components and page structures (layout, component position, interaction relationships, etc.), the original configuration remains unchanged. A new page configuration template is generated based on this, and then the original page configuration template is replaced or overwritten, achieving a smooth page evolution. This process automatically corrects component configuration errors caused by data structure changes without manual intervention, avoiding abnormal page display or data loading failures.

[0067] In a feasible design, the semantic dictionary also includes business notes corresponding to the fields, which is achieved by determining alternative fields that match the semantics of the initial fields based on the semantic dictionary: Fields in the semantic dictionary that have the same business type as the initial fields are identified as candidate fields. If the number of candidate fields is equal to 1, the candidate field is determined as the replacement field; If the number of candidate fields is greater than 1, the candidate fields that have the same field role as the initial field and belong to the same data table will be determined as new candidate fields. If the number of new candidate fields is equal to 1, the new candidate field will be determined as the replacement field; If the number of new candidate fields is greater than 1, the comprehensive score of each new candidate field is determined based on the similarity of the field name and business notes information between each new candidate field and the initial field. The new candidate field with the highest comprehensive score is determined as the replacement field.

[0068] For example, this is achieved by determining the comprehensive score of each new candidate field based on the similarity of its field name to the initial field and the similarity of its business remarks information: The first similarity is obtained by multiplying the similarity between the field name of the new candidate field and the initial field by the first weight; The second similarity is obtained by multiplying the similarity between the new candidate field and the business notes information of the initial field by the second weight, and the sum of the first weight and the second weight is 1. The first similarity score is added to the second similarity score to obtain the comprehensive score of the candidate field.

[0069] The above example uses a hierarchical matching strategy to identify candidate fields, which can ensure semantic accuracy while taking into account matching efficiency and robustness.

[0070] In a feasible design, the dataset structure description for determining the dataset required to define the intent description object is achieved based on the intent description object, semantic dictionary, and security analysis page design rules, in the following manner: Based on the large language model, page-level business logic planning and reasoning are performed on the intent description object, semantic dictionary and security analysis page design rules to obtain page logic planning results, which include page-level planning information and component-level planning information. Based on the large language model, the dataset requirements are obtained by reasoning about the page logic planning results. If a matching dataset structure description exists in the database based on the dataset requirements, the matching dataset structure description is reused. The dataset structure description stored in the database includes basic dataset structure description or analytical dataset structure description. If, based on the dataset requirements, it is determined that there is a missing matching dataset structure description in the database, then, based on the intent description object and semantic dictionary, determine the roles of each field corresponding to the analysis master object of the intent description object, as well as the basic dataset structure description corresponding to each target data table in the associated target data tables. Based on the large language model, dataset structure reasoning is performed on the intent description object, the field roles corresponding to the analysis main object, and the basic dataset structure description corresponding to each target data table to generate dataset construction function instructions. Generate the corresponding dataset structure description based on the dataset construction function instructions.

[0071] Among them, analytical dataset structure description refers to the dataset structure definition that includes data processing logic, which is generated based on one or more basic dataset structure descriptions, the data source, the intent description object, and semantic dictionary reasoning, and is used to support the data form and calculation rules of a specific analysis scenario.

[0072] Specifically, the large language model is invoked, triggering it to perform page-level business logic planning and reasoning on the intent description object, each field in the semantic dictionary, and the corresponding field semantic information, as well as the security analysis page design rules (which may also include historical page structure templates). This yields a structured page logic planning result output by the large language model. The page logic planning result includes page-level planning information (e.g., page theme, core page monitoring metrics, page display objectives, page layout structure, overall display logic, etc.) and component-level planning information (e.g., the types of visualization components the page should include, their display content, field requirements, data display methods, and business logic relationships between components, etc.). Then, by invoking the large language model based on the field requirements defined in the component-level planning information (including analysis dimensions, statistical indicators, and time granularity, etc.) and the page-level planning objective constraints, the required dataset requirements can be inferred, such as attack trend charts or attack data aggregated by time.

[0073] The database is checked for a matching dataset structure description using semantic matching. If a matching description exists, it is reused. If not, the process of building the dataset configuration object for the analytical dataset needs to be initiated, as shown below: (1) Generate dataset construction function instructions Based on the intent description object, semantic parsing is performed using a large language model to identify the semantic elements required for analysis, including the main analysis object (i.e., the core analytical entity extracted by the large language model from the intent description object), target business type, time dimension, analytical dimension, and aggregation metrics. The semantic dictionary is used to retrieve a set of fields matching the semantic elements, identifying the field business type, field role information, and the identifier of the target data table to which each field belongs. When fields originate from multiple target data tables, the connection relationships between these tables are further determined, forming a complete set of related data tables. The corresponding basic dataset structure description is retrieved from the database using the identifier of the target data table. Then, the large language model is invoked, triggering it to perform dataset structure reasoning on the intent description object, the field roles corresponding to the main analysis object, and the basic dataset structure description corresponding to each target data table. This yields accurate, structured dataset construction function instructions for the analytical dataset, which may include the following: 1) Analyze the main object and its corresponding data table; 2) Data source structure: including whether it involves multiple tables and their relationships; 3) Field selection results: including time dimension fields, analysis dimension fields, and aggregated indicator fields, etc. 4) Data processing logic: including field conversion, calculation rules, and filtering conditions; 5) Aggregation and grouping rules: including grouping fields and aggregation methods, etc. 6) Output dataset structure: including The names and types of the output fields. Used for subsequent calls to visualization components; Dataset building function instructions are used to instruct the execution of the definition of an analytical dataset (which can be executed by the function instruction execution module).

[0074] (2) Definition of analytical dataset for constructing functional instructions based on dataset 1) Verify the legality of the instructions, including whether the fields exist, whether the field semantics match, and whether the data access permissions meet the requirements. This operation can ensure that the dataset construction instructions are executable in three dimensions: physical, semantic, and permission. 2) Complete the semantics of the instruction, including automatically completing the default time granularity, automatically setting the default sorting rules, and automatically setting the data execution cycle. This operation can ensure the integrity of the parameters of the dataset construction instruction to support the generation of data configuration objects for subsequent analytical datasets.

[0075] Among them, field existence verification refers to verifying whether the field information involved in the dataset construction function instruction actually exists in the data table structure of the corresponding data source (i.e., physical existence) to ensure the executability of subsequent data processing operations. If a field fails validation, it is determined that the field is unusable, meaning the dataset construction function instruction is invalid. The process of defining the analytical dataset is terminated, or the large language model is called to correct the current dataset construction function instruction.

[0076] The field semantic matching verification refers to, if the field exists and the verification passes, obtaining the semantic attribute information of the field from the semantic dictionary based on the semantic elements corresponding to the intent description object, including the field business type, field role and semantic remarks information; comparing the semantic elements with the semantic attribute information of the field to determine whether the field meets the analysis requirements; If the analysis requirements are not met, the field is determined to be unavailable, i.e., the dataset construction function instruction is invalid. The process of defining the analytical dataset is terminated or the large language model is called to correct the current dataset construction function instruction.

[0077] Data access permission verification refers to verifying whether the user's access permissions to the relevant data source are fully authorized for read, join, and aggregation operations if the analysis requirements are met. If permissions are insufficient, the definition process of the analytical dataset is terminated. Otherwise, semantic completion instructions are executed to generate supplementary dataset construction instructions to complete the definition of the analytical dataset structure.

[0078] (3) Computational strategies for generating analytical datasets The computational strategy is generated based on the information included in the functional instructions constructed according to the intent description object and the supplemented dataset. The computational strategy is generated comprehensively based on the semantics of the intent description object, the structural features of the dataset, and preset scheduling rules. Specifically: First, obtain the following information: 1) The semantic information of the intent description object includes: analysis target, time range, statistical period, statistical indicators, and whether it is trend analysis, etc., which are used to determine the business scenario of data calculation; 2) Dataset structure characteristics: including the time field configuration corresponding to the selected fields, aggregation indicators and grouping dimensions, etc., which are used to determine the data calculation logic and update granularity; 3) Semantic rules and preset strategy library: This library stores the mapping relationship between various typical business scenarios and scheduling strategies. For example, business scenarios involving time trends correspond to periodic scheduling tasks; Then, the large language model is used to reason about the above information and generate a calculation strategy. The calculation strategy includes: data calculation method (e.g., full calculation or incremental calculation), execution method (scheduled scheduling or single execution), task trigger time and cycle, etc.

[0079] (4) Generate dataset configuration objects for analytical datasets to form a persistent dataset generation mechanism. Supplementing execution strategies and metadata management information involves encapsulating the information, execution strategies, and metadata management information included in the dataset construction function instructions into a dataset configuration object, and supplementing the corresponding parameters in the dataset configuration object based on the computation strategy. The dataset generated based on this dataset configuration object (i.e., the analytical dataset configuration object) is an analytical dataset.

[0080] Simultaneously, by integrating information from the dataset construction function instructions, computation strategies, and dataset identifiers from metadata management information, an analytical dataset structure description is generated and stored in the database for subsequent querying. The analytical dataset structure description and the dataset configuration object are associated through the same dataset identifier. The analytical dataset structure description mainly includes the following information: Data source: determined based on the main object of analysis and its corresponding data table, and the data source structure; Field list: determined based on field selection results and output dataset structure; Aggregation method: Determined based on the aggregation method in the aggregation and grouping rules; Time field configuration: determined based on the time dimension field in the field selection results and the default time granularity automatically filled in; Data processing operation instructions are determined based on one or more of the following information: The data source structure includes multi-table relationships; field transformation, calculation rules, filtering conditions, and time window settings in the data processing logic; aggregation and grouping rules; auto-completing default sorting rules; and automatically set data execution cycles. Among these, time window settings are used to limit the time range covered by data calculations (such as sliding windows, fixed time intervals, etc.).

[0081] As can be seen, analytical dataset configuration objects are not directly derived from the data table structure like basic dataset configuration objects. Instead, they are generated through reasoning based on intent description objects, semantic dictionaries, and basic dataset structure descriptions. Compared to basic datasets generated from basic dataset configuration objects, analytical dataset configuration objects include data processing operation instructions, meaning that the analytical datasets generated from them support complex business scenarios (for example, if the alarm level field in an alarm data table is stored as a numerical code (such as 1, 2, 3), an analytical dataset containing high-risk, medium-risk, and low-risk semantics can be generated based on the mapping relationship of the semantic dictionary). This difference directly determines the dataset requirements of different types of visualization components. For example, components that perform detailed queries and direct presentation do not need to perform complex transformations, associations, or aggregation calculations on the data; their core function is to display the original or simply filtered records from the data source, requiring only association with the basic dataset. However, for components that require aggregation analysis, trend display, and multi-source association, they must rely on data views generated from analytical datasets processed by pre-processed data processing logic (such as association, grouping, and aggregation). In other words, the dataset configuration object for a basic dataset is used to structurally define how the dataset is acquired, while the dataset configuration object for an analytical dataset is used to structurally define how the dataset is acquired and the computational logic.

[0082] In other words, the basic dataset structure description, built upon a single data table, maps the data storage structure to the analytical semantic structure, serving as the foundational layer for dataset modeling. The analytical dataset structure description, based on one or more basic dataset structure descriptions, generates analytical data objects through field selection, join calculations, aggregation, or business logic transformations, supporting specific analytical scenarios. Therefore, the relationship between the two is: the basic dataset structure description provides the semantic modeling foundation for the raw data, while the analytical dataset structure description enhances and processes the data based on business semantics.

[0083] Therefore, the dataset structure description included in the database may be a basic dataset structure description or an analytical dataset structure description.

[0084] This application uses a large language model to semantically understand the user's analytical questions, automatically infers the required dimensions, indicators, and time granularity, and generates structured dataset planning results. Through structured function calls, these results are persisted as periodically computable analytical datasets. This solves the problems of traditional BI systems, such as the need for manual dataset design, long modeling cycles, and difficulty in quickly responding to security analysis needs. It enables the automatic construction of data models from analytical intent, improving the efficiency and accuracy of data analysis.

[0085] (5) Store dataset configuration objects An analytical dataset configuration object is written to the dataset configuration storage table, and the analytical dataset configuration object and the corresponding analytical dataset structure description are associated with a unique identifier.

[0086] It's important to understand that since each basic dataset structure description corresponds to a data table, and the fields in each table are recorded in the semantic dictionary, the dataset requirements generated after the large language model infers the intent description object, semantic dictionary, and security analysis page design rules can directly find the corresponding basic dataset structure description in the database. When a matching dataset structure description is missing in the database, it means no basic dataset structure description meets the requirements, and the dataset configuration object generation process for the analytical dataset needs to be initiated.

[0087] The above embodiments input the intent description object, semantic dictionary, and security analysis page design rules into a large language model, enabling the model to accurately perform page logic planning and reasoning. The intent description object provides core semantics such as analysis objectives and statistical indicators; the semantic dictionary establishes the mapping relationship between business terms and data fields; and the security analysis page design rules standardize the page layout and component combination logic. Together, these three elements ensure that the page logic plan inferred by the large language model not only meets analysis needs but also accurately binds data fields and conforms to the display habits of security monitoring scenarios. Based on the accurate page logic planning results, the dataset requirements can be precisely determined, and based on these requirements, it can be determined whether a matching dataset structure description exists in the database. If not, the large language model is invoked again to perform dataset structure reasoning on the intent description object, the roles of each field corresponding to the main analysis object, and the basic dataset structure description corresponding to each target data table, generating dataset construction function instructions. Among them, the intent description object defines the target constraints of data requirements, the analysis of the field roles corresponding to the main object clarifies the field types of time, dimension and indicator, and the basic dataset structure description corresponding to each target data table provides available data sources and field lists. The three work together to enable the model to accurately generate dataset construction function instructions containing calculation logic such as field transformation, aggregation grouping, filtering and association, and then automatically and accurately generate dataset structure descriptions based on dataset construction function instructions.

[0088] S130: Through a large language model, reason about the information required for page configuration based on the intent description object, semantic dictionary, and dataset structure description of the dataset required by the intent description object, and generate a page configuration template.

[0089] The page configuration template is used to define the page structure, the component configuration of each component, and the layout parameters of each component. Each component references the dataset obtained through the dataset configuration object associated with the dataset structure description.

[0090] It should be noted that multiple different types of components (such as line charts, pie charts, and data tables) can reference the same dataset structure description, with different field mappings only based on their own display requirements.

[0091] For example, the page configuration template is also used to define the interaction relationships between components.

[0092] In one feasible design, this is achieved by using a large language model to infer the information required for page configuration based on the intent description object, semantic dictionary, and dataset structure description of the dataset required by the intent description object, thereby generating a page configuration template: Based on the large language model, page-level structural reasoning is performed on the intent description object, semantic dictionary, dataset structure description of the dataset required by the intent description object, security monitoring scenario rules and page design specifications to generate a page structure planning object, which is used to describe the page structure. Based on the large language model, component-level semantic reasoning is performed on the dataset structure description required for the page structure planning object and intent description object, generating a component semantic definition object for each component. The component semantic definition object is used to describe the configuration of the component. The layout parameters of each component are determined based on the page structure planning object and the component semantic definition object of each component. Based on the large language model, the linkage relationship between components is inferred from the page logic planning results, the component semantic definition object of each component, the dataset structure description of the dataset required by the intent description object, the semantic dictionary and the consistency relationship information of the dataset dimension. A linkage rule planning object is generated to describe the linkage relationship between different components. Based on the page structure planning object, the component semantic definition object of each component, and the structured functional instructions corresponding to the linkage rule planning object, a page configuration template is generated in combination with the layout parameters of each component.

[0093] Among them, security monitoring scenario rules are business logic and data display specifications for specific security monitoring scenarios (such as intrusion detection and vulnerability scanning). Page design specifications are general page visual and interaction design standards used to ensure a consistent page style and user experience.

[0094] Dataset dimensional consistency information refers to information about the consistency or mapping relationship between dimensional fields used for analysis in different datasets or components at the semantic, field role, and data structure levels.

[0095] Specifically, the large language model is invoked, enabling it to perform page-level structural reasoning based on the intent description object, semantic dictionary, dataset structure description, security monitoring scenario rules, and page design specifications. This generates and outputs a page structure planning object. The page structure planning object includes page layout and component distribution, such as page theme, page function description, page area division structure, area priority order, page default filtering logic, and overall page refresh strategy.

[0096] After completing page-level semantic planning, the large language model is invoked. The large language model performs component reasoning for each region based on the page structure planning object and the dataset structure description, generating component semantic definition objects to describe the attributes and data mapping relationships of each visualization component. These include, for example, component name, component type, dataset identifier referenced by the component, field mapping relationship, sorting rules, color strategy, whether interaction is supported, component description text, page region, refresh strategy, etc.

[0097] After completing component-level semantic planning, the layout parameters for each component are determined. Specifically, based on page-level information provided by the page structure planning object (e.g., page size parameters, page area division, and area priority) and component-level information provided by the component semantic definition object (e.g., the number of components in each area, component types, and their distribution requirements), layout reasoning and space allocation are performed using the reasoning capabilities of the large language model (or by executing layout algorithms, such as grid layout algorithms). This includes determining the position, size, and arrangement of each component on the page, thereby generating specific layout parameters for each component, including coordinate position (x, y), width, height, and hierarchy order. The grid layout algorithm first divides the page into several rows and columns of grid cells, with each component occupying one or more consecutive grid cells. Then, based on the component type and a preset default width-to-height ratio, the grid is filled sequentially from left to right and from top to bottom.

[0098] Furthermore, the large language model is invoked, enabling it to identify whether there are identical or semantically consistent fields between different components based on the page logic planning results, component semantic definition objects, dataset structure descriptions, and semantic dictionaries. It then combines field roles and dataset consistency information to infer the linkage relationships between different components, generating linkage rule planning objects. These linkage rule planning objects include component linkage relationships, component drill-down relationships, access control relationships, and global parameter relationships. Specifically, the page logic planning results assist the large language model in determining the overall page analysis objectives and whether linkage requirements exist; the component semantic definition objects assist the large language model in clarifying the fields used by each component and their roles; the dataset structure description information assists the large language model in determining the data source relationships and associativity between fields; and the semantic dictionary information provides the business type, field role, and semantic annotation information of fields, assisting the large language model in identifying semantic relationships between fields. Dataset dimensional consistency information is obtained through the following methods: Obtain field semantic information: Retrieve the business type, field role, and semantic remarks of the fields from the semantic dictionary to determine the semantic consistency between fields; Get field usage: Identify the fields used by each component and their role in the component, such as grouping dimensions, filtering conditions, etc. Obtain data relationship information: Based on the dataset structure description, analyze the dataset to which the field belongs and the data source relationship, which is used to determine whether there is data-level correlation between fields; Based on the above-mentioned semantic information, usage information, and data relationship information, semantic matching analysis is performed on the fields in different components. When the fields meet the consistency conditions in terms of semantics, role, and data structure, the dataset dimension consistency relationship information of these fields is established.

[0099] Furthermore, page structure planning objects, component semantic definition objects, and linkage rule planning objects are mapped to page configuration function instructions (which can be executed by the function instruction execution module) through preset parsing rules. For example: page_theme→CreatePage(), widget_definition→CreateWidget(). Page configuration function instructions are used to convert the declarative descriptions of page structure planning objects, component semantic definition objects, and linkage rule planning objects output by the large language model into a structured command sequence that can be parsed and executed at the underlying level. Through the structured mapping mechanism between page structure planning objects, component semantic definition objects, linkage rule planning objects, and system execution instructions (i.e., page configuration function instructions), the descriptions generated by the large language model are converted into standardized function call instructions. The underlying function instruction execution module completes the storage of page and component configurations in the database, thereby solving the problems of the large language model output results not being directly executable and the system behavior being uncontrollable, and realizing a deterministic transformation from planning results to system execution.

[0100] By executing the command sequence included in the page configuration function instructions, such as page creation, component instantiation, layout parameter setting, dataset binding, and linkage rule registration, the page configuration template is constructed and populated with configuration items such as page attributes, component list, dataset identifier associated with components, layout coordinates, field mapping, and interaction logic. This generates a complete and standardized page configuration template that can be parsed by the front-end rendering engine, thus achieving the persistence of the configuration information of the entire page view.

[0101] The above embodiments decompose the complex page building task into several clearly defined steps, such as page structure planning, component semantic definition, and linkage rule generation. By accurately inputting business rules and data semantics at each step, the system achieves automatic generation from user intent to complete page configuration, eliminating the need for manual drag-and-drop layout, manual field configuration, or writing of linkage logic. This method not only ensures the inherent consistency and business coordination of the generated page in terms of overall architecture, component details, and interaction logic, but also ensures the accuracy of linkage relationships and the correctness of data associations by leveraging semantic dictionaries and dimensional consistency information. This guarantees the professionalism and consistency of the generated page in terms of business logic, data mapping, and user experience, reducing the professional threshold and time cost of building security situation awareness pages, and replacing the traditional manual, discrete page configuration method.

[0102] The S140 uses a rendering engine to parse and render the page configuration template, generating a corresponding network security situation awareness business intelligence (BI) page.

[0103] Specifically, the page configuration template and the view identifier assigned to the page configuration template are stored in the page configuration library, and the view identifier is returned to the front end, triggering the front end to display the view identifier through the interface. In response to the user's click operation on the view identifier, the page configuration template is retrieved from the page configuration library and transmitted to the front end's rendering engine for parsing and rendering to generate the corresponding network security situation awareness business intelligence page.

[0104] In one feasible design, the following approach is used: the rendering engine parses and renders the page configuration template to generate the corresponding network security situation awareness business intelligence (BI) page. Perform validation on the page configuration template, including page layout validation, component linkage detection, and dataset dependency integrity validation. If the page configuration template passes the validation, the rendering engine parses and renders the page configuration template to generate the corresponding network security situation awareness business intelligence (BI) page.

[0105] Page layout validation includes: Extract the coordinates, width, height, and page boundaries of each component, and check whether each component exceeds the boundaries (such as exceeding the page range) and whether the components overlap.

[0106] Component linkage detection includes: checking whether the source and target components referenced in each relationship of the linkage rule planning object exist, and whether the specified association fields actually exist in the binding dataset of the relevant components. This ensures that all planned business interaction logic can be executed at the technical level, and avoids linkage failure due to missing components or fields.

[0107] Dataset dependency integrity checks include, but are not limited to, the following: Dataset existence verification: Check whether the datasets referenced by each component on the page have been defined and successfully created in the database; Field integrity verification: Checks whether the data fields that the component depends on exist in the corresponding dataset and whether the field mapping relationship is valid; Dataset configuration integrity verification: Check whether the dataset structure description is complete, including whether the data source, field list, aggregation method and time field configuration are correct; Data access and execution verification: Verify the query logic or calculation task corresponding to the dataset to ensure that there are no syntax errors, missing fields, or permission access exceptions during execution.

[0108] For example, the method further includes: If the page layout validation fails, i.e. the components are out of bounds or overlap, the position or size of the components will be automatically adjusted according to the area priority and preset rules until all components are laid out correctly.

[0109] If the component linkage detection fails—meaning the source or target component in the linkage rule does not exist on the page, or the specified associated field does not exist in the binding dataset of the relevant component—then automatic correction or anomaly marking will be performed according to preset rules: For missing source or target components, the invalid rule will be removed from the linkage rule set; for non-existent associated fields, a semantically similar alternative field will be found based on the semantic dictionary for automatic repair. If the repair is successful, the field mapping relationship in the linkage rule will be updated; if the repair fails, the relationship will be removed. For linkage rule planning objects that cannot be repaired, they will be marked as an anomaly and a prompt message will be generated for user confirmation or manual intervention.

[0110] If the dataset existence check fails, the dataset construction process is automatically triggered based on the component's analysis requirements, generating the corresponding dataset configuration object. If the field integrity check fails, a semantically similar alternative field is found based on the semantic dictionary for mapping repair (i.e., the alternative field replaces the original field in the dataset configuration object and dataset structure description). If the repair fails, a "configuration error" marker is added to the component and the user is notified. If the dataset configuration integrity check fails, missing items are automatically filled or incorrect configurations are corrected according to default rules. If the data access and execution check fails, the query logic is automatically corrected and missing fields are added according to the semantic dictionary and preset rules.

[0111] Furthermore, if any check fails and cannot be automatically repaired, a clear error message will be generated and fed back to the user through the system interface for confirmation or manual adjustment.

[0112] It should be noted that the above embodiments can automatically complete the verification and repair of the page configuration template by calling the preset FunctionCall interface.

[0113] The above embodiments, by performing page layout verification, component linkage detection, and dataset dependency integrity verification on the page configuration template before release, can detect problems such as component out-of-bounds or overlapping, linkage rule failure, missing datasets, or field mapping mismatch in advance, thus avoiding display errors, abnormal interactions, or data loading failures during page runtime and improving the reliability and user experience of the final released page.

[0114] In a feasible design, automatic updates of the page configuration template are triggered by changes in the underlying data source structure in the following way: If a change in the data structure of an already connected data source is detected, determine the semantic information of the fields that have changed in the data source, and update the semantic dictionary accordingly. Identify the target dataset affected by the data source; Based on the large language model, reasoning is performed on the intent description objects corresponding to the target dataset, the updated semantic dictionary, and the security analysis page design rules to obtain new dataset requirements; Determine the new dataset structure description corresponding to the target dataset based on the new dataset requirements; Update the page configuration template that references the target dataset based on the new dataset structure description; Replace the initial page configuration template in the page configuration library with the updated page configuration template.

[0115] The types of fields that have changed include those that have been added, deleted, or modified.

[0116] Specifically, if a change in the data structure of the data source is detected, the name of the target field that has changed is obtained (if the identifier of the changed data table is obtained, the name of the target field that has changed in that data table is further determined). If the change type of the target field is deletion, the record corresponding to the target field is removed from the semantic dictionary. Otherwise, the latest preset number of data samples are extracted from the changed target field to construct the context of the target field. Semantic reasoning is performed on the context of the target field by calling the large language model to generate the field semantic information of the target field. If the change type of the target field is addition, the record of the corresponding field is added to the semantic dictionary based on the latest field semantic information; if the change type of the target field is modification, the original record of the corresponding field in the semantic dictionary is overwritten and updated based on the field semantic information and the modification content of the field.

[0117] Provided that the dataset configuration object records its data source information (including the data source, data table, and field identifiers it depends on), the dataset that references the target field is determined based on the identifier of the changed data table and the name of the target field.

[0118] Given that the corresponding intent description object is recorded in the dataset configuration object, page-level business logic planning and reasoning are performed on the intent description object corresponding to the target dataset, the updated semantic dictionary, and the security analysis page design rules based on the large language model to obtain new page logic planning results. Then, new dataset requirements are determined based on the new page logic planning results.

[0119] The implementation method for determining the new dataset structure description corresponding to the target dataset based on the new dataset requirements is described in the aforementioned example of generating the dataset structure description for analytical datasets, and will not be repeated here.

[0120] Then, based on the new dataset structure description, update the page configuration template that references the target dataset (e.g., update the reference relationship between the components of the relevant page and the dataset identifier corresponding to the new dataset structure description), and replace the corresponding initial page configuration template in the page configuration library with the updated page configuration template.

[0121] It should be noted that the above embodiments can automatically update the page configuration template by calling the preset FunctionCall interface.

[0122] The above embodiment uses changes in the underlying data source structure as the trigger source, calls a large language model to perform semantic recognition on the changed fields and updates the semantic dictionary, and then re-infers and generates a new dataset structure description based on the original intent description object and the updated semantic dictionary. Finally, it updates the page configuration template that references this dataset structure description, achieving the effect of automatic page configuration updates triggered by data source changes. This application can complete the perception of data source structure changes, synchronization of semantic dictionaries, reconstruction of affected datasets, and automatic upgrade of dependent pages without manual intervention. It solves the problem in traditional BI systems where data source changes cause page failures or require manual repair one by one, improves the system's adaptability and operational efficiency, and ensures the consistency of page display content with the latest data source structure.

[0123] This application utilizes a large language model to parse unstructured security analysis descriptions into intent description objects containing analysis objectives and statistical indicators. This achieves an automatic transformation from vague requirements to explicit analysis objectives and statistical indicators, laying a precise semantic foundation for all subsequent operations. Subsequently, based on the intent description object, semantic dictionary, and security analysis page design rules, the dataset structure description required by the intent description object is accurately determined. This dataset structure description defines the structure of the dataset, solving the problem of "what kind of data is needed and how to retrieve the data."

[0124] The intent description provides the analytical objectives and core business elements (such as statistical indicators) for determining the dataset structure, specifying "what data is needed" to answer specific security questions. The semantic dictionary provides structured semantic knowledge of all fields in the accessed data source (including the business type of the fields and their role in the analysis), establishing a mapping relationship from business concepts to underlying data fields, indicating "where the data comes from and how to understand it." The security analysis page design rules provide domain-specific business specifications and constraints for determining the dataset structure, injecting data usage conventions and best practices in the security analysis scenario, ensuring that the generated dataset structure description meets the logical requirements of professional security monitoring. Therefore, the final dataset structure description accurately anchors business semantics while strictly adhering to the data source structure and security analysis specifications.

[0125] Based on this, the large language model is used to infer the information required for page configuration from the intent description object, semantic dictionary and dataset structure description, and automatically generate a page configuration template that defines the page structure, component configuration and layout parameters. The component references in the page configuration template are obtained through the dataset configuration object associated with the dataset structure description, thereby automatically completing the design of page layout, component selection and data binding.

[0126] Furthermore, the rendering engine parses and renders the page configuration template to generate a cybersecurity situational awareness business intelligence (BI) page. The entire process requires no manual intervention, solving the problems of traditional BI pages that require manual design of information structures and reliance on expert experience. It achieves automated planning from problem analysis to page logical architecture, reducing the professional threshold and time cost of building security situational awareness pages, and realizing efficient and intelligent automated page generation.

[0127] like Figure 2 As shown, this application also provides a network security situation awareness BI page construction system based on a large model, including: The intent analysis module is used to perform semantic understanding on the natural language descriptions for network security situation analysis received through the natural language interaction interface based on the large language model, and obtain intent description objects containing analysis objectives and statistical indicators. The dataset structure determination module is used to determine the dataset structure description of the dataset required by the intent description object based on the intent description object, semantic dictionary and security analysis page design rules. The semantic dictionary is used to associate fields with field semantic information in the data table of the data source that has been connected. The field semantic information includes information about the field in terms of business and analysis scenario. The dataset structure description is used to define the structure and source of the dataset. The page configuration template generation module is used to infer the information required for page configuration by using a large language model to analyze the intent description object, semantic dictionary, and dataset structure description of the dataset required by the intent description object. The page configuration template is used to define the page structure, the component configuration of each component, and the layout parameters of each component. Each component references the dataset obtained through the dataset configuration object associated with the dataset structure description. The page generation module is used to parse and render the page configuration template through the rendering engine to generate the corresponding network security situation awareness business intelligence (BI) page.

[0128] In a feasible design, the dataset structure determination module is implemented by determining the dataset structure description required by the intent description object based on the intent description object, semantic dictionary, and security analysis page design rules: Based on the large language model, page-level business logic planning and reasoning are performed on the intent description object, semantic dictionary and security analysis page design rules to obtain page logic planning results, which include page-level planning information and component-level planning information. Based on the large language model, the dataset requirements are obtained by reasoning about the page logic planning results. If a matching dataset structure description exists in the database based on the dataset requirements, the matching dataset structure description is reused. The dataset structure description stored in the database includes basic dataset structure description or analytical dataset structure description. If, based on the dataset requirements, it is determined that there is a missing matching dataset structure description in the database, then, based on the intent description object and semantic dictionary, determine the roles of each field corresponding to the analysis master object of the intent description object, as well as the basic dataset structure description corresponding to each target data table in the associated target data tables. Based on the large language model, dataset structure reasoning is performed on the intent description object, the field roles corresponding to the analysis main object, and the basic dataset structure description corresponding to each target data table to generate dataset construction function instructions. Generate the corresponding dataset structure description based on the dataset construction function instructions.

[0129] In one feasible design, the page configuration template generation module is implemented by reasoning about the information required for page configuration based on the intent description object, semantic dictionary, and dataset structure description of the dataset required by the intent description object using a large language model, and then generating a page configuration template: Based on the large language model, page-level structural reasoning is performed on the intent description object, semantic dictionary, dataset structure description of the dataset required by the intent description object, security monitoring scenario rules and page design specifications to generate a page structure planning object, which is used to describe the page structure. Based on the large language model, component-level semantic reasoning is performed on the dataset structure description required for the page structure planning object and intent description object, generating a component semantic definition object for each component. The component semantic definition object is used to describe the configuration of the component. The layout parameters of each component are determined based on the page structure planning object and the component semantic definition object of each component. Based on the large language model, the linkage relationship between components is inferred from the page logic planning results, the component semantic definition object of each component, the dataset structure description of the dataset required by the intent description object, the semantic dictionary and the consistency relationship information of the dataset dimension. A linkage rule planning object is generated to describe the linkage relationship between different components. Based on the page structure planning object, the component semantic definition object of each component, and the structured functional instructions corresponding to the linkage rule planning object, a page configuration template is generated in combination with the layout parameters of each component.

[0130] In a feasible design, the system also includes a page configuration template update module, which updates the page configuration template in the following way: If a change in the data structure of an already connected data source is detected, determine the semantic information of the fields that have changed in the data source, and update the semantic dictionary accordingly. Identify the target dataset affected by the data source; Based on the large language model, reasoning is performed on the intent description objects corresponding to the target dataset, the updated semantic dictionary, and the security analysis page design rules to obtain new dataset requirements; Determine the new dataset structure description corresponding to the target dataset based on the new dataset requirements; Update the page configuration template that references the target dataset based on the new dataset structure description; Replace the initial page configuration template in the page configuration library with the updated page configuration template.

[0131] In one feasible design, the page configuration template update module determines the semantic information of fields that have changed in the data source based on a large language model, and updates the semantic dictionary accordingly, in the following way: Extract a predetermined number of data samples from the target field that has changed in the data source; Construct the context of the target field, which includes the name of the data table to which the target field belongs, the field name of the target field, the type of the target field, a preset number of data samples, and preset security business semantic prompts; The large language model is invoked to perform semantic reasoning on the context and generate structured field semantic information, which includes field business type, field role and business remarks information. Update the semantic dictionary based on the field semantic information and the target field.

[0132] In a feasible design, the system also includes a dataset configuration object generation module, which generates dataset configuration objects in the following way: Based on the data structure scan results, determine the data tables contained in the connected data sources; Identify the semantic information of each field in each data table based on the semantic dictionary; The aggregation method and / or time field configuration of each field are determined based on the semantic information of each field in each data table; By integrating the data source, field name, aggregation method, and / or time field configuration of each data table, a dataset structure description of the basic dataset corresponding to each data table is generated, namely, the basic dataset structure description. Generate corresponding dataset configuration objects based on the basic dataset structure description of each data table, and store each dataset configuration object in the database.

[0133] In a feasible design, the page configuration template update module updates the page configuration template in the following way: If a dataset with a changed structure is detected, the page referencing the dataset and the components within that page are determined based on the first dependency relationship. The first dependency relationship is used to represent the reference relationship between the page identifier, the component identifier, and the dataset identifier. Iterate through each component on the page that references the dataset, and for each component, perform the following steps: Determine whether the fields referenced by the component are included in the structure of the dataset; If any of the fields referenced by the component contain an initial field that is not included in the structure of the dataset, a replacement field that matches the semantics of the initial field is determined based on the semantic dictionary; Update the component's configuration based on the alternative fields; Based on the updated components, perform an incremental update on the page configuration template corresponding to the page, and generate a new page configuration template.

[0134] In a feasible design, the semantic dictionary also includes business notes corresponding to the fields. The page configuration template update module determines alternative fields that match the semantics of the initial fields based on the semantic dictionary in the following way: Fields in the semantic dictionary that have the same business type as the initial fields are identified as candidate fields. If the number of candidate fields is equal to 1, the candidate field is determined as the replacement field; If the number of candidate fields is greater than 1, the candidate fields that have the same field role as the initial field and belong to the same data table will be determined as new candidate fields. If the number of new candidate fields is equal to 1, the new candidate field will be determined as the replacement field; If the number of new candidate fields is greater than 1, the comprehensive score of each new candidate field is determined based on the similarity of the field name and business notes information between each new candidate field and the initial field. The new candidate field with the highest comprehensive score is determined as the replacement field.

[0135] In a feasible design, the system also includes a validation module, which is used to perform validation on the page configuration template. The validation includes page layout validation, component linkage detection, and dataset dependency integrity validation. The page generation module is also used to parse and render the page configuration template through the rendering engine if the page configuration template passes the validation, thereby generating the corresponding network security situation awareness business intelligence (BI) page.

[0136] Other implementation methods and effects of the above system can be found in the embodiments of the method for constructing a network security situation awareness BI page based on a large model, and will not be repeated here.

[0137] The basic principles of this application have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this application are merely examples and not limitations, and should not be considered as essential features of each embodiment of this application. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the application to the necessity of employing the aforementioned specific details for implementation.

[0138] It should be understood that although the steps in the flowcharts of the accompanying figures are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0139] The block diagrams of devices, apparatuses, devices, and systems involved in this application are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0140] It should also be noted that in the apparatus, equipment, and methods of this application, the components or steps can be disassembled and / or recombined. These disassemblies and / or recombinations should be considered as equivalent solutions of this application.

[0141] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this application. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein can be applied to other aspects without departing from the scope of this application. Therefore, this application is not intended to be limited to the aspects shown herein, but rather to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0142] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this application to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

Claims

1. A method for constructing a network security situation awareness BI page based on a large model, characterized in that, include: Based on the large language model, semantic understanding is performed on the natural language descriptions for network security situation analysis received through the natural language interaction interface to obtain an intent description object containing analysis objectives and statistical indicators. Based on the intent description object, semantic dictionary, and security analysis page design rules, the dataset structure description of the dataset required by the intent description object is determined. The semantic dictionary is used to associate fields and field semantic information in the data table of the data source that has been connected. The field semantic information includes information about the field in terms of business and analysis scenarios. The dataset structure description is used to define the structure and source of the dataset. By reasoning about the intent description object, semantic dictionary, and dataset structure description of the dataset required by the intent description object through a large language model, a page configuration template is generated. The page configuration template is used to define the page structure, the component configuration of each component, and the layout parameters of each component. Each component references the dataset obtained through the dataset configuration object associated with the dataset structure description. The rendering engine parses and renders the page configuration template to generate the corresponding network security situation awareness business intelligence (BI) page.

2. The method according to claim 1, characterized in that, The dataset structure description for determining the dataset required for the intent description object based on the intent description object, semantic dictionary, and security analysis page design rules includes: Based on the large language model, page-level business logic planning and reasoning are performed on the intent description object, semantic dictionary and security analysis page design rules to obtain page logic planning results. The page logic planning results include page-level planning information and component-level planning information. Based on the large language model, the dataset requirements are obtained by reasoning about the page logic planning results. If a matching dataset structure description exists in the database based on the dataset requirements, the matching dataset structure description is reused. The dataset structure description stored in the database includes a basic dataset structure description or an analytical dataset structure description. If it is determined that the database lacks a matching dataset structure description based on the dataset requirements, then based on the intent description object and the semantic dictionary, determine the roles of each field corresponding to the analysis master object of the intent description object, as well as the basic dataset structure description corresponding to each target data table in the associated target data tables. Based on the large language model, dataset structure reasoning is performed on the intent description object, the field roles corresponding to the analysis main object, and the basic dataset structure description corresponding to each target data table to generate dataset construction function instructions. The corresponding dataset structure description is generated based on the dataset construction function instructions.

3. The method according to claim 2, characterized in that, The step of reasoning about the information required for page configuration based on the intent description object, semantic dictionary, and dataset structure description of the dataset required by the intent description object using a large language model, and generating a page configuration template, includes: Based on the large language model, page-level structural reasoning is performed on the intent description object, semantic dictionary, dataset structure description of the dataset required by the intent description object, security monitoring scenario rules and page design specifications to generate a page structure planning object, which is used to describe the page structure. Based on the large language model, component-level semantic reasoning is performed on the dataset structure description of the dataset required by the page structure planning object and the intent description object to generate a component semantic definition object for each component, which is used to describe the configuration of the component; The layout parameters of each component are determined based on the page structure planning object and the component semantic definition object of each component; Based on the large language model, the page logic planning results, the component semantic definition object of each component, the dataset structure description of the dataset required by the intent description object, the semantic dictionary and the dataset dimension consistency information are used to reason about the linkage relationship between components, and generate a linkage rule planning object. The linkage rule planning object is used to describe the linkage relationship between different components. Based on the page structure planning object, the component semantic definition object of each component, and the structured functional instructions corresponding to the linkage rule planning object, a page configuration template is generated in combination with the layout parameters of each component.

4. The method according to any one of claims 1-3, characterized in that, The method further includes: If a change in the data structure of an already connected data source is detected, the semantic information of the fields corresponding to the changed fields in the data source is determined, and the semantic dictionary is updated accordingly. Identify the target dataset affected by the data source; Based on the large language model, reasoning is performed on the intent description objects corresponding to the target dataset, the updated semantic dictionary, and the security analysis page design rules to obtain new dataset requirements; Determine the new dataset structure description corresponding to the target dataset based on the new dataset requirements; Update the page configuration template that references the target dataset according to the new dataset structure description; Replace the initial page configuration template in the page configuration library with the updated page configuration template.

5. The method according to claim 4, characterized in that, The process of determining the semantic information of fields that have changed in the data source based on a large language model and updating the semantic dictionary accordingly includes: Extract a predetermined number of data samples from the target field that has changed in the data source; Construct the context of the target field, which includes the name of the data table to which the target field belongs, the field name of the target field, the type of the target field, the preset number of data samples, and preset security business semantic prompts; The large language model is invoked to perform semantic reasoning on the context, generating structured field semantic information, which includes field business type, field role, and business remarks information; Update the semantic dictionary based on the semantic information of the field and the target field.

6. The method according to any one of claims 1-3, characterized in that, The method further includes: Based on the data structure scan results, determine the data tables contained in the connected data sources; Identify the semantic information of each field in each data table based on the semantic dictionary; The aggregation method and / or time field configuration of each field are determined based on the semantic information of each field in each data table; By integrating the data source, field name, aggregation method, and / or time field configuration of each data table, a dataset structure description of the basic dataset corresponding to each data table is generated, namely, the basic dataset structure description. Generate corresponding dataset configuration objects based on the basic dataset structure description of each data table, and store each dataset configuration object in the database.

7. The method according to any one of claims 1-3, characterized in that, The method further includes: If a dataset whose structure has changed is detected, the page that references the dataset and the components within the page are determined according to the first dependency relationship, whereby the first dependency relationship is used to represent the reference relationship between the page identifier, the component identifier, and the dataset identifier. Iterate through each component on the page that references the dataset, and for each component, perform the following steps: Determine whether the fields referenced by the component are included in the structure of the dataset; If any of the fields referenced by the component contain an initial field that is not included in the structure of the dataset, a replacement field that semantically matches the initial field is determined based on the semantic dictionary; Update the relevant configuration of the component based on the alternative fields; Based on the updated components, perform an incremental update on the page configuration template corresponding to the page, and generate a new page configuration template.

8. The method according to claim 7, characterized in that, The semantic dictionary also includes business remarks information corresponding to the fields. The step of determining alternative fields that semantically match the initial field based on the semantic dictionary includes: Fields in the semantic dictionary that have the same business type as the initial field are identified as candidate fields; If the number of candidate fields is equal to 1, the candidate field is determined as the replacement field; If the number of candidate fields is greater than 1, the candidate fields that have the same field role as the initial field and belong to the same data table will be determined as new candidate fields. If the number of new candidate fields is equal to 1, the new candidate field is determined as the replacement field; If the number of new candidate fields is greater than 1, the comprehensive score of each new candidate field is determined based on the similarity of the field name and business notes information between each new candidate field and the initial field. The new candidate field with the highest comprehensive score is determined as the replacement field.

9. The method according to any one of claims 1-3, characterized in that, The step of parsing and rendering the page configuration template through a rendering engine to generate a corresponding network security situation awareness business intelligence (BI) page includes: The page configuration template is validated, including page layout validation, component linkage detection, and dataset dependency integrity validation. If the page configuration template passes the verification, the rendering engine parses and renders the page configuration template to generate the corresponding network security situation awareness business intelligence (BI) page.

10. A network security situation awareness BI page construction system based on a large model, characterized in that, include: The intent analysis module is used to perform semantic understanding on the natural language descriptions for network security situation analysis received through the natural language interaction interface based on the large language model, and obtain intent description objects containing analysis objectives and statistical indicators. The dataset structure determination module is used to determine the dataset structure description of the dataset required by the intent description object based on the intent description object, the semantic dictionary and the security analysis page design rules. The semantic dictionary is used to associate fields and field semantic information in the data table of the data source that has been connected. The field semantic information includes information about the fields in terms of business and analysis scenarios. The dataset structure description is used to define the structure and source of the dataset. The page configuration template generation module is used to infer the information required for page configuration from the intent description object, semantic dictionary, and dataset structure description of the dataset required by the intent description object through a large language model, and generate a page configuration template. The page configuration template is used to define the page structure, the component configuration of each component, and the layout parameters of each component. Each component references the dataset obtained through the dataset configuration object associated with the dataset structure description. The page generation module is used to parse and render the page configuration template through the rendering engine to generate the corresponding network security situation awareness business intelligence (BI) page.

Images