Report generation method, electronic device, medium, and product

Abstract

This application discloses a report generation method, electronic device, medium, and product. The method includes: matching a target template based on user-inputted raw source data and historical report requirements; performing format analysis on the raw source data to obtain analysis results; preprocessing the raw source data based on the analysis results to obtain preprocessed data; generating visualization elements, text content, and multimedia elements based on the preprocessed data, the target template, and the analysis results; and generating a multimodal report based on the visualization elements, text content, multimedia elements, and the target template. This method enables intelligent template matching through joint analysis of raw source data and historical requirements, and performs adaptive format recognition and standardized preprocessing on multi-source heterogeneous data, ultimately generating a multimodal report integrating text, charts, and multimedia content. This effectively improves the automation level, data compatibility, and intuitiveness and professionalism of information delivery in report generation.

Description

Technical Field

[0001] This application relates to the field of data processing technology, specifically to a report generation method, electronic device, readable storage medium, and computer program product. Background Technology

[0002] In today's era of digital information explosion, industries such as finance, energy, and government generate massive amounts of data daily. Efficiently extracting value from this complex data and generating targeted reports has become a critical need. Existing report generation methods typically use preset templates combined with dynamic data population to automate report generation. However, when data from different sources has significantly different formats and structures, current technologies cannot adaptively identify and analyze the input data's format. This leads to parsing errors or generation failures when the data format does not match the template's expectations. Furthermore, the generated reports are primarily presented in text format, lacking automatic integration of visual charts and multimedia content, resulting in less intuitive presentation of key information and reduced readability. Summary of the Invention

[0003] In view of the above problems, this application provides a report generation method, electronic device, readable storage medium, and computer program product, which can solve the problems of poor data processing adaptability and monotonous report format.

[0004] Firstly, this application provides a report generation method, including: Match the target template based on the user's input of raw source data and historical report requirements; The original source data is subjected to format analysis to obtain the analysis results; Based on the analysis results, the original source data is preprocessed to obtain preprocessed data; Based on the preprocessed data, the target template, and the analysis results, visual elements, text content, and multimedia elements are generated. A multimodal report is generated based on the visualization elements, the text content, the multimedia elements, and the target template.

[0005] In the above technical solution, this method can achieve intelligent template matching through joint analysis of raw source data and historical requirements. On this basis, it performs format adaptive recognition and standardized preprocessing on multi-source heterogeneous data, thereby effectively avoiding parsing errors caused by data format differences. At the same time, it automatically generates matching visualization charts, text analysis and multimedia content based on the preprocessing results, and organically integrates them into a multimodal report. This makes the final output not only accurate and reliable in data processing, but also intuitive and professional in information presentation, thereby comprehensively improving the automation level of report generation, data compatibility and readability of the final report.

[0006] In some implementations, matching the target template based on the user-input raw source data and historical report requirements includes: Feature extraction is performed on the raw source data input by the user to obtain data features; wherein, the data features include one or more of the following: data type, data size, data source, data relationship, and field type distribution; Collect users' historical report requests; Using the data features and the historical report requirements as input, a deep learning-based intelligent recommendation model is invoked to perform multi-dimensional template matching processing to obtain a candidate template set; wherein, the multi-dimensional factors include one or more of field matching degree, industry adaptability, and module completeness. Select the target template based on the set of candidate templates.

[0007] In the above technical solution, the method can dynamically select the optimal template based on each specific data input and historical preferences, avoiding generation failures or repeated manual trial and error caused by template and data mismatch, thereby significantly improving the intelligence level of template adaptation, the accuracy of recommendation results and user experience.

[0008] In some implementations, selecting a target template based on the candidate template set includes: Receive template selection instructions input by the user for the candidate template set; An initial template is selected from the candidate template set according to the template selection instruction; When a template editing instruction is received from a user regarding the initial template, the initial template is adjusted according to the template editing instruction to obtain the target template; The template editing instructions include one or more of the following: adding chart placeholders, adjusting chart placeholders, and setting chart type and style parameters.

[0009] In the above technical solution, the method enables users to flexibly adjust the template through simple visual operations on the basis of intelligent recommendation, thereby meeting the personalized customization needs in different scenarios while retaining the efficiency of automated recommendation, thus effectively reducing the technical threshold and operational difficulty of template modification.

[0010] In some implementations, the step of preprocessing the original source data based on the analysis results to obtain preprocessed data includes: The original source data is cleaned according to the data processing method that matches the analysis results to obtain the first processed data; The first processed data is format-converted according to the target template and the historical report requirements to obtain the second processed data; When the second processing data includes data from multiple data sources, data fusion processing is performed on the data from the multiple data sources in the second processing data to obtain preprocessed data.

[0011] In the above technical solution, the method can automatically match the corresponding cleaning strategy for raw data of different formats and structures, effectively remove redundant, erroneous or invalid information, and convert the data into a standardized format according to the template requirements. At the same time, it supports intelligent association and fusion of multi-source data, thereby ensuring that the data input into the report is accurate, clean and complete, providing a high-quality data foundation for subsequent report generation.

[0012] In some implementations, the step of converting the format of the first processed data according to the target template and the historical report requirements to obtain the second processed data includes: The data field format is determined based on the target template and the historical report requirements; The data format of the first processed data is converted into the data field format to obtain the second processed data.

[0013] In the above technical solution, the method can accurately determine the required data field format according to the target template and historical needs, and automatically convert the cleaned data into the format, thereby ensuring seamless connection between the data and the template and avoiding filling errors or content loss due to inconsistent formats.

[0014] In some embodiments, the step of performing data fusion processing on data from multiple data sources in the second processed data to obtain preprocessed data includes: Obtain the relationships between multiple data sources in the second processed data; Based on the correlation between the multiple data sources, the second processed data is fused to obtain preprocessed data; The relationship between the multiple data sources is a multi-level association key chain, which includes at least two levels of serial association key chains among asset identifiers, vulnerability identifiers, and attack addresses.

[0015] In the above technical solution, the method can deeply associate and integrate security data scattered in different data sources based on the correlation established between multi-source data and by using multi-level association key chains (such as the serial matching of asset identifiers, vulnerability identifiers, and attack addresses). This breaks down data silos and makes heterogeneous data from different devices and platforms form an organic whole, providing more comprehensive and accurate data support for subsequent report analysis.

[0016] In some implementations, generating visualization elements, text content, and multimedia elements based on the preprocessed data, the target template, and the analysis results includes: Based on the preprocessed data and the target template, generate text content; Based on the preprocessed data and the analysis results, visualization elements are generated according to preset mapping rules; wherein, the preset mapping rules include time series data corresponding to line charts, category proportion data corresponding to pie charts or donut charts, and risk level data corresponding to heat maps; Multimedia elements are obtained based on the preprocessed data and the target template; wherein, the multimedia elements include one or more of interactive links, images, and security watermarks.

[0017] In the above technical solution, the method can automatically match the most suitable chart type (such as line chart for time series, pie chart for category proportion, and heat map for risk level) according to preset rules based on the characteristics and analysis results of the preprocessed data. At the same time, it generates appropriate text analysis and multimedia elements, so that the report can achieve organic unity in content description, data visualization and interactive experience, thereby significantly improving the professionalism of the report and the efficiency of information transmission.

[0018] In some implementations, generating text content based on the preprocessed data and the target template includes: The preprocessed data is statistically analyzed to obtain statistical results. The indicator data is calculated based on the preset compliance standards and the preprocessed data; wherein, the indicator data includes one or more of the following: compliance rate, repair rate, and response time. Based on the statistical results and indicator data, and combined with a professional security terminology database, analytical text is generated. Based on the preset static text in the target template and the preprocessed data, generate fixed descriptive text; The text content includes the analytical text and the fixed descriptive text.

[0019] In the above technical solution, the method can perform statistical calculations on preprocessed data and automatically calculate key indicators such as compliance rate and repair rate according to compliance standards. It combines a professional security terminology library to generate analytical text, and at the same time, it is combined with static descriptive text in the template so that the report content is both data-supported and professionally expressed, thereby realizing the intelligent conversion of data to text and improving the automation level and professionalism of report generation.

[0020] In some implementations, generating a multimodal report based on the visualization elements, the text content, the multimedia elements, and the target template includes: The visualization elements, text content, and multimedia elements are integrated according to the target template to obtain a first initial report; The content of the first initial report is processed by risk level color mapping and compliance item annotation to obtain the second initial report; When a report editing instruction is received for the second initial report, the second initial report is edited and adjusted according to the report editing instruction to obtain the final multimodal report.

[0021] In the above technical solution, the method can organically integrate visual elements, text content and multimedia elements according to the template, and automatically perform risk level color mapping and compliance item marking on the report content, making key risk points and compliance gaps clear at a glance. At the same time, it supports users to flexibly edit and adjust the report, taking into account personalized expression needs while ensuring the professionalism and standardization of the report.

[0022] In a second aspect, this application provides an electronic device including a memory and a processor, the memory storing a computer program, and the processor running the computer program to cause the electronic device to perform the report generation method described in any one of the first aspects.

[0023] Thirdly, this application provides a readable storage medium storing a computer program, which, when executed by a processor, performs the report generation method described in any one of the first aspects.

[0024] Fourthly, this application provides a computer program product comprising a computer program that, when executed by a processor, performs the report generation method described in any one of the first aspects.

[0025] The beneficial effects of this application are as follows: By adaptively identifying, cleaning, and fusing multi-source heterogeneous data, combined with a deep learning template recommendation mechanism driven by historical needs and data characteristics, the entire process from data input to report output is automated, significantly reducing manual intervention and error rates. Simultaneously, the visual template editing and adjustment functions lower the technical barrier to template modification, enabling non-technical personnel to easily customize templates. Furthermore, based on data type, visual elements such as line charts, pie charts, and heatmaps are automatically matched, and analytical text is generated using professional security terminology, ultimately forming a multimodal report that enhances the intuitiveness and professionalism of information delivery. In addition, risk level color mapping and compliance item labeling are automatically performed during report generation, ensuring that the output meets regulatory requirements. Finally, the integrated encrypted output, audit trail, and tiered distribution mechanisms throughout the entire process effectively guarantee the confidentiality and traceability of the security report. Attached Figure Description

[0026] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 This is a flowchart illustrating the report generation method in some embodiments of this application; Figure 2 This is a schematic diagram of the report generation apparatus in some embodiments of this application; Figure 3 This is a schematic diagram of the structure of an electronic device in some embodiments of this application. Detailed Implementation

[0028] The embodiments of the technical solution of this application will now be described in detail with reference to the accompanying drawings. These embodiments are only used to more clearly illustrate the technical solution of this application and are therefore merely examples, and should not be used to limit the scope of protection of this application.

[0029] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having”, and any variations thereof, in the specification, claims, and foregoing description of the drawings are intended to cover non-exclusive inclusion.

[0030] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more (including two), similarly, "multiple sets" refers to two or more sets (including two sets), and "multiple pieces" refers to two or more pieces (including two pieces) unless otherwise explicitly defined.

[0031] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0032] In the description of the embodiments in this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0033] Existing report generation methods typically use preset templates combined with dynamic data population to automate report generation. However, when there are significant differences in the format and structure of data from different sources, they cannot adaptively identify and analyze the input data's format. Furthermore, the reports are primarily presented in text format, lacking automatic integration of visualization charts and multimedia content. Therefore, existing methods suffer from poor data processing adaptability, a limited range of report formats, inflexible template configuration, insufficient professionalism and compliance, and poor security and controllability.

[0034] To address the aforementioned technical issues, this application provides a report generation method. This method aims to construct a complete processing chain from multi-source heterogeneous data input to multi-modal report output, with the bidirectional adaptation of templates and data as its core, so as to achieve full-process automation of report production and professional controllability of output quality.

[0035] like Figure 1 As shown, some embodiments of this application provide a report generation method, which includes: S100: Match the target template based on the user's input of raw source data and historical report requirements.

[0036] In this embodiment, the original source data refers to the original data file to be analyzed uploaded by the user, including but not limited to structured or semi-structured data exported from multiple security devices and platforms, such as attack logs of intrusion detection systems (IDS), vulnerability scanning results of vulnerability scanning platforms, and event handling records of emergency response platforms.

[0037] In this embodiment, the original source data can be obtained based on the report generation instructions input by the user.

[0038] In this embodiment, historical report requirements refer to information such as report types, usage scenarios, data metrics of interest, commonly used modules, and layout preferences contained in the user's historical report generation records, which are used to reflect the user's long-term reporting habits and preferences.

[0039] In this embodiment, the target template refers to the FreeMarker template file determined after template matching, which is used to guide the generation of the final report. The template defines the report's structural framework, chapter division, data filling positions, visual element placeholders, and style parameters.

[0040] S200. Perform format analysis on the original source data to obtain the analysis results.

[0041] In this embodiment, format analysis refers to the identification and structure parsing of the original source data, including the identification of file format, field separator, header row position, field type, and data quality (such as null values, inconsistent format, duplicate records, etc.).

[0042] In this embodiment, the analysis result refers to the identification conclusion obtained after format analysis, including file format type, data structure characteristics, field attribute information and data quality assessment results, which are used to guide the automatic selection of subsequent data processing methods.

[0043] In this embodiment, the method can use a variety of data parsing algorithms to recognize the format of the input data.

[0044] For example, for structured data, its format is determined by analyzing information such as the table header and field types; for unstructured data, such as text files, text classification algorithms and regular expression matching are used to determine the structural characteristics of the data.

[0045] In this embodiment, once the data format is identified, the method can automatically select the appropriate data processing method to obtain the analysis results.

[0046] S300. Based on the analysis results, preprocess the original source data to obtain preprocessed data.

[0047] In this embodiment, preprocessing refers to a series of automated processing operations that clean, transform, and fuse the original source data based on the analysis results. These operations include removing redundant or invalid data, unifying data formats, handling missing and outlier values, and associating and integrating data from multiple data sources to transform the original data into standardized data that meets template requirements and is of reliable quality.

[0048] In this embodiment, preprocessed data refers to standardized data obtained after the original source data has been cleaned, transformed, and fused. This data has eliminated redundant and invalid information, standardized the format, and completed the association and integration of multi-source data, and can be directly used to generate subsequent report content.

[0049] S400: Generate visualization elements, text content, and multimedia elements based on preprocessed data, target templates, and analysis results.

[0050] In this embodiment, visualization elements refer to chart components that present preprocessed data in a graphical manner, including but not limited to line charts, pie charts, donut charts, bar charts, heatmaps, etc., which are used to intuitively display the changing trends, distribution proportions, and risk levels of the data.

[0051] In this embodiment, the text content includes analytical text and fixed descriptive text. The analytical text is an analytical description automatically generated based on data statistics and compliance indicator calculations, combined with a professional security terminology library; the fixed descriptive text is a fixed-format description generated based on preset static text in the target template and preprocessed data.

[0052] In this embodiment, multimedia elements include one or more of interactive links, images, and security watermarks, which are used to enrich the presentation format of the report and the way information is obtained.

[0053] S500 generates multimodal reports based on visual elements, text content, multimedia elements, and target templates.

[0054] In this embodiment, a multimodal report refers to a report document that integrates various content formats such as text, charts, images, interactive links, and security watermarks. This report not only includes traditional text descriptions and tabular data, but also integrates visual charts (such as line charts, pie charts, heatmaps, etc.), multimedia elements (such as interactive links, images, and security watermarks), and supports risk level color mapping, compliance item labeling, and chart drill-down functions, making the report both intuitive, interactive, and professional in its information presentation.

[0055] As an optional implementation, the method further includes: When a user inputs a report generation request, including input in natural language, the natural language processing model trained on security vertical domain corpus is invoked to parse the intent of the report generation request and obtain the intent category; the intent category includes at least threat situation intent, vulnerability analysis intent, emergency response intent, and compliance assessment intent; Adjust the content layout of the multimodal report according to the intent category.

[0056] In this embodiment, adjusting the content layout of the multimodal report according to the intent category can refer to pre-operation or post-operation.

[0057] In this embodiment, the aforementioned pre-operation refers to adding intent categories when step S500 is executed, so that step S500 generates a multimodal report based on visual elements, text content, multimedia elements, target templates, and intent categories.

[0058] In this embodiment, the above-mentioned post-operation refers to further adjusting the content layout of the generated multimodal report based on the intent category after step S500 is executed, so as to obtain an updated multimodal report.

[0059] In this embodiment, when a user describes a report requirement in natural language within a natural language input box, the method uses natural language processing technology to parse the user input, extract key information, and transform the intent parsing results into specific report generation tasks (including determining the data source, selecting a suitable template, and data processing methods, etc.), so that the user's natural language input can influence the report generation process, realizing another parallel branch of the report generation method.

[0060] For example, if a user inputs "generate a report on product sales in each region for the previous quarter, including analysis of sales revenue, sales volume, and market share, and display it in chart form", the method will parse the data and match the corresponding template accordingly to determine the data processing method.

[0061] In the above embodiments, the method can achieve intelligent template matching through joint analysis of raw source data and historical requirements. On this basis, it performs format adaptive identification and normalization preprocessing on multi-source heterogeneous data, thereby effectively avoiding parsing errors caused by data format differences. At the same time, it automatically generates matching visualization charts, text analysis and multimedia content based on the preprocessing results, and organically integrates them into a multimodal report. This makes the final output not only accurate and reliable in data processing, but also intuitive and professional in information presentation, thereby comprehensively improving the automation level of report generation, data compatibility and readability of the final report.

[0062] In some embodiments, step S100 may include: S110. Extract features from the original source data input by the user to obtain data features; wherein, the data features include one or more of the following: data type, data size, data source, data relationship, and field type distribution.

[0063] In this embodiment, the method can collect data characteristics of the raw source data input by the user. These data characteristics include one or more of the following: data type, data scale (data volume), data source, data relationship, and field type distribution.

[0064] S120, Collect users' historical report requirements.

[0065] In this embodiment, the method can record (collect) the user's historical reporting needs, such as report type, usage scenario, and data metrics of interest, while extracting features from the user's original source data.

[0066] S130. Taking data features and historical report requirements as input, call the deep learning-based intelligent recommendation model to perform multi-dimensional template matching processing to obtain a candidate template set; where multi-dimensional includes one or more of field matching degree, industry adaptability and module completeness.

[0067] In this embodiment, the method can use data features and historical report requirements as training data and input them into a deep learning-based intelligent recommendation model for training.

[0068] In this embodiment, when a user initiates a new report generation request, the intelligent recommendation model will select the most matching FreeMarker template from the template library based on the characteristics of the current input data and the user's historical needs, and recommend it to the user as a set of candidate templates.

[0069] For example, if the data input by the user is mainly sales order data and monthly sales statistics reports are frequently generated in the past, the intelligent recommendation model will prioritize recommending templates related to sales data statistics.

[0070] S140. Select the target template based on the candidate template set.

[0071] To enable users to flexibly adjust templates through simple visual operations based on intelligent recommendations, step S140 may include: S141. Receive the template selection instruction input by the user for the candidate template set.

[0072] S142. Select an initial template from the candidate template set according to the template selection instruction.

[0073] S143. When receiving a template editing instruction from the user for the initial template, adjust the initial template according to the template editing instruction to obtain the target template; wherein, the template editing instruction includes one or more of the following: adding chart placeholders, adjusting chart placeholders, and setting chart type and style parameters.

[0074] In this embodiment, users can design templates through a visual interface using drag-and-drop, selection, and other operations.

[0075] In this embodiment, users can also add elements such as text boxes, tables, and image placeholders to the interface and set their styles and layouts.

[0076] In this embodiment, the method can convert user operations into corresponding FreeMarker template code in real time, so that users can create or modify templates without manually writing code.

[0077] In this embodiment, the method also provides real-time grammar checks and error messages during the user's editing process, helping the user to promptly identify and correct problems.

[0078] In the above embodiments, the method can dynamically filter the optimal template based on each specific data input and historical preferences, avoiding generation failures or repeated manual trial and error caused by template and data mismatch, thereby significantly improving the intelligence level of template adaptation, the accuracy of recommendation results, and the user experience.

[0079] In some embodiments, step S300 may include: S310. Clean the original source data according to the data processing method that matches the analysis results to obtain the first processed data.

[0080] In this embodiment, the method can automatically clean the data based on the identified data format and structure.

[0081] For example, for numerical data, outliers and missing values ​​are detected and corrected; for text data, noise reduction and word segmentation are performed.

[0082] S320. Based on the target template and historical report requirements, the first-processed data is converted into a new format to obtain the second-processed data.

[0083] In this embodiment, the method can convert the format of the cleaned data according to the report requirements and template requirements.

[0084] Examples include standardizing date formats and converting string-type numbers to numeric types.

[0085] To ensure seamless integration between the data and the template, step S320 may include: S321. Determine the data field format based on the target template and historical report requirements.

[0086] In this embodiment, the data field format refers to the format specifications required for each data field in the target template, including field name, data type (such as numeric, text, date, etc.), data precision (such as decimal places), time format (such as year-month-day or month / day / year), and enumerated value range, etc. This format is jointly determined by the preset filling specifications in the target template and the user's historical report requirements, and is used to guide the conversion of cleaned data to the format required by the template.

[0087] S322. Convert the data format of the first processed data to the data field format to obtain the second processed data.

[0088] S330. When the second processing data includes data from multiple data sources, perform data fusion processing on the data from the multiple data sources in the second processing data to obtain preprocessed data.

[0089] In this embodiment, fusion processing refers to the process of associating and merging data from different data sources by identifying the relationships between them and using a data association algorithm when multiple data sources exist.

[0090] In this embodiment, the above process establishes a mapping relationship between data sources through a multi-level association key chain, so that information scattered in different data sources can form an organic whole, thereby providing more complete and comprehensive data support for report generation.

[0091] In order to integrate heterogeneous data from different devices and platforms into a cohesive whole, step S330 may further include: S331. Obtain the relationship between multiple data sources in the second processing data.

[0092] In this embodiment, when there are multiple data sources, the method can automatically identify the relationships between the data sources.

[0093] S332. Perform data fusion processing on the second processing data according to the association relationship between multiple data sources to obtain preprocessed data; wherein, the association relationship between multiple data sources is a multi-level association key chain, and the multi-level association key chain includes at least two levels of serial association key chains among asset identifier, vulnerability identifier and attack address.

[0094] In this embodiment, the method can fuse data from different data sources using a data association algorithm.

[0095] For example, when one data source contains basic customer information and another data source contains customer order information, this method can associate and integrate the data from the two data sources based on the customer ID, thereby providing comprehensive data support for report generation.

[0096] In the above embodiments, the method can automatically match the corresponding cleaning strategy for raw data of different formats and structures, effectively remove redundant, erroneous or invalid information, and uniformly convert the data into a standardized format according to the template requirements. At the same time, it supports intelligent association and fusion of multi-source data, thereby ensuring that the data input into the report is accurate, clean and complete, providing a high-quality data foundation for subsequent report generation.

[0097] In some embodiments, step S400 may include: S410. Generate text content based on preprocessed data and target template.

[0098] To ensure the report is both data-driven and professionally presented, step S410 may include: S411. Perform data statistics on the preprocessed data to obtain the data statistics results.

[0099] S412. Calculate indicator data based on preset compliance standards and pre-processed data; among which, indicator data includes one or more of compliance rate, repair rate, and response time.

[0100] S413. Based on the statistical results and indicator data, and combined with a professional security terminology database, generate analytical text.

[0101] S414. Generate fixed descriptive text based on the preset static text and preprocessed data in the target template; wherein the text content includes analytical text and fixed descriptive text.

[0102] In this embodiment, analytical text and fixed descriptive text constitute the text content.

[0103] S420. Based on the preprocessed data and analysis results, generate visualization elements according to preset mapping rules; wherein, the preset mapping rules include line charts for time series data, pie charts or donut charts for category proportion data, and heat maps for risk level data.

[0104] In this embodiment, the method can automatically select appropriate visualization elements based on data type and analysis results.

[0105] For example, for time series data, this method can automatically generate line charts to show the trend of data changes; for categorical data, this method can generate bar charts or pie charts to compare the proportion of different categories; for risk level data, this method can generate heat maps.

[0106] In this embodiment, the mapping rules in the security scenario include: attack trends corresponding to line graphs, vulnerability distribution corresponding to ring graphs, and asset risks corresponding to heat maps.

[0107] In this embodiment, the method also supports users to customize the style and parameters of visual elements to meet personalized needs.

[0108] S430. Obtain multimedia elements based on preprocessed data and target template; wherein, multimedia elements include one or more of interactive links, images, and security watermarks.

[0109] In the above embodiments, the method can automatically match the most suitable chart type (such as line chart for time series, pie chart for category proportion, and heat map for risk level) according to preset rules based on the characteristics and analysis results of the preprocessed data. At the same time, it generates appropriate text analysis and multimedia elements, so that the report can achieve organic unity in content description, data visualization and interactive experience, thereby significantly improving the professionalism of the report and the efficiency of information transmission.

[0110] In some embodiments, step S500 may include: S510. Integrate the visual elements, text content, and multimedia elements according to the target template to obtain the first initial report.

[0111] In this embodiment, the method can organically integrate the generated visual elements, text content, and other multimedia elements (such as images, links, etc.) according to the template requirements.

[0112] In this embodiment, the method can automatically lay out text, charts, tables and threat intelligence during the integration process, ensuring that the layout of each element is reasonable and coordinated, and that the information is conveyed clearly and accurately.

[0113] For example, in a sales report, charts of sales data are placed next to corresponding textual analysis descriptions to help users understand the meaning of the data.

[0114] S520. Apply risk level color mapping and compliance item annotation to the contents of the first initial report to obtain the second initial report.

[0115] In this embodiment, the method can perform risk level color mapping on the report content. The mapping rule is: high risk corresponds to red, medium risk corresponds to yellow, and low risk corresponds to green.

[0116] In this embodiment, the method can also automatically label compliance items, marking gaps and non-compliance items in the Cybersecurity Classified Protection 2.0 standard.

[0117] In this embodiment, the generated report chart supports drill-down functionality, allowing users to drill down to the original security log after clicking the chart.

[0118] S530. When a report editing instruction for the second initial report is received, the second initial report is edited and adjusted according to the report editing instruction to obtain the final multimodal report.

[0119] In this embodiment, starting from the user's request to generate a report, the method can automatically complete the entire process of data acquisition, data processing, template selection, report generation, and output.

[0120] In the data acquisition stage, this method can automatically connect to the corresponding data source to acquire data according to user needs and configuration; in the data processing and template selection stage, this method can adaptively perform data processing and intelligent template selection; finally, the generated report is output to the specified location in the format specified by the user (such as PDF, Word, HTML, etc.).

[0121] As can be seen, the entire process described above requires no manual intervention, which can greatly improve the efficiency and accuracy of report generation.

[0122] Throughout the entire process described above, the method also incorporates security control and reporting update mechanisms.

[0123] For example, AES-256 encryption, watermarking, and access control are automatically performed when the report is output; the entire distribution chain is audited, and audit records are kept for operations such as viewing, downloading, and modifying; at the same time, incremental updates of the report are supported, only the newly added data is refreshed, and there is no need to repeat the processing of the full data.

[0124] In the above embodiments, the method can organically integrate visual elements, text content and multimedia elements according to the template, and automatically perform risk level color mapping and compliance item labeling on the report content, making key risk points and compliance gaps clear at a glance. At the same time, it supports users to flexibly edit and adjust the report, taking into account personalized expression needs while ensuring the professionalism and standardization of the report.

[0125] The following example, using a cybersecurity service provider, illustrates the specific application process of the aforementioned report generation method.

[0126] This company provides cybersecurity protection services to clients in the finance, energy, and government sectors, and is required to submit a "Client Cyber ​​Threat Situation Report" to them monthly. Traditionally, analysts manually export data from multiple security devices, clean and integrate it using Python scripts, and then generate reports using a fixed template, a process that takes approximately three business days. Furthermore, data format differences and outdated templates often result in the omission of crucial information in the reports.

[0127] Based on this, the specific application process of this report generation method can be illustrated as follows: S610, Intelligent Template Recommendation Stage (takes approximately 4 minutes).

[0128] S611, Data Feature Acquisition.

[0129] After logging into the system (which uses the report generation method provided in this application), the security analyst from Enterprise B selects the "Customer Threat Posture Report" entry point, and the system automatically pops up a multi-source data upload interface. The analyst uploads three types of core data in batches: IDS attack logs of a financial customer (CSV format, containing 15,000 records), vulnerability scan results (Excel format, containing 800 vulnerability entries), and emergency response events (JSON format, containing 120 event records).

[0130] After the data upload is complete, the system's intelligent template management module automatically begins in-depth analysis of data features, specifically including: (1) Identify data types: By matching with a security-related keyword database (such as "attack type", "vulnerability ID", "CVSS score", and "response status"), the data was determined to contain three core categories: "threat attack data", "vulnerability risk data", and "emergency response data". A total of 58 fields were involved, including 22 enumerated fields (such as attack type: SQL injection, ransomware; vulnerability status: unpatched, being patched), 18 numerical fields (such as attack count, CVSS score), 10 time fields (such as attack occurrence time, vulnerability discovery time), and 8 text fields (such as attack IP location, response recommendations).

[0131] (2) Statistical data scale: The IDS logs cover attack records from July 1st to July 31st, 2025, with an average of 500 records per day; the vulnerability data includes 210 high-risk vulnerabilities, 450 medium-risk vulnerabilities, and 140 low-risk vulnerabilities; among the emergency response incidents, there were 35 high-risk incidents, 60 medium-risk incidents, and 25 low-risk incidents.

[0132] (3) Linking historical requirements: The system checked the analyst's report records for the past 8 months and found that the reports he generated for financial clients always included four modules: "Overview of Attack Situation", "Distribution of Vulnerability Risks", "Review of High-Risk Events" and "Compliance Compliance Status". In addition, the reports had to include attack trend charts, vulnerability level pie charts and line charts of handling timeliness. The historical templates adopted a three-layer layout structure of "risk warning - data charts - protection suggestions".

[0133] S612, Intelligent Template Matching and Recommendation.

[0134] The system inputs data features and historical requirements into a security-specific recommendation model (training data includes over 3,000 security industry report templates and over 20,000 customer report generation records). It then selects three optimal templates based on a three-dimensional scoring system: "Field Matching Degree (weight 40%)", "Industry Adaptability (weight 30%)", and "Module Completeness (weight 30%)". (1) Template 1: The "Monthly Threat Situation Panoramic Template for the Financial Industry" has a 94% matching rate and includes four modules: attack situation, vulnerability risk, emergency response, and compliance assessment. It supports automatic insertion of attack trend line charts (statistics by hour), vulnerability level ring charts, and response time heatmaps. It has served financial clients 1,200 times in the past and is adapted to the compliance requirements of the Financial Industry Information Security Protection 2.0.

[0135] (2) Template 2: The "General Enterprise Threat Analysis Template" has a matching rate of 87% and focuses on attack tracing and vulnerability remediation rate analysis, but it lacks a compliance assessment module and requires manual addition of relevant information on compliance.

[0136] (3) Template 3: The "High-Risk Incident Special Report Template" has a matching rate of 82% and focuses on emergency response details, but the attack posture and vulnerability analysis modules are simplified and cannot meet the needs of comprehensive reporting.

[0137] Based on this, the system presents the template in a combination of "template preview image, core module list, and industry adaptation cases". Template 1 is recommended by default and marked "This template has been adapted to the compliance requirements of the financial industry and has the highest matching degree with your historical report modules".

[0138] Once confirmed by the analyst, the data processing phase begins.

[0139] S620, Adaptive Data Processing Phase (approximately 10 minutes).

[0140] S621. Automatic recognition and parsing of data formats.

[0141] The adaptive data processing engine in this system will automatically initiate a special parsing process for secure data characteristics: (1) IDS attack log (CSV): The field separator is "|", the header row is in the first row, the "Attack Type" field has aliases (e.g., "SQLi" corresponds to "SQL Injection", "RDP Brute Force" corresponds to "Remote Desktop Brute-Force"), the "Attack IP" field includes internal network IP (192.168.xx.xx) and external network IP (203.xx.xx.xx), and there are 230 duplicate logs (same attack IP, same time, same attack type).

[0142] (2) Vulnerability scanning data (Excel): The identification worksheet is divided into "High-risk vulnerabilities" and "Medium-low-risk vulnerabilities" for separate storage. The "CVSS score" field is in text format (e.g., "High-risk (9.8)"). The "Vulnerability remediation deadline" field has 15 empty values. The "Vulnerability-related asset" field is in the format of "Asset name-IP" (e.g., "Core server-10.0.0.1").

[0143] (3) Emergency Response Data (JSON): The data structure is nested in 3 layers (e.g., “Event Information - Handling Process - Handling Personnel”), and four core fields need to be extracted: “Event ID”, “Event Level”, “Handling Duration”, and “Handling Result”. The “Handling Duration” field is in text format (e.g., “2 hours 30 minutes”).

[0144] Afterwards, the engine automatically generated a "Security Data Parsing Report" pop-up window: "Three types of security data formats have been identified, 230 duplicate attack logs, 15 instances of inconsistent CVSS scoring formats, and 32 instances of text formatting for handling durations have been found. These will be automatically standardized. Four core fields need to be extracted from the JSON data to correlate with vulnerability data. Do you confirm?" After the analyst clicks "Confirm," the engine starts the automated processing.

[0145] S622, Data cleaning and standardization.

[0146] Data cleaning and standardization specifically include: (1) Removing duplicate data: Based on the triple unique identifier of "attacking IP-attack time-attack type", 230 duplicate records in the IDS log were deleted, generating a deduplication log (containing 14,770 valid records), and the deduplication log (including duplicate record ID, deletion time, and retention basis) was recorded.

[0147] (2) Standardized format conversion: Extract the numerical value (9.8) from the "CVSS score" text format (e.g., "high risk (9.8)") in the vulnerability data, and classify the level according to the CVSS 3.1 standard (9.0-10.0 is high risk, 7.0-8.9 is medium risk, and 0.1-6.9 is low risk); convert the emergency response "response duration" text (e.g., "2 hours 30 minutes") into minute values ​​(150 minutes); split the "vulnerability-related asset" field into two independent fields, "asset name" and "asset IP", to facilitate subsequent analysis by asset dimension.

[0148] (3) Handling missing and outlier values: For the 15 empty "remediation deadline" values ​​in the vulnerability data, the system queries the customer's security policy (the deadline for remediation of high-risk vulnerabilities is 7 days) and automatically fills them in as "vulnerability discovery time + 7 days"; it detects 5 abnormal values ​​for "attack count" in the IDS log (such as 10,000 times / hour, far exceeding the daily average of 500), judges them as false alarms of the device, marks them as "invalid logs" and excludes them, and notes this in the data processing report.

[0149] (4) Threat intelligence correlation: The system accesses the enterprise's internal threat intelligence database and matches the location and threat tags of 1,200 external attack IPs in the IDS logs (e.g., IP 203.xx.xx.xx belongs to "Foreign Hacker Organization A" and is tagged "Ransomware Attack Source"). This information is then added to the "Attack IP Details" field to enhance the ability to report and trace the source of threats.

[0150] S623, Multi-data source fusion and association.

[0151] The fusion and association of multiple data sources specifically includes: (1) Core field association: Using "vulnerability ID" as the association key, vulnerability data is associated with emergency response data (matching rule: "Vulnerability ID matches + event type = vulnerability response"). 180 records were successfully associated (i.e., the response process for 180 vulnerabilities has been initiated), and 620 unassociated vulnerabilities were marked as "pending response". Using "asset IP" as the association key, vulnerability data is associated with IDS logs, identifying 35 "high-risk assets" (assets with high-risk vulnerabilities and that have been attacked ≥50 times).

[0152] (2) Summary of security dimensions: A summary table is generated based on three core dimensions: "Attack Type," "Vulnerability Level," and "Resolution Result." Table 1: Summary of Attack Types (including attack type, number of attacks, number of IPs involved, threat tags, and top 3 attacking IPs) Table 2: Summary of Vulnerability Risks (including vulnerability level, number, asset type, remediation rate, and average remediation time) Table 3: Summary of Emergency Response (including event level, number of responses, success rate, average response time, and reasons for non-response) (3) Compliance indicator calculation: Automatically extract the compliance data required for the report, such as "high-risk vulnerability repair rate ≥ 90%" and "emergency response time ≤ 1 hour" in the Level 3 requirements of Information Security Level 2.0, calculate the customer's current compliance compliance rate (high-risk vulnerability repair rate 85%, emergency response compliance rate 92%), and provide data support for the compliance assessment module.

[0153] After the above data processing is completed, the system automatically generates a "Security Data Processing Summary Report" to show the comparison of data before and after cleaning, correlation results, and the calculation process of compliance indicators.

[0154] At this point, analysts can click "View Details" to verify the accuracy of the data. Once the analysts confirm that the data is correct, the report generation stage will begin.

[0155] S630, Multimodal Report Generation and Editing Stage (approximately 6 minutes).

[0156] S631, Automatic report generation.

[0157] The system can automatically generate a draft of a multimodal report based on financial industry-specific templates and processed data. (1) Text content generation: The system automatically generates analysis texts based on a professional security terminology database, such as: "In July 2025, the customer's core network detected 14,770 attacks, of which SQL injection attacks accounted for 35% (5,169 times), mainly originating from the overseas IP segment 203.xx.xx.0 / 24, which has been marked as 'attack source of hacker group A'; a total of 800 security vulnerabilities were discovered, including 210 high-risk vulnerabilities, with a current repair rate of 85%, which does not meet the Level 3 requirement of 'high-risk vulnerability repair rate ≥ 90%' of the Information Security Classification 2.0, and requires close attention." "The average handling time for 35 high-risk emergency incidents was 45 minutes, with a 100% success rate, which is better than the industry average (60 minutes)."

[0158] (2) Insertion of visual elements: Automatically insert security-specific charts according to the template layout, such as "Attack Trend Chart" (line chart, X-axis is hour, Y-axis is attack count, and attack type is distinguished by color), "Vulnerability Level Distribution Ring Chart" (marking the number and percentage of vulnerabilities at each level), "Asset Vulnerability Risk Heat Map" (displaying vulnerability density by asset IP segment, the darker the color, the higher the risk), and "Resolution Time Comparison Chart" (bar chart, comparing customer resolution time with industry average time).

[0159] (3) Data table filling: The data from Tables 1-3 will be automatically populated into the template table. The tables will be marked with risk level colors (high risk red, medium risk yellow, low risk green). Risk warning labels will be added to numerical fields (e.g., a vulnerability remediation rate of 85% will be marked with "Not Met" in red font). Threat intelligence annotations will be attached next to key data (e.g., "Associated with hacker group A" will be marked next to the attacking IP).

[0160] S632, Template Fine-tuning and Personalized Editing.

[0161] After reviewing the initial draft, the analyst needs to make two targeted adjustments: (1) Added special modules: Add a "High-Risk Vulnerability Tracking" submodule after the "Emergency Response" module. Click "Add Component" and select the "Vulnerability Tracking Table" template. The system will automatically extract 31 unpatched vulnerabilities out of 210 high-risk vulnerabilities and generate a tracking table containing "Vulnerability ID, Asset IP, Discovery Time, Repair Deadline, and Responsible Person". Set a red warning for "Overdue Repair" (e.g., 2 vulnerabilities have exceeded the repair deadline).

[0162] (2) Adjust the chart dimensions: Add an "Attack Time" dimension to the "Attack Type Distribution Pie Chart" (divided into 0-6 AM, 7-6 PM, and 7-11 PM). Click "Dimension Settings" on the chart to add a "Time Segment" field. The system will update the chart in real time to a stacked pie chart with "Attack Type - Time Segment" dimensions, clearly showing the key conclusion that "SQL injection attacks account for the highest proportion (42%) between 7-11 PM".

[0163] During the above editing process, the system provides a "security compliance verification" function, which provides real-time prompts to indicate whether the report meets compliance standards such as Cybersecurity Classified Protection 2.0 and PCI DSS (e.g., "The current high-risk vulnerability repair rate is 85%, which does not meet the Level 3 requirements of Cybersecurity Classified Protection 2.0. It is recommended to supplement the rectification suggestions"), ensuring that the report meets the customer's compliance requirements.

[0164] S640, Intelligent Interaction and Report Output Stage (approximately 3 minutes).

[0165] S641. Supplementing Natural Language Requirements and Adjusting Tasks.

[0166] Analysts found that the report did not include "details of attack IP attribution". They entered the following in the natural language interactive box: "Add a 'TOP 5 Attack IP Attribution' sub-module to the 'Attack Overview' module to display the IP address, location, threat tag, number of attacks, and protection recommendations."

[0167] Based on this, the system analyzes the requirements using a security-related NLP model: (1) Core requirements: A new sub-module, "TOP 5 Attack IP Tracing," has been added and is now part of the "Attack Situation Overview."

[0168] (2) Data requirements: Extract the top 5 most attacked external IPs from IDS logs, correlate them with the threat intelligence database to obtain their location and threat tags, and generate protection recommendations (such as "configure firewall IP blacklist") based on the customer's protection device type.

[0169] (3) Display requirements: Using a combination of "IP details table and protection advice text", high-risk IPs are marked with a red warning.

[0170] (4) Automatic system response: "The requirements have been understood. We will match the details of the top 5 attacking IPs from the threat intelligence database to generate a source tracing submodule. Do you want to continue?" The analyst clicked "Continue." The system completed data extraction and module insertion within 15 seconds. The supplementary information included "IP203.xx.xx.123 (Origin: Overseas, Threat tag: Ransomware distribution source, Number of attacks: 890, Protection recommendation: Add to firewall blacklist immediately and deploy IDS signature rules)".

[0171] S642. Report Format Selection and Output.

[0172] After the analyst confirms that the report content is correct, they click "Generate Report," and the system provides a security industry-specific output format: (1) Encrypted PDF format: Supports AES-256 encryption (to prevent client report leaks), allows setting an opening password and access password (restricting copying and modification), automatically adds the client's logo and "Confidential" watermark to the header, and includes "Report Generation Time, Analyst Name, and Contact Information" in the footer.

[0173] (2) Interactive HTML format: It supports vulnerability data drilling (click the vulnerability ID to view detailed vulnerability descriptions and remediation solutions), attack log export (filter by attack type and download CSV), and can be embedded into the customer's security management platform for real-time data synchronization.

[0174] (3) Compliant export format: Specialized attachments are generated according to standards such as Cybersecurity Classified Protection 2.0 and PCI DSS, such as "Cybersecurity Classified Protection Compliance Gap Analysis Table" and "Vulnerability Remediation Plan Timeline," to facilitate customers' submission to regulatory authorities for review.

[0175] At this point, the analyst can select "Encrypted PDF format" and set an opening password (a password provided by the client), while also checking "Add confidential watermark" and "Generate compliance attachments", and then click "Confirm Output".

[0176] The system will generate the report within 1.5 minutes. The final PDF report will be 35 pages long and will include: Cover (including customer name, reporting period, confidentiality level), risk warning summary (1 page), attack posture overview (8 pages), vulnerability risk analysis (10 pages), emergency response review (7 pages), compliance assessment and recommendations (6 pages), information security compliance attachments (3 pages). All data are marked with their source (e.g., "Data source: Customer IDS device (manufacturer: a security company, model: IDS-2025) July 2025 log").

[0177] S643, Report Distribution and Access Control.

[0178] The system provides a tiered distribution function to address the sensitive nature of security reports: (1) Customer distribution: Send via the enterprise's encrypted email system. The email body contains only a report summary and a download link (valid for 24 hours). The link requires the customer to enter a unique password to download. It is also pushed to the customer's security management platform "Report Center" and can only be viewed by the customer's designated administrator.

[0179] (2) Internal distribution: Permissions are set according to roles, such as the sales team only viewing the "Customer Risk Summary", the technical team viewing the full report, and management viewing the "Customer Risk Summary and Service Optimization Suggestions"; all internal viewing records are generated into audit logs (including viewing personnel, time, and operation) to prevent internal leaks.

[0180] If the analyst completes the "client encrypted email distribution and internal technical team permission settings" and enables the "report update reminder" function (the system will automatically push a report update notification if the vulnerability remediation status is updated later), then if additional data is needed later (such as new vulnerability scan results from the client), they can directly click "report update" so that the system can automatically reuse historical data processing rules and templates, updating only the newly added data. This process (report iteration process) can be completed within 1 minute.

[0181] In summary, the traditional manual method for producing this report would take approximately 3 working days, while applying this method reduces the total time from data upload to final report output to only about 23 minutes (4+10+6+3). It's easy to understand that these time figures clearly demonstrate the significant time savings achieved by this method.

[0182] like Figure 2 As shown, some embodiments of this application provide a schematic diagram of a report generation apparatus. It should be understood that this apparatus is related to... Figure 1 The method executed in the middle corresponds to the steps involved in the aforementioned method. The specific functions and effects of the device can be found in the description above. To avoid repetition, detailed descriptions are omitted here.

[0183] The report generation device includes: Matching unit 710 is used to match target templates based on the user-input raw source data and historical report requirements; Analysis unit 720 is used to perform format analysis on the raw source data and obtain analysis results; The preprocessing unit 730 is used to preprocess the original source data according to the analysis results to obtain preprocessed data; The element generation unit 740 is used to generate visualization elements, text content, and multimedia elements based on preprocessed data, target templates, and analysis results. The report generation unit 750 is also used to generate multimodal reports based on visual elements, text content, multimedia elements, and target templates.

[0184] In some embodiments, the specific implementation of each unit in the report generation device corresponds one-to-one with the steps in the aforementioned method embodiments, and will not be repeated here.

[0185] like Figure 3As shown, this application provides an electronic device 800, which includes a processor 801 and a memory 802. The processor 801 and the memory 802 are interconnected and communicate with each other through a communication bus 803 and / or other forms of connection mechanism (not shown). The memory 802 stores a computer program that can be executed by the processor 801. When the computer program is run, the processor 801 executes the computer program to perform the method in any of the aforementioned optional implementations.

[0186] This application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the method in any of the aforementioned optional implementations.

[0187] The computer-readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0188] This application provides a computer program product, which includes a computer program that, when run by a processor, executes the method in any of the aforementioned optional implementations.

[0189] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and not to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. These modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application, and they should all be covered within the scope of the claims and specification of this application. In particular, as long as there is no conflict, the various technical features mentioned in the embodiments can be combined in any way. This application is not limited to the specific embodiments disclosed herein, but includes all technical solutions falling within the scope of the claims.

Claims

1. A report generation method, characterized in that, include: Match the target template based on the user's input of raw source data and historical report requirements; The original source data is subjected to format analysis to obtain the analysis results; Based on the analysis results, the original source data is preprocessed to obtain preprocessed data; Based on the preprocessed data, the target template, and the analysis results, visual elements, text content, and multimedia elements are generated. A multimodal report is generated based on the visualization elements, the text content, the multimedia elements, and the target template.

2. The report generation method according to claim 1, characterized in that, The process of matching target templates based on user-input raw source data and historical report requirements includes: Feature extraction is performed on the raw source data input by the user to obtain data features; wherein, the data features include one or more of the following: data type, data size, data source, data relationship, and field type distribution; Collect users' historical report requests; Using the data features and the historical report requirements as input, a deep learning-based intelligent recommendation model is invoked to perform multi-dimensional template matching processing to obtain a candidate template set; wherein, the multi-dimensional factors include one or more of field matching degree, industry adaptability, and module completeness. Select the target template based on the set of candidate templates.

3. The report generation method according to claim 2, characterized in that, The step of selecting a target template based on the candidate template set includes: Receive template selection instructions input by the user for the candidate template set; An initial template is selected from the candidate template set according to the template selection instruction; When a template editing instruction is received from a user regarding the initial template, the initial template is adjusted according to the template editing instruction to obtain the target template; The template editing instructions include one or more of the following: adding chart placeholders, adjusting chart placeholders, and setting chart type and style parameters.

4. The report generation method according to claim 1, characterized in that, The step of preprocessing the original source data based on the analysis results to obtain preprocessed data includes: The original source data is cleaned according to the data processing method that matches the analysis results to obtain the first processed data; The first processed data is format-converted according to the target template and the historical report requirements to obtain the second processed data; When the second processing data includes data from multiple data sources, data fusion processing is performed on the data from the multiple data sources in the second processing data to obtain preprocessed data.

5. The report generation method according to claim 4, characterized in that, The step of converting the format of the first processed data according to the target template and the historical report requirements to obtain the second processed data includes: The data field format is determined based on the target template and the historical report requirements; The data format of the first processed data is converted into the data field format to obtain the second processed data.

6. The report generation method according to claim 4, characterized in that, The step of performing data fusion processing on data from multiple data sources in the second processed data to obtain preprocessed data includes: Obtain the relationships between multiple data sources in the second processed data; Based on the correlation between the multiple data sources, the second processed data is fused to obtain preprocessed data; The relationship between the multiple data sources is a multi-level association key chain, which includes at least two levels of serial association key chains among asset identifiers, vulnerability identifiers, and attack addresses.

7. The report generation method according to claim 1, characterized in that, The step of generating visualization elements, text content, and multimedia elements based on the preprocessed data, the target template, and the analysis results includes: Based on the preprocessed data and the target template, generate text content; Based on the preprocessed data and the analysis results, visualization elements are generated according to preset mapping rules; wherein, the preset mapping rules include time series data corresponding to line charts, category proportion data corresponding to pie charts or donut charts, and risk level data corresponding to heat maps; Multimedia elements are obtained based on the preprocessed data and the target template; wherein, the multimedia elements include one or more of interactive links, images, and security watermarks.

8. The report generation method according to claim 7, characterized in that, The step of generating text content based on the preprocessed data and the target template includes: The preprocessed data is statistically analyzed to obtain statistical results. The indicator data is calculated based on the preset compliance standards and the preprocessed data; wherein, the indicator data includes one or more of the following: compliance rate, repair rate, and response time. Based on the statistical results and indicator data, and combined with a professional security terminology database, analytical text is generated. Based on the preset static text in the target template and the preprocessed data, generate fixed descriptive text; The text content includes the analytical text and the fixed descriptive text.

9. The report generation method according to claim 1, characterized in that, The process of generating a multimodal report based on the visualization elements, the text content, the multimedia elements, and the target template includes: The visualization elements, text content, and multimedia elements are integrated according to the target template to obtain a first initial report; The content of the first initial report is processed by risk level color mapping and compliance item annotation to obtain the second initial report; When a report editing instruction is received for the second initial report, the second initial report is edited and adjusted according to the report editing instruction to obtain the final multimodal report.

10. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a computer program, and the processor running the computer program to cause the electronic device to perform the report generation method according to any one of claims 1 to 9.

11. A readable storage medium, characterized in that, The readable storage medium stores a computer program, which, when executed by a processor, performs the report generation method according to any one of claims 1 to 9.

12. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, performs the report generation method according to any one of claims 1 to 9.

Images