Requirement document security protection method and device, computer device and storage medium

Abstract

The application belongs to the technical field of artificial intelligence, and relates to a demand document security protection method, which comprises inputting a to-be-reviewed demand document into a security review model, extracting structured content of the to-be-reviewed demand document through a document analysis network, performing semantic enhancement and standardization processing on the structured content, and obtaining standardized demand content; identifying security protection items from the standardized demand content based on a pre-constructed security knowledge base through a security protection item identification network, and establishing a mapping relationship between the security protection items and demand descriptions; generating protection suggestions by combining the mapping relationship with the demand document through a security protection suggestion generation network; and creating a security demand task based on the security protection items and the protection suggestions. The application also provides a demand document security protection device, a computer device and a storage medium. The application can be applied to the security demand review scene of financial technology and medical treatment, can accurately identify implicit security protection items, and can improve the security demand identification rate and the accuracy of generating protection suggestions.

Description

Technical Field

[0001] This application relates to the fields of artificial intelligence technology and natural language processing technology, and in particular to a method, device, computer equipment and storage medium for security protection of requirements documents. Background Technology

[0002] In the application development process, requirements document review is the core basis for defining application functions, business logic, and user needs, and its security directly determines the security baseline for subsequent development stages. With the increasing complexity of digital application scenarios (such as financial-grade transaction systems and medical data platforms), security-related descriptions in requirements documents, such as user privacy protection, access control, and data transmission, are becoming increasingly opaque. Existing technologies related to security review of requirements documents mainly fall into two categories: one is general-purpose requirements document processing tools; the other is traditional security requirements analysis techniques, including rule-based keyword matching tools and traditional NLP (Natural Language Processing) analysis tools. The former can only retrieve explicit security keywords, and the latter can only complete basic topic classification; both lack in-depth reasoning capabilities in the security domain.

[0003] The inventors recognized that the aforementioned technologies have the following problems: First, they have a fundamental deficiency in the ability to identify security protection items. Based on the principle of shallow matching, they cannot capture hidden security risks and have a low recognition rate for hidden needs. Second, the security recommendations lack scenario-specific precision and can only output general terms, failing to connect with compliance standards in industries such as finance and healthcare. Third, the degree of automation is extremely low, with core reviews relying on senior security experts, and the review results from different experts are inconsistent. Fourth, they are disconnected from mainstream development toolchains, unable to automatically transfer review results and respond to changes in requirements in real time, resulting in a low implementation rate of security recommendations and completely failing to meet the security baseline requirements of highly sensitive and heavily regulated fields such as finance and healthcare. Summary of the Invention

[0004] The purpose of this application is to propose a method, device, computer equipment, and storage medium for security protection of requirements documents, in order to solve the technical problems of existing requirements document security review lacking natural language deep understanding and security domain intelligent reasoning capabilities, unable to generate scenario-based accurate compliance suggestions, and highly dependent on manual work, resulting in low efficiency of requirements document review, low security requirement recognition rate, and low accuracy of security suggestions.

[0005] Firstly, a method for protecting the security of requirements documents is provided, which adopts the following technical solution: Obtain the requirement document to be reviewed, and input the requirement document to be reviewed into the trained security review model, wherein the security review model includes a document parsing network, a security protection item identification network, and a security protection suggestion generation network; The document parsing network extracts the structured content of the requirement document to be reviewed, and performs semantic enhancement and standardization on the structured content to obtain standardized requirement content. The security protection item identification network is used to perform contextual reasoning on the standardized requirements based on a pre-built security knowledge base, identify security protection items, and establish a mapping relationship between the security protection items and the requirements description. The security protection suggestion generation network combines the mapping relationship with the business scenarios in the requirements document to generate protection suggestions. Based on the security protection items and the protection recommendations, create associated security requirement tasks, and perform security protection on the requirement documents to be reviewed in accordance with the security requirement tasks.

[0006] Secondly, a security protection device for requirements documents is provided, which adopts the following technical solution: The acquisition module is used to acquire the requirement document to be reviewed and input the requirement document to be reviewed into the trained security review model, wherein the security review model includes a document parsing network, a security protection item identification network, and a security protection suggestion generation network. The document parsing module is used to extract the structured content of the requirement document to be reviewed through the document parsing network, and to perform semantic enhancement and standardization processing on the structured content to obtain standardized requirement content; The identification module is used to identify security protection items by performing contextual reasoning on the standardized requirements content based on a pre-built security knowledge base through the security protection item identification network, and to establish a mapping relationship between the security protection items and the requirements description. The suggestion generation module is used to generate protection suggestions by combining the mapping relationship with the business scenarios in the requirements document through the security protection suggestion generation network; The task association module is used to create associated security requirement tasks based on the security protection items and the protection suggestions, and to perform security protection on the requirement document to be reviewed in accordance with the security requirement tasks.

[0007] Thirdly, a computer device is provided that adopts the technical solution described below: The computer device includes a memory and a processor, the memory storing computer-readable instructions, and the processor executing the computer-readable instructions to implement the steps of the requirement document security protection method described above.

[0008] Fourthly, a computer-readable storage medium is provided, which adopts the technical solution described below: The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the requirement document security protection method described above.

[0009] Compared with the prior art, this application has the following main advantages: This application provides a method for protecting security in requirement documents. Through a trained security review model, it automates the processing of requirement documents to be reviewed, significantly improving the automation and accuracy of security reviews while reducing manual intervention costs. Furthermore, the security review model combines industry-specific security knowledge bases for contextual reasoning, accurately identifying implicit security protection items and improving the security requirement identification rate. It also generates targeted protection suggestions based on business scenarios, enhancing the accuracy of these suggestions. Simultaneously, by automatically synchronizing security protection items and suggestions as associated security requirement tasks, it ensures the automatic flow of security requirement tasks, increasing the implementation rate of protection suggestions. This, in turn, safeguards the security and compliance of applications across multiple industries, providing efficient support for security management in complex business scenarios. Attached Figure Description

[0010] To more clearly illustrate the solutions in this application, the accompanying drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is an exemplary system architecture diagram to which this application can be applied; Figure 2 This is a flowchart of one embodiment of the document security protection method according to the requirements of this application; Figure 3 yes Figure 2 A flowchart of a specific implementation of step S202; Figure 4 yes Figure 2 A flowchart of a specific implementation of step S203; Figure 5 yes Figure 2 A flowchart of a specific implementation of step S204; Figure 6 This is a schematic diagram of the structure of one embodiment of the document security protection device according to the requirements of this application; Figure 7 This is a schematic diagram of the structure of one embodiment of the computer device according to this application. Detailed Implementation

[0012] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein in the specification of the application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application; the terms "comprising" and "having," and any variations thereof, in the specification, claims, and foregoing drawings of this application, are intended to cover non-exclusive inclusion. The terms "first," "second," etc., in the specification, claims, or foregoing drawings of this application are used to distinguish different objects, not to describe a particular order.

[0013] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0014] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0015] like Figure 1 As shown, system architecture 100 may include terminal device 101, network 102, and server 103. Terminal device 101 may be a laptop 1011, tablet 1012, or mobile phone 1013. Network 102 is used as a medium to provide a communication link between terminal device 101 and server 103. Network 102 may include various connection types, such as wired, wireless communication links, or fiber optic cables.

[0016] Users can use terminal device 101 to interact with server 103 via network 102 to receive or send messages, etc. Various communication client applications can be installed on terminal device 101, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social media platform software, etc.

[0017] Terminal device 101 can be various electronic devices with a display screen and support web browsing. In addition to laptops 1011, tablets 1012, or mobile phones 1013, terminal device 101 can also be an e-book reader, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 player (Moving Picture Experts Group Audio Layer IV), a laptop computer, and a desktop computer, etc.

[0018] Server 103 can be a server that provides various services, such as a backend server that provides support for the pages displayed on terminal device 101.

[0019] It should be noted that the requirement document security protection method provided in this application embodiment is generally executed by a server / terminal device, and correspondingly, the requirement document security protection device is generally set in the server / terminal device.

[0020] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0021] Continue to refer to Figure 2 The flowchart illustrates an embodiment of a requirement document security protection method according to this application, including the following steps: Step S201: Obtain the requirement document to be reviewed and input the requirement document to be reviewed into the trained security review model. The security review model includes a document parsing network, a security protection item identification network, and a security protection suggestion generation network.

[0022] The requirements document security protection method provided in this application can be applied to the requirements security review stage in various digital application development processes. For example, in the field of fintech applications, banks, payment and securities institutions generate a large number of requirements documents involving sensitive information such as fund transactions, personal credit, and customer holdings when developing core transaction systems, online loan systems, and customer asset management systems. They often need to use this application to automatically identify security risks such as unauthorized access, data leakage, and compliance deficiencies hidden in these documents, in order to establish a solid security baseline in advance, shorten the review cycle, and meet industry regulatory requirements such as PCI DSS. For example, in the field of healthcare applications, hospitals and internet healthcare platforms, when developing electronic medical record systems, online consultation platforms, and medical insurance settlement systems, will have requirements documents containing a large amount of sensitive content such as patients' personal health information, biometric information, and medical insurance data. They often need to use this application to accurately identify security protection items such as data anonymization, access control, and third-party data sharing to ensure the security of medical data.

[0023] Retrieve the requirements documents to be reviewed. These are the requirements documents awaiting security review. These documents can be functional requirements specifications or system design documents written by the development team at the beginning of the project, typically stored electronically in document format or portable document format. The process of retrieving these requirements documents can be achieved through a file upload interface, supporting both direct retrieval from the project management system and manual upload by developers to the review platform.

[0024] In this embodiment, the requirements document to be reviewed includes information such as functional descriptions, user roles, and data flow paths. The functional descriptions typically include the specific functional modules of the application, such as user login, data query, or payment settlement; user roles involve user groups with different permissions, such as ordinary users, administrators, or third-party service providers; and the data flow path describes the path of data transmission between functional modules and user roles, such as how user input data is transmitted to the backend server.

[0025] It should be noted that when obtaining the requirement documents to be reviewed, the system will perform a preliminary verification to ensure that the document format meets the parsing requirements, and record the basic information of the document, such as the document name, version number and upload time, for subsequent tracking and management.

[0026] In this embodiment, the requirement document to be reviewed undergoes automated security requirement review using a pre-trained security review model. This security review model includes a document parsing network, a security protection item identification network, and a security protection suggestion generation network.

[0027] For example, for security reviews in the financial sector, a financial security review dataset containing labeled samples is constructed by collecting industry-specific compliance standards (such as PCI DSS), historical security review annotation cases of banking / payment / securities system requirement documents, financial system vulnerability reports, regulatory penalty decisions, and industry security requirement templates. This dataset is then used to train a pre-built security review model, resulting in a pre-trained model. For specific risks in financial scenarios, such as fund transaction security, credit data protection, unauthorized access to customer assets, and data export compliance, a specialized dataset is designed. This dataset is used to fine-tune the pre-trained model, allowing it to learn to infer implicit security risks from requirement descriptions and accurately map them to corresponding industry compliance requirements, generating targeted protection suggestions. After fine-tuning, the model is validated using a set of labeled real financial requirement documents. Once validated, a trained security review model for financial scenarios is obtained.

[0028] Similarly, for security reviews in the medical field, we collect medical industry-specific regulations (such as HIPAA), electronic medical record security specifications, historical hospital / internet hospital requirement documents review annotation cases, and medical data breach incident reports to construct a medical security review dataset containing annotated samples. We then use this dataset to train a pre-built security review model, resulting in a pre-trained model. For risks specific to medical scenarios, such as patient health information anonymization, medical record modification tracking, doctor access control, third-party sharing security of medical data, and biometric information protection, we design specialized datasets. These datasets are used to fine-tune the pre-trained model, allowing it to learn to identify hidden sensitive data protection risks in medical needs and generate targeted protection recommendations. After fine-tuning, we validate the model using annotated real electronic medical records and online consultation system requirement documents. Once validated, we obtain a trained security review model for medical scenarios.

[0029] After the security review model is trained, the model's capabilities are dynamically evolved through the synergy of human feedback learning, industry adaptation upgrades, and misjudgment correction mechanisms. This addresses issues such as performance degradation after model deployment, slow adaptation to new industries, and the inability to quickly correct high-frequency misjudgments.

[0030] Among them, the human feedback learning establishes a closed-loop learning mechanism of expert annotation, data accumulation and incremental training, which allows the model to continuously learn from the experience and knowledge of security experts. Specifically, security experts can annotate the security protection items and protection suggestions identified by the model (correct / incorrect / needs optimization). The annotated data is used for model fine-tuning, and incremental training is carried out every 1,000 accumulated feedbacks.

[0031] Industry adaptation upgrades involve collecting a small number of samples from the relevant industry (such as 500+ typical requirement documents, industry compliance standards, and historical security review cases) for domain adaptation training when new industries (such as metaverse social, autonomous driving, and industrial internet) need to be supported. At the same time, a dedicated terminology library, security knowledge base, and suggestion template library for the new industry are built simultaneously and used in conjunction with the fine-tuned model to quickly improve the accuracy of identifying protection items in that industry.

[0032] The error correction mechanism automatically calculates the manual marking error rate of each security protection item and performs periodic summary analysis. When the manual marking error rate of a certain security protection item exceeds a preset threshold (such as 10%), rule verification is automatically triggered to analyze the reasons for high-frequency misjudgments and supplement corresponding special scenario rules (such as relaxing some external compliance requirements in the "internal management system").

[0033] It should be emphasized that, to further ensure the privacy and security of the requirements documents to be reviewed, these requirements documents can also be stored in a blockchain node.

[0034] The blockchain referred to in this application is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked together using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain can include an underlying blockchain platform, a platform product service layer, and an application service layer.

[0035] Step S202: Extract the structured content of the requirement document to be reviewed through a document parsing network, and perform semantic enhancement and standardization processing on the structured content to obtain standardized requirement content.

[0036] The document parsing network combines text extraction and layout analysis capabilities, and can handle input documents in various formats, including Docx, PDF, Markdown, and scanned images (converted via OCR).

[0037] In this embodiment, the process of extracting the structured content of the document to be reviewed using a document parsing network mainly includes three stages: document format conversion, content recognition, semantic enhancement, and standardization. First, the input document to be reviewed is preprocessed to convert it into a unified internal representation. Then, the heading levels, paragraph content, table data, and chart data in the document are identified, and key information is extracted to obtain structured content that maintains the logical structure of the original document, such as the description text of functional modules, the permission definition of user roles, and the data flow path. Next, for ambiguous expressions in the structured content, contextual completion is performed based on the content of adjacent paragraphs or chapters in the document to obtain semantically enhanced fusion features. Finally, semantic standardization processing is performed on the semantically enhanced fusion features to solve the problems of ambiguous expressions or non-standard terminology that may exist in the document.

[0038] In some alternative implementations, the document parsing network includes a document parsing subnetwork, a semantic enhancement subnetwork, and a normalization subnetwork. See also Figure 3 As shown, the steps described above—extracting the structured content of the requirements document to be reviewed using a document parsing network, and then performing semantic enhancement and standardization on the structured content to obtain standardized requirements content—include the following: Step S301: The document parsing subnetwork is used to perform structural analysis and key information extraction on the document to be reviewed, resulting in structured content. Step S302: Semantically enhance the structured content through the semantic enhancement sub-network to obtain semantically enhanced fusion features containing contextual structural information; Step S303: By combining the standardized subnetwork with the preset industry terminology database, the semantic enhancement fusion features are standardized to obtain standardized requirement content.

[0039] The document parsing subnetwork can adopt the LayoutLM model, including a multimodal embedding layer, a multi-layer Transformer encoder, and a prediction output layer. The multimodal embedding layer includes text embedding, image embedding, layout embedding, modal embedding, and position embedding. Each Transformer encoder layer contains a multi-head attention layer and a feedforward neural network. The prediction output layer includes an element classification head, a bounding box regression head, a hierarchy relationship head, and a table structure head. The document to be reviewed is input into the document parsing subnetwork. The multimodal embedding layer performs text embedding, image embedding, layout embedding, modal embedding, and position embedding on the document to be reviewed, and the resulting concatenation yields a multimodal fusion vector. The multimodal vector is then input into the multi-layer Transformer encoder, where the multi-head self-attention mechanism of the multi-head attention layer calculates the self-attention of the multimodal fusion vector. The self-attention is then merged to obtain the attention distribution feature. The attention distribution feature and the multimodal fusion vector are input into the feedforward neural network layer for connection enhancement, outputting the final multimodal enhanced fusion feature. The prediction output layer's task heads simultaneously perform classification prediction on the multimodal enhanced fusion feature to obtain structured content that maintains the logical structure of the original document. This process can effectively improve the accuracy of document parsing.

[0040] In some alternative implementations, after extracting structured content, contextual completion is performed for ambiguous statements in the document. For example, in a requirements document for a medical application, if a section describes "patient information must be properly stored," the system will combine the preceding "patient information includes name and medical record number" with the following "data is stored on a cloud server" to infer that "proper storage" may involve data encryption and access control, and then supplement it to "patient information must be stored encrypted and access restricted."

[0041] Furthermore, step S302 specifically includes: Structured content is input into a semantic enhancement subnetwork, which includes an embedding layer, a context encoding layer, an entity relation joint decoding layer, and a graph enhancement layer. The embedding layer performs vector transformation on the structured content to obtain structured text embedding vectors. The context encoding layer performs global context semantic encoding on the structured text embedding vectors to obtain context semantic features. The entity relation joint decoding layer performs joint entity relation extraction on the context semantic features to obtain entity relation triples. The graph enhancement layer performs semantic enhancement on the entity relation triples to generate semantically enhanced fusion features.

[0042] The embedding layer can be a GraphBERT embedding layer, which performs vector transformation on the structured content to obtain structured text embedding vectors.

[0043] The context encoding layer adopts a Transformer-based encoder architecture, consisting of multiple stacked encoders. Each encoder layer includes a multi-head attention layer and a feedforward network layer. Specifically, the multi-head self-attention mechanism of the multi-head attention layer extracts semantic features from the structured text embedding vector, capturing the semantic information and contextual relationships of the text in the structured text embedding vector to obtain the global context semantic encoding. The feedforward network layer then performs semantic space transformation and semantic enhancement on the global context semantic encoding to obtain context semantic features.

[0044] In this embodiment, the entity relation joint decoding layer decodes all entities, directed relations, and corresponding attributes simultaneously based on contextual semantic features. In one example, the entity relation joint decoding layer adopts a BART-Large decoder structure, which is composed of multiple stacked decoders. Each decoder layer includes a masked multi-head self-attention layer, a cross-attention layer, and a feedforward network layer. Specifically, each attention head of the masked multi-head self-attention layer performs self-attention calculation on the contextual semantic features to obtain the output of each attention head. The outputs of multiple heads are fused to obtain a multi-head attention feature representation. The multi-head attention feature representation and the contextual semantic features are input into the cross-attention layer for cross-attention calculation, outputting semantically aligned extracted features. Finally, the semantically aligned extracted features are subjected to semantic space transformation and semantic enhancement through the feedforward network layer to obtain the encoder attention output. The encoder attention output and the contextual semantic features are used as the input of the next decoder, and the calculation is repeated until all decoders have completed processing, outputting the final entity relation triplet. The extracted entity types include functional module entities, user role entities, and data entities; the relationship types include inclusion relationships, call relationships, flow relationships, operation relationships, permission relationships, and constraint relationships. Taking the financial field as an example, an example of an entity relationship triple is as follows: Personal credit approval module (head entity) - includes - risk rating sub-module (tail entity), credit reviewer (head entity) - calls - credit limit calculation module (tail entity), branch customer manager (head entity) - enters - loan application materials (tail entity), etc.

[0045] The graph enhancement layer performs semantic enhancement based on the entities and relations in the entity-relation triples, resulting in a semantically enhanced graph, i.e., semantically enhanced fusion features. In one example, the graph enhancement layer uses a graph neural network (GNN) to transfer and aggregate neighborhood entity feature information from the entity-relation triples, obtaining entity aggregate features; the entity aggregate features are then calculated using a self-attention mechanism to obtain semantically enhanced fusion features.

[0046] Specifically, key paths (i.e., relationships) are extracted from entity relationship triples, an entity relationship graph is constructed, an adjacency matrix of the entity relationship graph is established based on the connection relationships of entities in the entity relationship graph, and a feature vector matrix of the entity relationship graph is established based on the feature information of entities in the entity relationship graph. The established adjacency matrix and feature vector matrix are then passed through a graph neural network to transfer and aggregate the feature information of neighboring entities. The feature vector matrix of the entity relationship graph is updated based on the feature vectors of each entity after transfer and aggregation, resulting in entity aggregated features. For the feature vector of each entity in the entity aggregated features, the weight information is transferred and aggregated based on the importance of other entities on the key path relative to the current entity, and the feature vectors of each entity are updated through a self-attention mechanism, resulting in semantically enhanced fusion features.

[0047] Semantic enhancement processing through the semantic enhancement subnetwork can resolve textual ambiguity, unify semantic representation, and improve the information integrity and readability of the content.

[0048] After semantic enhancement of the structured content, the semantic enhancement fusion features are then semantically standardized to address potential ambiguities or non-standard terminology in the requirements document. Specifically, the system uses a pre-defined industry terminology library to match the descriptive text in the requirements document with standard terminology.

[0049] In some alternative implementations, step S303 specifically includes the following steps: The semantically enhanced fusion features are input into the standardization sub-network, which includes a semantic decoding layer and an industry alignment layer. Attention is calculated on the semantically enhanced fusion features through the semantic decoding layer to obtain semantic association features. The industry alignment layer matches and aligns the semantic association features with standard terms in a preset industry terminology library to obtain standardized requirement content.

[0050] The semantic decoding layer consists of multiple stacked decoders. The semantic enhancement fusion feature is input into the first decoder. Each attention head of the masked multi-head attention mechanism layer of the decoder performs self-attention calculation on the semantic enhancement fusion feature to obtain the output of each attention head. The outputs of multiple attention heads are fused with the semantic enhancement fusion feature to obtain the attention fusion feature representation of the decoder. The attention fusion feature representation is used as the input of the next decoder, and the calculation is repeated until all decoders have completed processing. The final attention fusion feature representation is then output and subjected to semantic feature space transformation to obtain semantic association features.

[0051] In one example, each decoder includes a masked multi-head attention layer, an encoder-decoder attention layer, and a decoder feedforward network layer. The semantic enhancement fusion features are processed sequentially through the masked multi-head attention layer, encoder-decoder attention layer, and decoder feedforward network layer of the decoder to obtain the attention fusion feature representation of the decoder.

[0052] Furthermore, by calling a preset industry terminology library through the industry alignment layer, the semantic association features are matched with the standard terms in the preset industry terminology library, and the semantic association features are standardized using the standard terms to obtain standardized requirement content.

[0053] Among them, the industry terminology library is a structured and scalable collection of domain knowledge built for security requirement review scenarios in specific industries such as finance and healthcare. It systematically includes all the core terms involved in the industry's business processes, data assets, user roles, operational behaviors and compliance requirements, and clarifies the standard names, synonyms, variants, classification attributes and security association information of the terms. It is a core supporting component for semantic standardization processing steps.

[0054] Standardization improves the clarity and consistency of document content, providing a more accurate basis for identifying subsequent security protection items.

[0055] Step S203: Through the security protection item identification network, based on the pre-built security knowledge base, perform contextual reasoning on the standardized requirement content to identify security protection items and establish a mapping relationship between the security protection items and the requirement description.

[0056] The security knowledge base is a pre-built database, a structured, hierarchical, and scalable collection of security domain knowledge built for security review scenarios during the application requirements phase. Its system integrates general security specifications, international security standards, and industry-specific compliance requirements such as finance and healthcare. It includes a three-tiered structure of security domains, protection items, and scenario examples. For example, security domains include data security and identity authentication, protection items include encrypted transmission and multi-factor authentication, and scenario examples cover protection cases in specific business scenarios.

[0057] The specific steps involved in building a security knowledge base include: Collect and integrate security knowledge from multiple sources, including general security standards (such as OWASP Top 10, "Information Security Technology: Classification of Information Security Vulnerabilities"), international security management systems (such as ISO 27001, ISO 27701), and industry-specific compliance standards (such as PCI in the financial industry). (DSS, Cybersecurity Classified Protection 2.0; HIPAA for the medical industry, "Administrative Measures for Cybersecurity of Medical and Health Institutions," etc.) Security is divided into primary security domains according to the core dimensions of security protection, forming the top-level framework of the knowledge base. These security domains include data security, access control, identity authentication, interface security, compliance auditing, and business logic security. Each security domain is further subdivided into secondary protection items. For example, the "data security domain" is broken down into protection items such as transmission encryption, storage encryption, data anonymization, data destruction, and third-party data sharing security; the "access control domain" is broken down into protection items such as horizontal access control, vertical access control, and the principle of least privilege. Each protection item is matched with multi-dimensional business scenario examples and corresponding compliance clauses, forming tertiary scenario examples. These scenario examples distinguish between general scenarios and industry-specific scenarios. For example, the "transmission encryption" protection item is associated with the general scenario "user password transmission must use TLS 1.3 or higher" and the financial scenario "bank card transaction data transmission must comply with PCI." The DSS Chapter 4 requirements state that "patient electronic medical record transmission must comply with the HIPAA encryption standard" in medical scenarios, and the specific compliance clause number corresponding to each scenario is marked. The completeness, accuracy, and applicability of the knowledge base are cross-validated by general security experts and security experts from industries such as finance and healthcare, correcting errors and omissions, and establishing a regular update mechanism to keep up with the latest security standards, regulations, and new security vulnerabilities, and regularly add new protection items and scenario examples.

[0058] In this embodiment, the security protection item identification network is a security domain model fine-tuned based on LLM. Specifically, the network is trained on a general LLM model using over 100,000 security cases from requirement documents. By combining the security protection item identification network with a security knowledge base to perform contextual reasoning on standardized requirement content, implicit protection items in the requirement documents are identified. For example, from "users can log in via mobile phone verification code," the protection item "protection against SMS verification code hijacking (e.g., limiting the number of times sent to SMS verification codes to ≤3 within 1 minute)" is identified.

[0059] In some alternative implementations, the security item identification network includes a knowledge retrieval layer, a low-rank encoding layer, and a decoding output layer; see [link to relevant documentation]. Figure 4 As shown, the steps described above for identifying security protection items through a security protection item identification network, based on a pre-built security knowledge base, and performing contextual reasoning on standardized requirements, include: Step S401: Retrieve security protection knowledge corresponding to standardized requirements from the pre-built security knowledge base through the knowledge retrieval layer; Step S402: Input the standardized requirements and security protection knowledge into the low-rank coding layer for low-rank attention calculation to obtain the knowledge-enhanced text representation; Step S403: The knowledge-enhanced text representation is input to the decoding output layer and decoded to generate the security protection item.

[0060] The knowledge retrieval layer employs a semantic retrieval model with a dual-encoder architecture, including a query encoder and a document encoder. The query encoder encodes standardized requirement content to obtain a query vector; the document encoder encodes each document fragment in the security knowledge base into a document vector; the similarity between the query vector and the document vector is calculated, and a preset number of document fragments with the highest similarity are selected based on the similarity to form security protection knowledge.

[0061] Next, the standardized requirements and security knowledge are input into a low-rank encoding layer, which consists of multiple low-rank encoders. The standardized requirements and security knowledge are fused through low-rank multi-head attention and inter-layer attention mechanisms within these low-rank encoders to obtain a knowledge-enhanced text representation. Feature extraction is performed through the low-rank multi-head attention mechanism. Specifically, the input standardized requirements and security knowledge are concatenated to obtain knowledge fusion features, which are then mapped to different low-rank subspaces. Multi-head self-attention computation is performed in these low-rank subspaces to obtain global semantic features of the knowledge fusion. Through multi-head parallel processing, the model can comprehensively understand the various dimensions of information from the standardized requirements and security knowledge. The inter-layer attention mechanism establishes information transmission channels between different low-rank encoders, enabling the deep network to utilize the basic features extracted by the shallow network. Specifically, the previous low-rank encoder inputs the output global semantic features of the knowledge fusion into the next low-rank encoder, which then performs low-rank multi-head attention computation on the global semantic features and the knowledge fusion features, until the last low-rank encoder outputs the final knowledge-enhanced text representation.

[0062] Finally, the knowledge-enhanced text representations are input into the decoding output layer, which employs a Transformer decoder structure composed of multiple stacked decoders. Each decoder includes a masked multi-head attention layer and a feedforward network layer. The multi-head attention mechanism of each decoder captures long-distance dependencies between the knowledge-enhanced text representations, identifying security safeguards.

[0063] For example, in contextual reasoning within a financial scenario, the system pays particular attention to content related to fund transactions and user identity. For instance, in a requirements document for an online payment application, if the description mentions that "users can complete payments via bank cards," the security protection item identification network will combine financial scenario cases from a security knowledge base to infer potential risks of card information leakage and payment fraud, mapping these to two protection items: "bank card data encryption" and "transaction behavior monitoring." Simultaneously, the security protection item identification network further analyzes the user roles involved in the payment process, such as the presence of third-party payment service providers, and infers the potentially required "third-party interface security authentication" protection item. Through this multi-layered reasoning, it can identify security protection items not explicitly mentioned in the requirements document but crucial to business security.

[0064] For example, in contextual reasoning based on healthcare industry requirements documents, the system loads a dedicated healthcare data security knowledge base containing protection items related to patient privacy and medical device access. For instance, when analyzing a requirements document for a telemedicine application, if the description mentions "doctors viewing real-time patient data via mobile devices," the security protection item identification network, combined with medical scenario examples from the security knowledge base, infers potential risks of unauthorized device access and data transmission leakage, mapping these to the protection items "device authentication" and "data transmission encryption." Simultaneously, the security protection item identification network further analyzes the patient data flow path, discovering that the data may be stored in third-party cloud services, thus additionally mapping to the protection item "cloud storage compliance check."

[0065] By combining a security protection item identification network with a security knowledge base to perform contextual reasoning on standardized requirements, implicit security protection items can be accurately identified, improving the security requirement identification rate and enhancing the completeness of protection item identification.

[0066] After identifying security protection items, a mapping relationship is established between the requirement descriptions in the requirements document and the security protection items. This mapping relationship is represented as: Requirement Description - Security Domain - Protection Item ID. Specifically, each identified security protection item is associated with a specific descriptive paragraph in the requirements document, and the associated page number and paragraph are marked. For example, "Synchronization of user information between the APP and the mini-program" is mapped to the "Cross-platform data encryption" protection item under the "Data Security Domain".

[0067] Furthermore, during the mapping process, the system automatically generates a preliminary risk assessment report based on the type of protection item and the business scenario. For example, after identifying the "SMS hijacking protection" item, the system uses case data from the security knowledge base to assess the potential risk of user account theft due to the non-implementation of this protection item, and generates a brief risk description, such as "SMS verification codes may be maliciously intercepted, threatening user account security." The generated risk assessment report can serve as a reference for generating subsequent protection recommendations.

[0068] Step S204: Generate a network through security protection recommendations, and combine the mapping relationship with the business scenarios in the requirements document to generate protection recommendations.

[0069] Specifically, the security protection suggestion generation network generates targeted protection suggestions by calling a preset suggestion template library based on the mapping relationship established in the aforementioned steps and in combination with the specific business scenarios described in the requirements document.

[0070] In some possible implementations, the steps described above for generating protection recommendations through a security protection recommendation generation network, combining the mapping relationship with the business scenarios in the requirements document, include: Identify the business scenarios in the requirements document and call the preset suggestion template library based on the business scenarios; input the mapping relationship and preset suggestion templates into the security protection suggestion generation network, and generate protection suggestions in combination with preset compliance rules.

[0071] The preset suggestion template library is a database containing security protection measures for various industries and business scenarios, including technical implementation details and verification methods. Specifically, the security protection suggestion generation network first identifies the business scenarios in the requirements document, and then selects an appropriate suggestion template from the preset suggestion template library based on the identified business scenarios.

[0072] Furthermore, the recommendation template breaks down the suggested content into multiple quantifiable technical indicators and corresponding verification methods for each indicator. For example, for the "identity authentication" security protection item, the recommended content includes the technical indicator "password strength": "password length must be at least 8 characters, containing a combination of uppercase and lowercase letters and numbers," and the corresponding verification method includes "simulating weak password attempts to log in during the development phase through unit tests." By breaking down the technical indicators, the enforceability of the protection recommendations can be enhanced.

[0073] During the generation of protection recommendations, the security protection recommendation generation network automatically adapts compliance content based on the regional and industry compliance requirements involved in the requirements document, which is to say, it presets compliance rules. For example, for the requirement of "collecting EU user data", the protection recommendation adds "protection measures that comply with Article 17 of the GDPR 'right to erasure'".

[0074] Further, see Figure 5As shown, the steps described above for inputting the mapping relationship and preset suggestion template into the security protection suggestion generation network, and generating protection suggestions in combination with preset compliance rules, include: Step S501: Input the mapping relationship and the preset suggestion template into the security protection suggestion generation network. The security protection suggestion generation network includes a rule matching layer and a suggestion generation layer. Step S502: Through the rule matching layer, the corresponding preset compliance rules are matched according to the requirement description in the mapping relationship; Step S503: Based on the mapping relationship, preset compliance rules, and preset suggestion template, construct the prompt instruction and input the suggestion generation layer; Step S504: Through the suggestion generation layer, generate protection suggestions according to the generation prompt instructions.

[0075] The security protection recommendation generation network automatically matches appropriate compliance content, i.e., preset compliance rules, based on the regional and industry compliance requirements mentioned in the requirement description. For example, for the requirement description of "collecting EU user data", the preset compliance rule "must comply with the protection measures of Article 17 of the GDPR 'right to erasure'" is automatically matched.

[0076] In one possible implementation, industry information and regional information are identified from the requirement description of the mapping relationship through a rule matching layer, and the corresponding industry compliance requirements are matched according to the industry information and regional information; the industry compliance requirements and requirement descriptions are converted into compliance requirement vectors and requirement query vectors respectively; the semantic similarity between the compliance requirement vectors and requirement query vectors is calculated, and the industry compliance requirement with the highest voice similarity is selected as the preset compliance rule for the corresponding requirement description.

[0077] The mapping relationship, preset compliance rules, and preset suggestion template are used to construct the prompt instruction. The process of generating the prompt instruction can be achieved through the preset suggestion template. Specifically, the parameter indicators corresponding to all variable placeholders in the preset suggestion module are determined, the corresponding parameter content is extracted from the mapping relationship and preset compliance rules, and automatically filled into the variable placeholders of the preset suggestion module to obtain the filled suggestion template, which is the generated prompt instruction.

[0078] Next, a suggestion generation layer generates protection suggestions based on the generated prompts. The suggestion generation layer calls a pre-trained large language model to generate targeted protection suggestions through an autoregressive approach based on the generated prompts.

[0079] In some embodiments, the proposed pre-trained large language model for generating layer calls includes an embedding layer, a low-rank adaptation layer, and multiple decoders with stacked connections, each decoder including a masked multi-head attention mechanism layer and a fully connected layer.

[0080] Specifically, the generated prompt instructions are embedded through an embedding layer to obtain a prompt vector.

[0081] The low-rank adaptation layer performs low-rank decomposition on the cue vector, specifically including: projecting the cue vector onto the first low-rank matrix of the low-rank adaptation layer to obtain a low-dimensional key feature vector; and reconstructing and projecting the low-dimensional key feature vector onto the second low-rank matrix of the low-rank adaptation layer to obtain the cue low-rank features. The low-rank adaptation layer introduces two low-rank matrices (the number of rows and columns of the low-rank matrix is ​​much smaller than that of the self-attention weight matrix), denoted as the first low-rank matrix A and the second low-rank matrix B. A typically has the same number of rows as the cue vector weight matrix and is used to compress the original high-dimensional input features into a low-dimensional bottleneck space to filter redundant information, retaining only the core features relevant to security protection suggestions. B has the same number of columns as the cue vector weight matrix and reconstructs and maps the compressed low-dimensional features back to the original high-dimensional input feature space (i.e., the protection suggestion generation space).

[0082] Next, the low-rank features of the prompts are input into multiple decoders for autoregressive generation to obtain the final protection suggestions. The low-rank features of the prompts are inferred through the masked multi-head attention mechanism layer and fully connected layer of each decoder until the last decoder has finished processing and outputs the generated protection suggestions.

[0083] For example, the generation of security recommendations for financial payment scenarios involves in-depth analysis of the security requirements within the payment process. For instance, in a requirements document for an online payment application, for the identified "transaction behavior monitoring" security protection item, the security recommendation generation network will select a financial industry template from its recommendation template library and generate a recommendation that reads: "Monitor user payment behavior in real time, detect abnormal transaction patterns, and automatically trigger alarms." Technical indicators include "the monitoring system must respond to abnormal transactions within 1 second" and "the alarm threshold must be dynamically adjusted based on user historical behavior"; the verification method is "testing the response speed and accuracy of the monitoring system by simulating abnormal transaction scenarios."

[0084] For example, regarding compliance protection recommendations in medical scenarios, such as in a requirements document for a telemedicine application, the security protection recommendation generation network might generate the following recommendation for the "remote access control" security protection item: "Doctors must use dual authentication when remotely accessing patient data and record operation logs for each access." Technical indicators include "dual authentication must be implemented using both passwords and dynamic verification codes" and "operation logs must be retained for at least 12 months for auditing"; the verification method is "testing the effectiveness of the dual authentication function by simulating doctor access scenarios."

[0085] By combining business scenarios and pre-defined compliance rules in the requirements document to generate protection recommendations, the scenario-based accuracy and compliance of the protection recommendations can be improved, while also enhancing their implementability.

[0086] Step S205: Create associated security requirement tasks based on security protection items and protection recommendations, and perform security protection on the requirement documents to be reviewed in accordance with the security requirement tasks.

[0087] In this embodiment, a pre-defined application programming interface (API) is used to interface with the requirements management tool to integrate the requirements management system. The security protection items identified in the preceding steps and the generated protection suggestions are synchronized to the requirements management system, forming traceable security requirement tasks. Based on the priority of the security protection items and the business scenario, each task is automatically assigned to the corresponding execution end for security protection of the requirements documents to be reviewed.

[0088] Each security requirement task includes a unique identifier for the security protection item, the specific content of the protection recommendation, and its association with the requirement document (such as the page number or paragraph number of the requirement document).

[0089] Specifically, security protection items and recommendations are structured and encapsulated according to a predefined format to obtain structured security protection recommendations. These encapsulated structured security protection recommendations are then synchronized to the requirements management system to ensure the integrity and consistency of data transmission. Each security requirement task includes fields such as "protection item name," "recommendation content," "priority," and "document association location," enabling the requirements management system to accurately parse and display them to the development team. Simultaneously, the system records operation logs for each synchronization, including synchronization time, number of tasks, and synchronization status, for subsequent investigation and auditing. This structured synchronization method ensures that security review results are seamlessly integrated into the development process.

[0090] In some embodiments, the requirements management system supports multiple interface protocols and data formats to adapt to different requirements management tools. For example, for internal enterprise requirements management platforms, data synchronization is achieved through customized interfaces to ensure that security requirements tasks maintain consistent numbering rules and status transition logic with existing requirements tasks; for cloud-based requirements management tools, a common application programming interface is used for data push, and batch task creation and update functions are supported. Through this flexible integration method, the security review model can be seamlessly integrated into the development process of different project environments.

[0091] In some alternative implementations, the step of creating associated security requirement tasks based on security protection items and protection recommendations also includes: The version control mechanism monitors changes to the requirements document. When a change is detected, a re-identification process is automatically triggered, and the security review model is invoked to re-execute steps S201 to 205 on the changed requirements document.

[0092] Specifically, the version number and content hash value of the requirements document are compared regularly. When a major content update is detected (such as adding a new feature description or modifying an existing feature description), the updated requirements document is immediately obtained and a re-identification process is triggered.

[0093] This real-time monitoring mechanism ensures that security reviews are always based on the latest requirements, improving the accuracy of security review results and thus guaranteeing the precision and timeliness of protection recommendations.

[0094] In some optional implementations, a security protection coverage report is generated for the reviewed requirements document. The security protection coverage report uses a heatmap to show the distribution of protection items in each part of the requirements document. The missing risk level of protection items is marked with red, yellow and green to show the distribution of security protection items in the requirements document. For example, red indicates "high risk missing: payment data does not mention encryption".

[0095] In some optional implementations, task status tracking is used to monitor the changes in the requirements document, update the implementation status of security requirements tasks in real time, and generate progress reports. For example, after a requirements document for a financial payment application is updated, the implementation progress of newly added protection tasks is tracked. If the status of the "payment request signature verification" task changes from "pending" to "completed," a progress report is updated and pushed to the project manager so that the team can understand the implementation status of security requirements.

[0096] This application automates the processing of security review requirement documents through a pre-trained security review model, significantly improving the automation and accuracy of security reviews while reducing manual intervention costs. Furthermore, the security review model combines industry-specific security knowledge bases for contextual reasoning, accurately identifying implicit security protection items and improving the security requirement identification rate. It also generates targeted protection recommendations based on business scenarios, enhancing the accuracy of these recommendations. Simultaneously, by automatically synchronizing security protection items and recommendations as associated security requirement tasks, it ensures the automatic flow of security requirement tasks, increasing the implementation rate of protection recommendations. This, in turn, safeguards the security and compliance of multi-industry application development and provides efficient support for security management in complex business scenarios.

[0097] The embodiments of this application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) refers to the theories, methods, technologies, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0098] Foundational technologies for artificial intelligence generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies mainly encompass computer vision, robotics, biometrics, speech processing, natural language processing, and machine learning / deep learning.

[0099] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing related hardware through computer-readable instructions. These computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above methods. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, optical disk, or read-only memory (ROM), or random access memory (RAM).

[0100] It should be understood that although the steps in the flowcharts of the accompanying figures are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0101] Further reference Figure 6 As a response to the above Figure 2 The implementation of the method shown in this application provides an embodiment of a requirement document security protection device, which is similar to... Figure 2 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0102] like Figure 6As shown, the requirement document security protection device 600 described in this embodiment includes: an acquisition module 601, a document parsing module 602, an identification module 603, a suggestion generation module 604, and a task association module 605. Wherein: The acquisition module 601 is used to acquire the requirement document to be reviewed and input the requirement document to be reviewed into the trained security review model, wherein the security review model includes a document parsing network, a security protection item identification network, and a security protection suggestion generation network. The document parsing module 602 is used to extract the structured content of the requirement document to be reviewed through the document parsing network, and to perform semantic enhancement and standardization processing on the structured content to obtain standardized requirement content; The identification module 603 is used to identify security protection items by performing contextual reasoning on the standardized requirements content based on a pre-built security knowledge base through the security protection item identification network, and to establish a mapping relationship between the security protection items and the requirements description. The suggestion generation module 604 is used to generate protection suggestions by combining the mapping relationship with the business scenarios in the requirement document through the security protection suggestion generation network; The task association module 605 is used to create associated security requirement tasks based on the security protection items and the protection suggestions, and to perform security protection on the requirement document to be reviewed in accordance with the security requirement tasks.

[0103] It should be emphasized that, to further ensure the privacy and security of the aforementioned documents to be reviewed, these documents can also be stored in a node of a blockchain.

[0104] Based on the aforementioned requirement document security protection device 600, and through a trained security review model, the automated processing of requirement documents to be reviewed is achieved, significantly improving the automation level and accuracy of security reviews while reducing the cost of manual intervention. Furthermore, the security review model combines industry-specific security knowledge bases for contextual reasoning, accurately identifying implicit security protection items, improving the security requirement identification rate, and generating targeted protection suggestions based on business scenarios, thus improving the accuracy of these suggestions. Simultaneously, by automatically synchronizing security protection items and protection suggestions as associated security requirement tasks, the automatic flow of security requirement tasks is ensured, improving the implementation rate of protection suggestions.

[0105] In some optional implementations, the document parsing network includes a document parsing subnetwork, a semantic enhancement subnetwork, and a normalization subnetwork, and the document parsing module 602 includes: The parsing submodule is used to perform structural parsing and key information extraction on the document to be reviewed through the document parsing subnetwork to obtain structured content; The semantic enhancement submodule is used to perform semantic enhancement on the structured content through the semantic enhancement subnetwork to obtain semantic enhancement fusion features containing contextual structure information; The standardization submodule is used to standardize the semantic enhancement fusion features by combining the standardization subnetwork with a preset industry terminology library to obtain standardized requirement content.

[0106] The above process can effectively improve the accuracy of document parsing.

[0107] In some optional implementations of this embodiment, the semantic enhancement submodule includes: The first input unit is used to input the structured content into the semantic enhancement sub-network, which includes an embedding layer, a context encoding layer, an entity relation joint decoding layer, and a graph enhancement layer. The vector embedding unit is used to perform vector transformation on the structured content through the embedding layer to obtain a structured text embedding vector; A context encoding unit is used to perform global context semantic encoding on the structured text embedding vector through the context encoding layer to obtain context semantic features; The entity extraction unit is used to perform joint entity relation extraction on the context semantic features through the entity relation joint decoding layer to obtain entity relation triples. The semantic enhancement unit is used to semantically enhance the entity relation triples through the graph enhancement layer and generate semantically enhanced fusion features.

[0108] Semantic enhancement processing through the semantic enhancement subnetwork can resolve textual ambiguity, unify semantic representation, and improve the information integrity and readability of the content.

[0109] In some optional implementations of this embodiment, the standardization submodule includes: The second input unit is used to input the semantic enhancement fusion feature into the normalization sub-network, which includes a semantic decoding layer and an industry alignment layer. An attention calculation unit is used to perform attention calculation on the semantically enhanced fusion features through the semantic decoding layer to obtain semantically related features; The standardization unit is used to match and align the semantic association features with standard terms in the preset industry terminology library through the industry alignment layer to obtain standardized requirement content.

[0110] Standardization improves the clarity and consistency of document content, providing a more accurate basis for identifying subsequent security protection items.

[0111] In some optional implementations, the security protection item identification network includes a knowledge retrieval layer, a low-rank encoding layer, and a decoding output layer, and the identification module 603 includes: The retrieval submodule is used to retrieve security protection knowledge corresponding to the standardized requirements from a pre-built security knowledge base through the knowledge retrieval layer. The low-rank encoding submodule is used to input the standardized requirements and the security protection knowledge into the low-rank encoding layer to perform low-rank attention calculation and obtain a knowledge-enhanced text representation. The decoding submodule is used to input the knowledge-enhanced text representation into the decoding output layer for decoding and generation to obtain security protection items.

[0112] By combining a security protection item identification network with a security knowledge base to perform contextual reasoning on standardized requirements, implicit security protection items can be accurately identified, improving the security requirement identification rate and enhancing the completeness of protection item identification.

[0113] In some alternative implementations, it is recommended that module 604 include: The submodule is invoked to identify the business scenarios in the requirement document and invoke the preset suggestion template library based on the business scenarios. The generation submodule is used to input the mapping relationship and the preset suggestion template into the security protection suggestion generation network, and generate protection suggestions in combination with preset compliance rules.

[0114] In some optional implementations of this embodiment, the generation submodule includes: The third input unit is used to input the mapping relationship and the preset suggestion template into the security protection suggestion generation network, which includes a rule matching layer and a suggestion generation layer. The matching unit is used to match the corresponding preset compliance rules according to the requirement description in the mapping relationship through the rule matching layer; The construction unit is used to construct and input the prompt instruction into the suggestion generation layer based on the mapping relationship, the preset compliance rules and the preset suggestion template; The suggestion generation unit is used to generate protection suggestions based on the generation prompt instructions through the suggestion generation layer.

[0115] By combining business scenarios and pre-defined compliance rules in the requirements document to generate protection recommendations, the scenario-based accuracy and compliance of the protection recommendations can be improved, while also enhancing their implementability.

[0116] To address the aforementioned technical problems, embodiments of this application also provide a computer device. Please refer to [link / reference needed]. Figure 7 , Figure 7 This is a basic structural block diagram of the computer device in this embodiment.

[0117] The computer device 7 includes a memory 71, a processor 72, and a network interface 73 that are interconnected via a system bus. It should be noted that only a computer device 7 with a memory 71, a processor 72, and a network interface 73 is shown in the figure; however, it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented alternatively. Those skilled in the art will understand that the computer device described here is a device capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0118] The computer device can be a desktop computer, laptop, handheld computer, or cloud server, etc. The computer device can interact with the user via a keyboard, mouse, remote control, touchpad, or voice control.

[0119] The memory 71 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 71 may be an internal storage unit of the computer device 7, such as the hard disk or memory of the computer device 7. In other embodiments, the memory 71 may also be an external storage device of the computer device 7, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device 7. Of course, the memory 71 may include both the internal storage unit and its external storage device of the computer device 7. In this embodiment, the memory 71 is typically used to store the operating system and various application software installed on the computer device 7, such as computer-readable instructions for security protection methods of requirement documents. In addition, the memory 71 can also be used to temporarily store various types of data that have been output or will be output.

[0120] In some embodiments, the processor 72 may be a central processing unit (CPU), controller, microcontroller, microprocessor, or other data processing chip. The processor 72 is typically used to control the overall operation of the computer device 7. In this embodiment, the processor 72 is used to execute computer-readable instructions stored in the memory 71 or to process data, for example, to execute computer-readable instructions for the requirements document security protection method.

[0121] The network interface 73 may include a wireless network interface or a wired network interface, which is typically used to establish communication connections between the computer device 7 and other electronic devices.

[0122] By employing a well-trained security review model, the processing of review requirement documents is automated, significantly improving the automation and accuracy of security reviews while reducing the cost of manual intervention. Furthermore, the security review model combines industry-specific security knowledge bases for contextual reasoning, accurately identifying implicit security protection items, improving the security requirement identification rate, and generating targeted protection recommendations based on business scenarios, thus enhancing the accuracy of these recommendations. Simultaneously, by automatically synchronizing security protection items and recommendations as associated security requirement tasks, the automatic flow of security requirement tasks is ensured, improving the implementation rate of protection recommendations. This, in turn, safeguards the security and compliance of applications across multiple industries, providing efficient support for security management in complex business scenarios.

[0123] This application also provides another embodiment, namely, providing a computer-readable storage medium storing computer-readable instructions that can be executed by at least one processor to cause the at least one processor to perform the steps of the above-described requirements document security protection method.

[0124] By employing a well-trained security review model, the processing of review requirement documents is automated, significantly improving the automation and accuracy of security reviews while reducing the cost of manual intervention. Furthermore, the security review model combines industry-specific security knowledge bases for contextual reasoning, accurately identifying implicit security protection items, improving the security requirement identification rate, and generating targeted protection recommendations based on business scenarios, thus enhancing the accuracy of these recommendations. Simultaneously, by automatically synchronizing security protection items and recommendations as associated security requirement tasks, the automatic flow of security requirement tasks is ensured, improving the implementation rate of protection recommendations. This, in turn, safeguards the security and compliance of applications across multiple industries, providing efficient support for security management in complex business scenarios.

[0125] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0126] It should be noted that any AI models, software tools, or components not belonging to this company appearing in the embodiments of this application are merely illustrative examples and do not represent actual use. All user personal information involved in the embodiments of this application has been authorized (with the knowledge and consent) by the relevant parties or has been fully authorized by all parties, and the executing entity may obtain it through various legal and compliant means. The collection, storage, use, processing, transmission, provision, and disclosure of the information, data, and signals involved all comply with relevant laws and regulations and do not violate public order and good morals.

[0127] Obviously, the embodiments described above are only some embodiments of this application, not all embodiments. The accompanying drawings show preferred embodiments of this application, but do not limit the patent scope of this application. This application can be implemented in many different forms; rather, the purpose of providing these embodiments is to provide a more thorough and comprehensive understanding of the disclosure of this application. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of this application's specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the scope of patent protection of this application.

Claims

1. A method for protecting the security of requirements documents, characterized in that, Includes the following steps: Obtain the requirement document to be reviewed, and input the requirement document to be reviewed into the trained security review model, wherein the security review model includes a document parsing network, a security protection item identification network, and a security protection suggestion generation network; The document parsing network extracts the structured content of the requirement document to be reviewed, and performs semantic enhancement and standardization on the structured content to obtain standardized requirement content. The security protection item identification network is used to perform contextual reasoning on the standardized requirements based on a pre-built security knowledge base, identify security protection items, and establish a mapping relationship between the security protection items and the requirements description. The security protection suggestion generation network combines the mapping relationship with the business scenarios in the requirements document to generate protection suggestions. Based on the security protection items and the protection recommendations, create associated security requirement tasks, and perform security protection on the requirement documents to be reviewed in accordance with the security requirement tasks.

2. The requirement document security protection method according to claim 1, characterized in that, The document parsing network includes a document parsing subnetwork, a semantic enhancement subnetwork, and a normalization subnetwork. The step of extracting the structured content of the document to be reviewed from the document parsing network, and performing semantic enhancement and normalization on the structured content to obtain standardized requirement content includes: The document parsing subnetwork is used to perform structural analysis and key information extraction on the document to be reviewed, resulting in structured content. The semantic enhancement subnetwork is used to semantically enhance the structured content to obtain semantically enhanced fusion features containing contextual structure information; By combining the standardized subnetwork with a preset industry terminology database, the semantic enhancement fusion features are standardized to obtain standardized requirement content.

3. The requirement document security protection method according to claim 2, characterized in that, The step of semantically enhancing the structured content through the semantic enhancement sub-network to obtain semantically enhanced fusion features containing contextual structure information includes: The structured content is input into the semantic enhancement subnetwork, which includes an embedding layer, a context encoding layer, an entity relation joint decoding layer, and a graph enhancement layer. The structured content is vectorized through the embedding layer to obtain the structured text embedding vector; The structured text embedding vector is globally semantically encoded using the context encoding layer to obtain context semantic features; The entity relation joint decoding layer extracts entity relations from the context semantic features to obtain entity relation triples. The entity relationship triples are semantically enhanced by the graph enhancement layer to generate semantically enhanced fusion features.

4. The requirement document security protection method according to claim 2, characterized in that, The step of standardizing the semantic enhancement fusion features by combining the standardized subnetwork with a preset industry terminology database to obtain standardized requirement content includes: The semantically enhanced fusion features are input into the standardized sub-network, which includes a semantic decoding layer and an industry alignment layer. The semantically enhanced fusion features are processed by the semantic decoding layer to obtain semantically related features; The industry alignment layer matches and aligns the semantic association features with standard terms in the preset industry terminology library to obtain standardized requirement content.

5. The requirement document security protection method according to claim 1, characterized in that, The security protection item identification network includes a knowledge retrieval layer, a low-rank encoding layer, and a decoding output layer. The step of identifying security protection items by performing contextual reasoning on the standardized requirement content based on a pre-built security knowledge base through the security protection item identification network includes: The knowledge retrieval layer retrieves security protection knowledge corresponding to the standardized requirements from a pre-built security knowledge base. The standardized requirements and the security protection knowledge are input into the low-rank coding layer for low-rank attention calculation to obtain a knowledge-enhanced text representation. The knowledge-enhanced text representation is input into the decoding output layer for decoding and generation, resulting in a security protection item.

6. The requirement document security protection method according to claim 1, characterized in that, The step of generating protection recommendations by combining the mapping relationship with the business scenarios in the requirements document through the security protection recommendation generation network includes: Identify the business scenarios in the requirements document, and call the preset suggestion template library based on the business scenarios; The mapping relationship and the preset suggestion template are input into the security protection suggestion generation network, and protection suggestions are generated in combination with preset compliance rules.

7. The requirement document security protection method according to claim 6, characterized in that, The step of inputting the mapping relationship and the preset suggestion template into the security protection suggestion generation network, and generating protection suggestions in combination with preset compliance rules, includes: The mapping relationship and the preset suggestion template are input into the security protection suggestion generation network, which includes a rule matching layer and a suggestion generation layer. Through the rule matching layer, corresponding preset compliance rules are matched according to the requirement description in the mapping relationship; Based on the mapping relationship, the preset compliance rules, and the preset suggestion template, construct a prompt instruction and input it into the suggestion generation layer; The suggestion generation layer generates protection suggestions based on the generation prompt instructions.

8. A security protection device for requirement documents, characterized in that, include: The acquisition module is used to acquire the requirement document to be reviewed and input the requirement document to be reviewed into the trained security review model, wherein the security review model includes a document parsing network, a security protection item identification network, and a security protection suggestion generation network. The document parsing module is used to extract the structured content of the requirement document to be reviewed through the document parsing network, and to perform semantic enhancement and standardization processing on the structured content to obtain standardized requirement content; The identification module is used to identify security protection items by performing contextual reasoning on the standardized requirements content based on a pre-built security knowledge base through the security protection item identification network, and to establish a mapping relationship between the security protection items and the requirements description. The suggestion generation module is used to generate protection suggestions by combining the mapping relationship with the business scenarios in the requirements document through the security protection suggestion generation network; The task association module is used to create associated security requirement tasks based on the security protection items and the protection suggestions, and to perform security protection on the requirement document to be reviewed in accordance with the security requirement tasks.

9. A computer device, characterized in that, The method includes a memory and a processor, wherein the memory stores computer-readable instructions, and the processor executes the computer-readable instructions to implement the steps of the requirement document security protection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the requirement document security protection method as described in any one of claims 1 to 7.

Images